Agreguesi i feed

Hello,

Here’s some thoughts on software for August.

Bear with me on these broad categories but I think you can group most software projects into one of these groups: art, infrastructure, and activism.

Art is primarily to communicate experiences and feelings to others. Making video games is art. Making digital musical and instruments and visual effects is art. The drawing you did as a child that’s stuck on somebody’s fridge is art. The 3rd year computing student’s university coursework, uploaded to Github without comment and abandoned forever… that’s art, or at least, it’s a sketchbook. The thorny entry to the IOCCC, the optimized inner loop deep in some graphics toolkit, that only a handful of people will ever look at, but all of them will agree: that’s art.

People make art for fun, learning and practice.

Infrastructure is stuff that is needed and expected for the world to function. The definition of infrastructure changes over time, as societies adopt and depend on new technologies. Roads, milk delivery, electricity, bakeries, aqueducts, supermarkets, the internet, trams, the lift in your apartment building, and so on. Many societies depend on software projects now. Web browsers, phone cells, operating systems, social networks, software developer tools, power grid management, Google Maps, and so on.

People make infrastructure for money, or perhaps out of a sense of duty.

Activism is a desire to bring about a particular social or political goal or change. I don’t know when the first activist software project started, but it was no later than the 1980s when the GNU project began its stated mission to make proprietary software unviable via copyleft, and many free software projects followed along. The design of the GNU C compiler was shaped by the mission. Tor began in the 2000s with the goal of ensuring private, uncensored internet access. Bitcoin began with the stated aim of destroying the financial system, the wake of the 2008 bank crisis. Although in many countries it’s now regulated financial infrastructure, which shows you that projects can move between these categories over time.

People spend our energy on activism based on our beliefs, usually a sense of wanting to make the world a better place for everyone, or at least for ourselves, and our friends and family.

Not everything fits into these categories (the biggest gap I can see is experiments and research) but let’s keep this short, I want to use them to look at the conversations I keep seeing in the open source world this year.

When one person sees a project as activism and another sees it as infrastructure, you see some genuinely confused conversations happening.

Codeberg banned projects with largely AI generated code from the site, and Sourcehut is considering doing the same. If you see these projects as Git hosting infrastructure similar to Gitlab and Github, then that decision makes very little sense. Why would they want to host fewer projects? However if you see the project as a group of activists trying to reduce the power and influence of US tech firms, and limit the harms of rapid of adoption of AI, then it makes a lot of sense.

Linux decided to allow some LLM use and not put too many limits, as long as its making the project better. If you see Linux as a bunch of engineers building infrastructure then it’s a very logical decision. But if you thought your contributions were part of some activist movement then that might be a disappointing decision.

Every so often I hear someone say things like “please keep politics out of software”. You can infer that they’re probably talking about infrastructure software — and it’s as misguided as if they said it about any other infrastructure. Is an aqueduct political? If one country is seen as stealing another country’s water then… yes. Can a shipping lane be political? Yes, see numerous examples, including the ongoing US-Iran conflict. Can a road be political? Yes, if it crosses a border, especially if it’s in dispute. Ask someone old from Berlin or the north of Ireland about whether roads can be political.

Maintaining software takes a lot of effort. If someone is putting in that effort without being paid, they have some other motivation for doing it. Humans rarely do difficult, laborious work for no reason. Our motivation might be to learn, to show off, to have fun, to meet people, to collaborate with friends, or it might be to work towards some kind of political or societal change. I’ve probably contributed to open source for all of these reasons at different times.

We are increasingly referring to open source software as “digital infrastructure” and funding some of the maintenance work via corporate money and public money. This is great, but it requires the project to frame itself as infrastructure rather than activism. You are unlikely to get funding from Microsoft if you openly state that your goal is to destroy Microsoft. You are unlikely to get funding from a government if your stated goal is to destroy the modern financial system or prevent all forms of censorship.

Activists using open source licenses have something of a problem to deal with. If your goal is to bring about world peace, you hardly want people building drones and missiles using the software you develop. Yet the open source movement have made it clear that if you try to limit who can use your software, it’s no longer open source. And, many software engineers have made it clear they don’t give a shit about software licensing anyway and they’ll use your code however they want without even reading the license.

You can control access to software infrastructure, of course, just like you can put soldiers and passport controls on a bridge or a road. But you can’t call it open source any more.

The GNOME desktop project is art, infrastructure and activism. The discussion on Reddit is mostly people who design and post desktops and themes for fun. Several corporations build products with GNOME, and treat it as infrastructure. And then there are contributors who want to bring about change, perhaps weakening the power of Big Tech by spreading an ethical alternative to Android and iOS.

GNOME hasn’t made a statement on AI use, and I don’t think we’ve tried very hard to discuss it so far. I wonder if we’re putting it off because we’d have to also discuss whether our goal is to maintain some infrastructure, or build something cool-looking, or bring about meaningful societal change?

Over the summer of 2026, I worked towards bringing the option of playing Vocab-Style puzzles to GNOME Crosswords as part of Google Summer of Code. This entailed adding support to the puzzle library, and writing the backend of the algorithm responsible for grid generation. Jonathan Blandford provides a thorough rundown on the ins and outs of Crosswords with these slides.

The first few weeks of the start of GSoC were spent by adding a drop-down calendar widget to Crosswords Editor, and storing GDate data as ISO8601. We decided to integrate this into my design despite it not being directly related to the proposed project because it still contributed to the Crosswords app.

For the new puzzle type, I started with adding support to the puzzle library, libipuz, which is responsible for formatting and representing puzzles styled as ‘paper-and-pencil’ crosswords. My primary mentor and I bounced ideas back and forth for some time before we started designing and writing the algorithm. We landed on an idea and I created an initial design document for the plan of action to follow for the summer. We decided that aiming for both the backend and frontend in one summer may be more work than we initially thought, so we concluded on focusing exclusively on getting a working algorithm to build from.

The bulk of this summer consisted of writing and reconfiguring the depth-first search backtracking algorithm.

 

GitLab Links to Code:

An overview of my GitLab profile can be found here.

• Implementation of New Vocab Puzzles
  • This is the bulk of the algorithm and unit tests. The user inputs a word, the word gets analyzed in a recursive function to check for crossings and constraints, we save the state of the board, backtrack if needed, and present a grid.
• Vocab Ipuz
  • Adding new class for IpuzVocab to support vocab puzzles in the puzzle library (libipuz).
• Check for Island Words
  • There may be a word in a list that may not share any intersection points with any others no matter how many backtracks are done. Consequently, this affects grid creation in a timely manner and may prevent grid generation at all by stating it false. We can compare the bitmask of words in the list before we even activate the algorithm to detect a word that would potentially conflict with the others.

• Date Validation
  • Previously, the Crosswords Editor had a free-for-all AdwEntryRow. However its purpose is to present a legible date to the user, and store the date in ISO8601 format. I used GDateTime, GDate, and a Gtk Calendar widget to add a drop-down calendar in the date box. The chosen date presented in Gregorian style to the user, and stored as ISO8601 to the backend.
• Added Dispose to Shapebg
  • Releases references to GObjects that Shapebg owns and frees Shapebg’s remaining memory.

 

Design Docs:

• Updated Design Doc
•  Vocab Design Doc

 

Blog Post Links (Most Recent -> Oldest):

• GSoC 2026 Final Report – Laureen Caliman
• Vocab-style Crosswords Update | Final Stretch
• Intern Experience at GUADEC
• Update on Crosswords Backtracking Algorithm
• Pick a Word, Any Word
• Extending Libipuz
• GSoC Project Start
• Introduction Post

 

I also gave a lightning talk at the 2026 GNOME Users and Developers European Conference here. Thank you to the GNOME Travel Committee for making that opportunity possible.

I still have some work to do for both Libipuz and Crosswords: finish the island-checking function detailed above, open a new MR to choose the most compact/square grid out of 500 options and present that to the user directly rather than them cherry-pick through a large selection,  create a new MR to add photos of the puzzle in libipuz using gi-docgen, convert the 500-generated grid code to a PuzzleTask, and incorporate the frontend to make this a fully-functioning part of the game.

I would like to thank my primary mentor, Jonathan Blandford, and my other mentor, Federico Mena Quintero, for their guidance, feedback, patience, and teaching. This program was exactly what I needed to become better at development and serves as my rock to open-source contributions. I learned a lot of valuable skills such as document reading, how much to push in a commit, how to slow down trying to get a lot done at once, but simultaneously how to speed up my progression on the parts that actually matter, code with brevity, and a whole lot of dealing with nasty version control!

I intend to continue contributing to GNOME Crosswords as well as the overall GNOME Foundation. I look forward to collaborating with more people involved in the Foundation!

 

A rapidly developing El Nino is already reaching record-setting levels for this time of year and is expected to intensify further over the coming months. "The El Nino has blossomed. It is off the charts. Usual measures of El Nino have blown past prior record levels in the period with good data, even though maximum effects are still several months in the future," writes renowned climate scientist James Hansen at Columbia University in New York in a newsletter sent today. Climate scientists disagree over whether it has already surpassed previous "super El Nino" events on every metric, but several say the signal is unprecedented in forecasts and could ultimately become the strongest modern event on record. New Scientist reports: There are different ways of measuring El Ninos, which occur when warm surface waters spread eastwards along the equator across the surface of the tropical Pacific Ocean. Hansen thinks the best measure is how much warmer than usual the upper 300 meters of the eastern tropical Pacific becomes. "Our preferred metric, the heat anomaly in the upper 300 meters of the Equatorial Pacific Ocean... already exceeds the 1997-98 super El Nino," he writes. [...] What's clear is that this developing super El Nino will soon exceed previous events on all measures. "I have never seen an El Nino signal this intense in our forecasts," [Adam Scaife at the Met Office, the UK's national weather service] said in a statement released today. "If the forecast is accurate... then 2026 will far exceed our recent experience of El Nino and its worldwide climate influences." While Hansen is comparing the developing super El Nino to other modern events for which we have direct temperature records, Hayley Fowler at Newcastle University in the UK thinks it could also exceed historical events suspected to be even larger. "The super El Nino evolving in the Pacific will likely be the biggest ever recorded, reaching or exceeding the levels of the 1877-1878 El Nino which caused widespread impacts, including famines and around 50 million deaths (3-4 percent of the global population at the time), mostly across Asia and South America," Fowler said in a statement.

Read more of this story at Slashdot.

An anonymous reader quotes a report from ZDNet: According to a Bloomberg report, attributed to China's Ministry of State Security, the country has ordered some government agencies to drop Windows 10 China Government Edition for Chinese-made Linux distributions. Why not Windows 11? Because China, like many other non-US governments, no longer trusts American companies with their software and services. This approach is all about digital sovereignty. In addition, even before the recent trend of governments outside America moving away from Windows, Beijing has started a long-running push to replace foreign technology in sensitive systems with domestic, open-source alternatives. [...] The Chinese government did not specify which Linux versions would replace Windows 10. However, the stock prices of Chinese Linux suppliers, Kylin Software and Tongxin Software Technology (commonly known as UnionTech), immediately jumped. These companies' respective operating systems, Kylin OS (no relation to Ubuntu Kylin) and UnionTech OS (UOS), were already positioned as domestic desktop and server replacements for Windows in government, state-owned enterprise, and critical-infrastructure environments. [...] Huawei's HarmonyOS 2, which began as an Android variant but is now a proprietary mobile and Internet of Things (IoT) operating system, is also being developed into a PC platform. HarmonyOS 2 won't be deployed anytime soon. Kylin and UOS are the only mature desktops that are ready for institutional desktop deployments. [...] ... this transition won't be easy. For agencies now moving off the government Windows build, the issue will be more demanding than simply swapping one desktop interface for another. Migration requires application testing, peripheral and driver validation, identity system integration, document-format compatibility, staff retraining and, in many cases, replacement or adaptation of Windows-dependent line-of-business software. The report provides no details on exactly how this transformation will occur. But the speed of the shift suggests that these issues are already being addressed in China's centralized managed desktop stack.

Read more of this story at Slashdot.

Overview

My project was to write the Pitivi Timeline Ruler in Rust using GTK4 and create GObject bindings for it. The project goals overall went well, and I was able to complete the widget successfully along with adding a layout manager structure to the ruler for child widgets to be added from the Pitivi/Python side. My standalone repository contains a working Python demo to verify successful FFI functionality.

Integration into the Pitivi application is not complete. The GTK4 port branch is still a work in progress and is not quite ready yet for deployment.

My commit adding the ruler to the WIP GTK4 branch can be found here.

My repository containing all of my commits and the standalone widget with demos can be found here

Plan Going Forward

I will stay actively involved in the GTK4 porting effort, apply for GNOME membership and stay involved in the Pitivi project. The GNOME community has been very welcoming, and I plan on continuing to contribute both to Pitivi and the broader GNOME ecosystem for the foreseeable future.

Design General Architecture

A major structural change that has been made after mentor feedback was to move application orchestration out of the widget itself, and keep more of the logic on the app side. The design is a "dumb widget, smart app" framework, where the ruler does not own editor policy.

The app provides the logic for how to handle gestures and what to do when the user interacts with the widget. One example of this is that project_duration was removed as a property entirely, and logic around bounds is now handled entirely on the app side. This allows the widget to be used in a variety of contexts, and allows the app to handle bounds in whatever way is appropriate for the context.

The rendering code also received a fairly large cleanup. Previously, the widget stored several pieces of drawing state separately, including adjustments, cached Pango layouts, and font descriptions. These have now been grouped into a single DrawingState struct behind one RefCell. This made ownership easier to follow, and allows the code to release it's mutable state borrow before connecting or disconnecting signals.

I also introduced a labels_dirty flag so timeline labels are only recalculated when they're actually needed during the snapshot phase, rather than repopulating the cache with every setter or adjustment call.

The widget follows font and color settings from the users GTK4 theme, allowing user theme changes seamlessly.

Time Markers

The ruler utilizes a BTreeMap to cache the text markers that are visible at the current window size plus a half a screen size buffer over either edge. I used a BTreeMap because it offers high efficiency insertion, deletion, and lookup for this case where our markers are sorted.

The ruler recalculates the spacing needed between labels by calculating an intentionally wide timecode using the current font and some padding. This measurement is cached until a change in frame-rate or font invalidates it.

Labels include frames when zoomed in below 1 second, and drop the frame count when zoomed out past that point.

Major Ticks and Intervals

Major divisions are calculated using a two-mode strategy. First, the pixel density is calculated to determine whether a one-second interval can meet the minimum label spacing. If so, frame-aligned intervals are used, with the smallest interval meeting the minimum label spacing selected.

If one second is too narrow for a label, frame alignment is abandoned in favor of whole-second intervals, selecting the smallest interval that meets the minimum label spacing from a pre-defined list. This list can be tuned later to meet Pitivi's UI needs.

Minor Ticks

After discussing ticks with some video editors, I realized that frame alignment is more important to the video editing community than clean time divisions. Because of this, I made the decision to implement a reverse modulo loop to consider possible intervals from largest to smallest that accurately divide frames. The resulting spacing is also checked against the minimum tick spacing to make sure we don't end up with a block of ticks that are too close together. The result is that our minor ticks are asymmetrical and are not even as the user zooms in and out, but they do always accurately divide by frames in the major interval.

Layout Manager & Layout Child

We needed some mechanism to position arbitrary external widgets (play-head, markers, loop-brackets) on the timeline. The timeline uses nanosecond timestamps, so the parent ruler determines x-cords for the children based on the zoom and horizontal scrolling position.

I introduced two objects (public C-wrapper and Engine):

1. PitiviTimelineLayoutChild
   • Subclasses gtk::LayoutChild.
   • Metadata wrapper for generic widgets dropped onto the timeline.
   • Adds a custom GObject property for timestamp.
2. PitiviTimelineLayoutManager
   • Subclasses gtk::LayoutManager and is installed on PitiviTimelineRuler.
   • Creates the custom layout child for each child widget.
   • overrides measure() and allocate().

During allocation, the manager reads the ruler's ns_per_pixel, horizontal adjustment, and the child's time stamp to determine the child's x-coordinate. The child is centered on it's time stamp and scrolls with the ruler. The Python demo shows an example using ruler.add_marker(playhead, 0) to add a play-head at the start of the timeline.

Bindings and Build

The FFI layer in ruler.h and capi.rs expose the following small API:

• pitivi_timeline_ruler_new() creates a ruler as a GtkWidget.
• pitivi_timeline_ruler_clocktime_from_pos() converts an x coordinate to a nanosecond time stamp.
• pitivi_timeline_ruler_add_marker() adds a child widget at a time stamp and returns a layout-child object.
• The properties of the ruler are exposed as GObject properties, and can be set and retrieved using standard GObject property accessors.

The Process Challenges

The FFI bindings were a major challenge for me. I ran into significant challenges fixing bugs and understanding conceptually how the Rust bindings actually worked. My initial FFI attempt did compile, but I had to work through significant GTK initialization and headless CI issues. The fixes show up in my commit history as changes of a couple of small lines of code, but the time spent understanding the issues was significant.

I also came into this with very limited knowledge about Flatpak and Meson. Getting myself to a point where I understood what the build systems were doing took a significant amount of effort. I think I spent about the same amount of time reading about GIR, GObject, Flatpak and Meson as I did writing the code. For a very small percentage of the actual code, those tools required the most attention. I view this learning as really valuable for future work in the GNOME space, and I tried to take as much time as I could afford to do my best to genuinely deepen my understanding.

The rendering logic, while similar to previous GTK4 widgets I had built, ended up having numerous rounds of refactoring and learning. I wrote about 4 different strategies for scaling, multiple designs for splitting time and frames and multiple minor tick rules. Even once I was settled on a design, I had multiple waves of finding cache inefficiencies, clearing stale entries, and removing precision and allocation bugs. The ruler is visually small, but the underlying math and rendering logic took quite a bit of work to really get to a professional standard. I would not be surprised if the logic changes again in the future as I continue to work on the Pitivi GTK4 port and get feedback from the community.

Major Milestones

• May 3: Built the initial window render as a standalone GTK4 application.

• May 8: Added the initial GObject getter/setter structure, a GtkScrolledWindow test, and zoom bounds.

• May 9-13: Drew the initial major and minor ticks, changed the scale to nanoseconds per pixel, and added Pango labels to test scale behavior.

• May 14-28: Reworked time stamp math, wrote code to extract frame-rate from video's GES timeline which was later scrapped, and refactored rendering of ticks to draw a single interval and then paint it repeatedly across the ruler.

• May 30-June 4: Wrote the dynamic label-width measurement, minimum tick spacing, and frame-oriented major/minor interval selection structure. Added gtk::Scrollable interface to the ruler.

• June 6-26: Refined cache eviction for scrolling. I also addressed zoom drift, font and DPI changes, adjustment-signal cleanup, and precision around the playhead coordinates. I wrote the unit tests for subdivision and timecode math in this period as well.

• June 30-July 3: Removed redundant APIs, moved gesture handling to the app side, refactored types throughout the codebase, and removed the widget's project-state ownership.

• July 5-25: Created the initial FFI bindings and the layout manager and layout child, and then attended GUADEC in A Coruña, Spain. I managed to resolve the GTK initialization CI issues and successfully exposed the ruler and layout child.

• July 26-29: Added dirty-label cache invalidation and consolidated the rendering state into DrawingState struct. These optimizations simplified borrow management and reduced thrashing the Pango cache.

• August 1-12 - Added the Python demo to python/test.py, fixed allocation updates for children widgets near the start of the ruler during zoom changes, added Meson build, added the Meson test target that runs the Rust tests.

• August 12-Present: I am currently battling through adding my ruler to the Pitivi GTK4 port branch.

Special Thanks

I would like to send a massive thank you to my mentors, Yatin and Alex Băluț. I was going pretty significantly off track a few times throughout the project and I got nudged in the right direction at some critical moments.

I would also like to thank the GNOME travel committee. Getting to attend GUADEC was a really incredible experience. Sergey Bugaev took a lot of time to sit and work through some of my bugs with me and help provide some guidance. As a long time GNOME daily user, getting to spend time and meet maintainers and Federico was a really exciting opportunity.

GSoC has been a great experience, and I am very grateful for the opportunity to work on this project. I am looking forward to continuing to contribute to the GNOME ecosystem.

Ypsilanti Township, Michigan, has imposed a six-month moratorium on "major electric utility infrastructure" in its latest attempt to delay a proposed $1.2 billion University of Michigan-Los Alamos data center that would support nuclear-weapons research. Township leaders, who have already paused water service for data centers, say the project has moved forward without adequate consultation and want more time to study noise, grid impacts, and other effects on residents. 404 Media reports: Last year, the university announced it was partnering with LANL on the construction of a massive 220,000 square foot hyperscale data center in Ypsilanti Township and residents have been fighting it ever since. During a meeting of the Township Board on August 18, the council unanimously passed a resolution that will delay the construction of new electrical infrastructure for 180 days. Data centers need a lot of energy, and Michigan's power authority will have to build new substations in the Township to power the proposed facility. The moratorium asked the local power authorities to use the six month delay to study noise pollution and how the new infrastructure would affect existing customers. The moratorium is narrowly focused on "the nature and scale of electrical infrastructure necessary to serve new high-energy-demand land uses [...] including infrastructure associated, but not limited to hyper-scale data centers, mid-sized data centers, artificial intelligence computing facilities, and high-performance computational centers, industrial facilities, and other intensive electrical users." Earlier this month, the University of Michigan announced it had settled on a specific plot of land in Ypsilanti Township -- a 144-acre plot on Textile Road. In a press release about the decision, the University said the data center would have the "capacity to change the world" and insisted it would not be a "high value target risk" in a war, that it would not store any hazardous nuclear material, and was not a weapons production facility. LANL previously confirmed that the data center will be used for nuclear weapons research. Ypsilanti Township Supervisor Brenda Stumbo told WEMU news that the selection of the site was a "travesty of justice" because it ignores constituents' concerns about environmental impact. During the August 18 moratorium vote, the Board projected a large stock photograph of an electric substation behind its members. The photo was meant to remind people of the size of the incoming infrastructure and the lack of communication from the university about it. "This picture's really important to think about because U of M has been so crystal clear that they've been communicating to us abundantly -- which is not true," Township clerk Debbie Swanson said during the meeting. "That speaks to the lack of respect."

Read more of this story at Slashdot.

Apple is cutting more than 200 jobs as it shifts resources toward a rebuilt, AI-powered Siri and other future products. Roughly 100 positions are being eliminated from the Vision Pro organization, including much of its gaming team and some immersive-video staff. Another 100 cuts are hitting the Siri and software teams. Bloomberg reports: In a statement, Apple acknowledged that it was realigning some teams "to evolve our business to deliver the best experiences for our users." "While we will create new roles as part of this change, it will also impact a limited number of existing roles," the company said. "We are grateful to these team members for their contributions, and we are committed to supporting them throughout their transition, including opportunities to apply for other roles at Apple." The Siri reshuffling is tied to an upcoming AI-infused version of the assistant, which is built on a new technical architecture. That shift requires a change in the necessary expertise, prompting the company to eliminate a small number of existing roles, reallocate resources and create new positions supporting the updated Siri. The changes to the Intelligent Systems Experience team reflect an effort to reorganize work on AI-powered capabilities. As more groups bring AI functions to apps, features and services, Apple is realigning teams to match priorities and accelerate development. The restructuring will eliminate some existing positions while creating new roles.

Read more of this story at Slashdot.

Federal prosecutors have charged activist Samuel Tunick with obstruction after he gave Customs and Border Protection officers a duress passcode that wiped his GrapheneOS-powered Pixel during a border search. "His prosecution is one of the earliest known instances of the federal authorities charging a person with destroying evidence using a program designed to wipe a device clean after a specific code is entered," reports The New York Times. From the report: "Obstructing federal law enforcement is a serious matter that has serious repercussions," Theodore Hertzberg, the U.S. attorney for the Northern District of Georgia, said in a statement. "Individuals who destroy or attempt to destroy property, including data, to prevent lawful search and seizure should expect to face prosecution and punishment for their actions." A spokeswoman for U.S. Customs and Border Protection said in a statement that the agency had the authority to search the electronic devices of anyone entering or leaving the United States, regardless of citizenship, to enforce laws addressing terrorism, child exploitation, drug- and human-smuggling, visa fraud and national security threats. "The border search will only include an examination of information that is present on the device at the time it is presented for inspection," the spokeswoman said, adding that it searched the electronic devices of fewer than 0.01 percent of all arriving international travelers in the last fiscal year. "Just the knowledge that the government is peering into your private life in this way, trying to dig up dirt on you, even though it's unsuccessful, is creepy," Tunick said, in response to a question about how the charges have affected him. His message: "The government doesn't own our communications, our relationships, as hard as they might try to. We have to defend our fundamental right to privacy; otherwise we can't say that we really live in a democracy."

Read more of this story at Slashdot.

One of the larger bits of work I’ve been doing crosses many core projects. I’m motivated to switch to GNOME OS across multiple form factors, but to do that, homed and related tooling need quite a few functional gaps fixed.

TL;DR

• github.com/chergert/linux
• github.com/chergert/cryptsetup
• github.com/chergert/qemu
• github.com/chergert/systemd
• github.com/chergert/edk2

I really wanted a rather simple storage stack. I try to run XFS or ext4 in most places because they continue to serve me well. I also want to run GNOME OS on phones, where we’ll need dm-inlinecrypt for better performance and to avoid loading raw storage encryption
keys into system memory.

Where I prefer something like thin provisioning is a multi-user setup, where I want encryption, integrity, layering, and reliable accounting without dedicating a fixed partition to every user.

Getting all of those properties at once required work from the filesystem down through device-mapper, the block layer, UFS, QEMU, and cryptsetup.

Keeping the storage key out of memory

Traditional full-disk encryption requires the raw volume key to enter kernel memory. That key can unlock the entire device, so extracting it from a running system is particularly valuable to an attacker.

Hardware-wrapped keys change this arrangement. The long-term key is stored as an opaque, device-bound blob. During activation, it is converted into a boot-scoped ephemeral blob and handed to the storage hardware. The hardware derives and programs the AES-XTS key without disclosing it to software.

There is still a separate 32-byte software secret for integrity and other cryptographic operations which cannot be offloaded. Knowing that secret does not reveal the inline-encryption key.

This reduces the opportunity to extract a reusable storage key, but it is not magic. It does not protect plaintext already present in memory, nor does it defeat an attacker who fully controls the running system.

The practical problem with hardware-wrapped keys is that they are difficult to develop and test without the relevant hardware. Even when hardware is available, failures across the complete stack can be difficult to reproduce and inspect.

So I started building the hardware I needed in QEMU.

A virtual UFS inline-crypto engine

The QEMU work adds an optional UFSHCI 4.1 inline-crypto profile. It supports AES-256-XTS, 512- and 4096-byte data units, 32 keyslots, 64-bit data-unit numbers, and both legacy and MCQ request formats.

It models more than just the encryption operation. Keyslots are programmed in stages before being activated, can be evicted, and are zeroized during reset. Requests take their own snapshots of key state so that concurrent eviction or reprogramming has deterministic behavior.
Crypto failures are reported as storage errors rather than returning corrupted data.

There is also a test-only wrapped-key mailbox. It can import or generate a key, prepare a boot-scoped version, derive the associated software secret, program a keyslot, and evict it. The long-term and ephemeral representations use authenticated envelopes so tests can also exercise damaged or substituted blobs.

This mailbox models the API and lifecycle that the guest needs, but it is not a trusted execution environment. QEMU necessarily has access to its root secret.

Following an encrypted write

With the hardware model available, a write can be followed through the entire Linux stack.

dm-inlinecrypt attaches an encryption context to the I/O, including the key and data-unit number. The block inline-crypto layer programs a UFS keyslot, then UFS submits the request to QEMU. Only encrypted bytes reach the backing image. Reads take the reverse path.

This makes dm-inlinecrypt a useful full-device target. Device-mapper describes which blocks should be encrypted, while the actual transform stays in inline-encryption hardware.

The target distinguishes raw keys from hardware-wrapped keys. A long-term wrapped blob is prepared into a fresh ephemeral blob during activation. Only the ephemeral form is placed in an active device-mapper table.

Key replacement also makes secure suspend useful. Userspace can suspend the device and wipe the active key. Resume is refused until a replacement has been installed, at which point a new ephemeral key is prepared and programmed.

Integrity without losing the hierarchy

Encryption by itself does not prevent undetected modification, so the protected configuration places exported dm-integrity above dm-inlinecrypt.

That ordering means integrity authenticates the plaintext seen by the filesystem. Inline encryption protects the filesystem data as well as the integrity tags, superblock, and journal when they reach physical storage.

The HMAC-SHA256 integrity key is derived from the hardware-provided software secret using HKDF-SHA256. The binary LUKS UUID is used as the salt, along with a fixed domain-separation string. This keeps integrity separate from the hardware-only inline-encryption key.

I’ve added a fixed profile at 4096-byte integrity blocks, 32-byte HMAC tags, colocated metadata, and a 32 MiB journal. This is fairly intuition based so it needs more testing.

Suspend and resume follow the layering. Suspend wipes integrity first then inline encryption. Restoration is reversed. This is really hard to test with real hardware, so Qemu again really comes in handy.

Provisioning blocks before publishing them

Thin provisioning adds another problem. A filesystem may publish a logical allocation before the thin pool has assigned physical storage. Failure from lack of capacity is then deferred until too late such as when writing data, an integrity tag, or the integrity journal. All of those can be catastrophic.

I added REQ_OP_PROVISION based on earlier ideas on LKML to make persistent allocation a block-layer op. It is different from a write and is effectively the opposite of discard: it asks the storage stack to ensure that a range is physically backed.

Provisioning is carried through the block core, loop devices, device-mapper, thin volumes, dm-integrity, and ext4. Thin volumes allocate, zero, and commit their mappings. Integrity provisions every corresponding data, metadata, and journal region. Ext4 provisions new data and metadata extents before exposing mappings.

The initial ext4 support is conservative. The provision mount option implies nodelalloc, requires 4 KiB extents without bigalloc, rejects unsupported stacks, and disables online resize.

Turning it into a LUKS2 workflow

The cryptsetup work ties these pieces together.

A platform provisioner can generate or import a wrapped key, derive the optional software secret, format a LUKS2 device for hardware-wrapped encryption, and add ordinary LUKS2 keyslots using the opaque blob as the volume key.

Hardware-wrapped segments have an explicit key_type and mandatory requirements. The integrity configuration is also fixed and marked as dependent on hardware-wrapped-key integrity support. That should make older implementations reject the device.

During activation, cryptsetup retrieves the long-term blob, prepares an ephemeral one, creates dm-inlinecrypt, derives the integrity key, and finally creates dm-integrity above it.

For now, this interface is library-only which is how I’m using it from homed.

Testing all of this in a custom GNOME OS build resulted in me finding some issues in tianocore as well (edk2) which I’ve fixed in my tree to allow booting off PCI-UFS over SCSI.

A laboratory for the whole stack

The important result is that this can now be tested without specialized storage hardware.

We can run AES-XTS known-answer tests and independently inspect ciphertext in QEMU’s backing image. We can test both data-unit sizes, legacy and MCQ queues, fragmented requests, concurrency, reset, cancellation, rekeying, damaged envelopes, and storage errors.

We can also exercise thin-volume provisioning through integrity and inline encryption, reject malformed or downgraded LUKS2 metadata, and verify secure suspend, resume, and key replacement.

Each layer has tests which I tried to keep working and improve along the way.

There is plenty left to do. Namely, I’m not really interested in doing LKML type stuff while unemployed living abroad. So if this is something other people want, they’ll need to encourage their respective teams to pick up the work.

Either way, I now have something useful which is a virtual test lab for a security feature which requires each of these layers to work together.

In my last post, I talked about the value GitHub provides to FOSS, while arguing that we should avoid deep dependency on it.

Now let’s talk about agentic AI (LLMs).

TL;DR: I think GitHub Agentic Workflows is a new minimum quality bar that anyone having hosted agents operate on a git repository should strive to meet. It’s FOSS (unlike the built-in Copilot stuff) and pretty well designed in my opinion especially from a security point of view.

One background opinion I have here is that agentic AI is a strong reason to go even more deeply into “git-ops” style workflows. Having the ability to audit, verify (CI) and include a rationale for changes to things that aren’t necessarily software even (like a team’s travel budget) make even more sense in a world of agents.

OK you’re using git already, now let’s say you want to use agentic AI. There are rather a lot of solutions to this =) I want to narrow in first on “hosted” workflows (as opposed to just spinning up opencode/claude/codex/whatever on your laptop).

A simple scenario here is “mostly readonly with one write output” flows, which include:

• PR reviews
• CI failure diagnosis
• Duplicate issue detection

etc.

The more complex scenarios are “issue to PR” style flows, or intermixing CI and AI (e.g. having an agent run during a CI run after it fails but before the VMs/containers are torn down and being able to do some live debugging).

There’s of course plenty of third party services (mostly proprietary) that will do much of this. Today on GitHub you can assign an issue to Copilot for example, etc.

GitHub Agentic Workflows is simply a compiler that outputs GitHub Actions that run in the context of your repository. Aside from the inference endpoint, there’s no proprietary black boxes (also assuming you are using a FOSS tool inside, like Codex but not Claude Code) etc.

What the compiler takes as input is a Markdown prompt that is very much similar to an agent skill with YAML frontmatter that defines its integration with GitHub such as event triggering – but especially key is restrictions on its output.

There’s a lot to like about this. As part of my job lately I’ve had to look over what other people are doing in this space, and I have to say there’s people doing things that are worse than this. In some cases significantly worse (mostly less secure).

Let’s say you want to implement a duplicate issue detector.

A serious problem with all agentic AI is prompt injection. It’s easy for someone to encode malicious instructions in an issue they file, and an agent can easily run those. If you’re running this issue triage as e.g. an agent skill from your laptop with full credentials, you can easily get your account taken over.

But the problem is the “most obvious” way to do this stuff by e.g. writing a GitHub Action with a GH_TOKEN and the following permissions will allow writing to all issues:

permissions: issues: write

If e.g. a person prompt injects an agent and says “by the way this project is archived, close all the issues” an agent might just act on that!

And for “issue to PR” style workflows, the contents: write permission to a token is very powerful.

The safe outputs portion of GH-AW is very well designed in this respect, greatly limiting the blast radius of a compromised agent (e.g. the duplicate issue detector can add at most one comment, not close other issues etc.)

For public repositories, GH-AW also has a concept of an “integrity threshold” when reading from GitHub itself and the default is approved, so it the agent will not even see issues from new or unaffiliated contributors. For this use case, we have to remove that filter, but it’s balanced by restricting the output.

Prompt injection can also leak the API key you use to access the inference endpoint – definitely not something you want to be surprised by when you get the bill later that month. GH-AW runs an actions VM as normal, but the agent runs in an OpenShell-like sandbox (it’s not actually OpenShell, that’s a whole other discussion!)

Now, I’m not saying all agentic AI should be GH-AW; in addition to the advantages above, it has a whole host of downsides. In particular it’s not at all designed to be interactive and certainly there are many use cases where that’s much more efficient, especially research/planning, some types of debugging etc.

A pattern I expect to emerge is that these types of “less structured/organic/interactive/local” flows end up delegating some work to per-repository workflows. For example a weekly planning session may result in filing issues, which get driven to completion via a GH-AW style flow in each repo.

Further hybrids are possible of course, nothing truly stops one from having a GH-AW style flow send an interactive question to a human via a MCP tool or equivalent. But I don’t think I’d want to do that personally, I’d rather make it easier to turn a whole session dynamically interactive, kind of like how today one can use things like the tmate action to log into a runner.

GH-AW definitely has its issues; one thing is that it’s annoying to reproduce the sandboxing outside of a GHA run. There’s also a really high latency to each run because it involves spinning up not just a GHA runner, but also downloading and provisioning the container agent wrappers etc. That’s for good security reasons overall, and anyone doing something else should be able to justify the security tradeoffs.

Just to restate the conclusion: I think GitHub Agentic Workflows is a good reference baseline for a safe way to add agentic workflows to a GitHub hosted repository, and everyone doing something similar should include a comparison with it at least. If not, take some of the code: the “safe outputs” stuff is reasonably easy to use in other systems too.

The question of using proprietary tools to build FOSS has always been one of the tension points in our community. One of the most prominent proprietary tools is github.com and the non-FOSS parts of gitlab.com (and a longer tail of other platforms).

A while ago I came across Give Up GitHub from the Software Freedom Conservancy which is on one side of this. My opinion remains nuanced and split. One I think few people would argue with is that there’s been enormous value provided to FOSS by the $0 github.com (and gitlab.com etc) services. Just the basic hosting of git infrastructure, issue tracking and other ancillary things (discussions, etc) but especially GitHub Actions.

There are a lot of critical projects out there getting by with the $0 “free/personal organization” infrastructure. It’s actually plenty for most projects (e.g. mature language libraries).

And while GitHub hasn’t been shy about pushing into the web interface things like Copilot (a proprietary agent framework) – in my opinion the platform still generally hasn’t been subject to platform decay. I mean, there’s no advertisements (which probably wouldn’t work because people would use custom interfaces talking to the API anyways).

This could of course change literally tomorrow; or next month, etc. But my gut says that at the current time Microsoft is OK funding github.com just to provide reliable infrastructure for their own teams, and those using it at large scale on premise probably provide enough income to offset the loss-leader economics for now.

I personally believe in (and argue for at my employer) avoiding a truly deep dependency on any one (proprietary) service (which includes github.com). In particular, I think Forgejo is a nice bit of software; it’s easy to run on premise for homelabs etc. The decision to run the Fedora Forge was not an easy one – there’s real ecosystem splitting effects, but I think we’ll be OK.

The thing is though, running a $0, publicly reachable internet service where people can just store/write things is genuinely hard (and especially when paired with a service to execute arbitrary code like Github Actions). It’s under constant attack from spam, scraping, bitcoin mining and abuse in a way that probably few people outside of the administrators truly appreciate.

I have a lot of respect for people and projects choosing to self-host or use smaller-scale hosts like Codeberg, but there’s real tradeoffs there around sustainability and availability.

I don’t expect this status quo to change much in the near future. In the next post, I’ll talk about how this relates to agentic AI.

An anonymous reader quotes a report from The Economist: Students and school children are increasingly using artificial intelligence. A survey last year by Chegg, an ed-tech firm, found that 80% of rich-world undergraduates used it in their studies. More recent polls put the figure at 94% in Britain and 93% in Germany. Such widespread adoption has fueled concerns about the impact the technology might be having on learning. Teachers report marking identikit essays that they suspect are churned out by ChatGPT. Yet firm evidence on AI's educational effects has been lacking. David Stromberg of Stockholm University and Victor Lei and Wu Yanhui of the University of Hong Kong set out to fill the gap. They tracked 27,000 pupils aged 12-18 in China, where AI adoption has been fast. Around 80% reported using models such as Doubao and DeepSeek; the other 20% formed the control group. The results are eye-opening. After six months, pupils using AI saw their average homework score rise by 18% across all subjects. The time they took to complete each assignment fell from an average of 64 minutes to 45. But come exam time, the same students scored 20% below their classmates who had not called on AI's help. Homework scores once predicted exam performance; now those who score highest are, perversely, more likely to do worse in exams. The takeaway: "AI can boost learning productivity, but only for those who use the technology intelligently," reports The Economist. "Students must resist the temptation to reach for an AI-generated answer before thinking things through for themselves."

Read more of this story at Slashdot.

A man dressed as Darth Vader used a Public Safety and Livable Neighborhoods Committee meeting in San Diego to mock the city's use of Flock surveillance cameras, sarcastically arguing that the technology would help the "emperor" track "rebel scum" and find Luke Skywalker. "This is what the emperor needs. This technology will help us find the rebel scum and the hidden base on Hoth," he said. The Hill reports: He urged that the cameras be used to surveil any "rebel scum as they move from playground to playground, from playground to pool, from pool to gymnasium, because we all know that the Flock cameras are not only following the license plate readers, they are following children." The plea for the cameras shifted to raising taxes to clear out storm drains and to the clearing of homeless encampments in the city. The man said the council members can use "doublespeak" to say the police department is humanitarian. "And how will the people trust this City Council when this City Council continues to vote for surveillance technology that imprisons them? Ms. Campbell, you must work on your Jedi mind tricks," he said, addressing City Council member Jennifer Campbell, before waving his hand to the audience. "Do it like this." His last plea was for the Flock cameras to be used to "help us find Luke Skywalker as he traverses the universe in his X-wing." "This technology is a necessary, necessary force," he concluded. According to DeFlock, San Diego has more than 550 Flock cameras across the city.

Read more of this story at Slashdot.

Micron says it will spend $10 billion over the next decade on a new research lab in Boise focused on advanced memory technologies, computing systems, and future chip manufacturing. Here are some details, as reported by Reuters: - Micron Research Labs will bring together customers, academia, government and the broader semiconductor ecosystem to pursue breakthroughs, the company said. - The latest investment builds on the more than $250 billion that Micron had separately committed to manufacturing and R&D across the United States. - The lab will be connected to Micron's research and technology footprint across the U.S., Europe, Japan, India, Singapore and Taiwan. - Growing adoption of AI workloads and infrastructure buildout have boosted demand for high-bandwidth memory, which rapidly feeds data to AI accelerators, making it a critical component of modern computing infrastructure. - The Trump administration has prioritized domestic chip manufacturing in a bid to reduce foreign dependence, boost the economic output and maintain its lead in the AI race. - Micron expects to break ground on the facility in 2027, which will be capable of hosting hundreds of researchers and facilitating international conferences and workshops.

Read more of this story at Slashdot.

Linus Torvalds says AI "enormously helped" him track down a stubborn Intel Xe graphics driver bug that took 24 debugging patches and 18 kernel boots to isolate. "I'd like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it," wrote Torvalds on the commit. "I suspect those things have been trained by people who may not be quite as stubborn as I am..." Phoronix reports: The patch by Linus Torvalds is for the Xe kernel driver and the change is no longer hand out the flat Compute Command Streamer (CCS) storage as usable vRAM. On a Battlemage G21 graphics card, he was hitting a scenario where there was a mismatch where the usable memory ended and hit a case where the GDM display manager would end up being endlessly restarted. [...] Linus Torvalds views AI as a useful tool and in this case reaffirmed he found it "enormously helped" his effort in tracking down this Intel graphics driver bug. The Intel Xe driver fix is merged to Linux 7.3 Git and is also marked to back-porting to the stable kernel branches.

Read more of this story at Slashdot.

Confidential computing can protect sensitive workloads even when the cloud host cannot be fully trusted. Confidential virtual machines can shield memory and CPU state from the hypervisor. Disk encryption can also stop the host from reading stored data. But how does the virtual machine know the disk state it received is the newest?

After years of refusing to adopt tap-to-pay technology in its stores, retail giant Walmart announced today that it is finally accepting payments via both Apple Pay and Google Pay. The rollout begins August 24 at select Walmart and Sam's Club locations and is expected to reach all stores by year-end. It will then expand to fuel stations by mid-2027. TechCrunch reports: The news is a surprise, as Walmart has long refused to adopt the ubiquitous payment technology to instead promote its own in-house solutions, like Walmart Pay and Scan-and-Go. In years past, Walmart even teamed up with other big retailers in an attempt to take down Apple Pay entirely with an alternative mobile payment system of their own, called CurrentC. The effort failed and was shut down back in 2016. All the while, Walmart customers have begged the company to support modern tap-and-pay technology, like Apple Pay, which is now accepted at 85% of retailers across the U.S., including most larger stores. For Walmart, the decision reads as a defeat. As one of the world's largest retailers, it believed it could push customers to its own payment solutions despite the growing adoption of Apple Pay and others of its kind. Ultimately, it had to admit that it was disadvantaging its own customers in the process.

Read more of this story at Slashdot.

Earlier this year as I drift abroad in France, I made a new abstraction over Avahi and systemd-resolved. It is called librebonjour and I wrote about it here.

It’s nice in that I no longer need to build Avahi to get GObject bindings to essentially call a D-Bus interface. It’s also nice to not have to care as an application developer if the system is configured with Avahi or systemd-resolved. Though, the systemd-resolved abstraction was lacking a bit compared to Avahi due to missing features.

When you are browsing for services using Avahi, you can be notified automatically of changes. This doesn’t quite work the same in systemd-resolved. Librebonjour had to set a timer and poll occasionally for updates and compare old-to-new sets to notify the application. Not very ideal.

When looking at a recent systemd checkout, I noticed that it already had support for the notification over its varlink interface. A handfull of commits later to hoist a few things and handle client disconnections/isolation properly and I can have the feature for librebonjour too.

One more dependency I can cut out of my system (there will be many more coming, I assure you, as GNOME is heavy with cruft).

I’ve been working on a bunch of things across the Linux puzzle for a product I want to build. Here is an overview of a few of those things.

LibMKS at 120hz

I wanted to get my virtual machines to 120hz so that I can start testing product features inside of VMs. In fact, I actually like doing development with virtual machines over say, trying to shove all your development tooling in a sysext which, at least to me, feels like square-peg/round-hole territory.

To get this working, a few things needed improvements.

Qemu

Qemu has a dbus display backend where it can send you DMABUF FD. But it doesn’t really handle any sort of sync and that becomes a problem as you crank up the frame rate. Additionally, it just defaulted to 75hz with no mechanism to override it.

So I have some patches which provide a new D-Bus interface which can be implemented by LibMKS. It provides something more like a Vulkan swap-chain as well as API to set the refresh rate. While this isn’t a mapping 1:1 of what a wayland protocol might do for frame rate, it does match more what the emulated graphics device expects, so it is probably fine for now and clearly an huge improvement.

A big change in the new API is that we will register all the DMABUF up front, and then tell the client just to switch to another DMABUF along with damage rectangles. Of course, I also had to make Qemu start collecting damage rectangles correctly.

• DMABUF3 Listener API for D-Bus
• Allow Clients to set Frame Rate

Linux

With those changes in place, I kept seeing damage being full-frame. The next part of the stack that can break is thus the Linux kernel virtio graphics driver. Damage rectangles come in as properties on the drm plane being submitted. So it turns out that in two places some short circuiting was preventing that from working right.

After fixing all that (and the corresponding LibMKS side) I have decent graphics performance in a VM.

Since I continue to be floating precariously abroad, this is my notice of such patches. If you are interested in seeing these upstream and work in either of those communities, feel free to crib them, improve them, and submit them upstream. I’m happy locally patching my software given the copious amount of free time I have so there is little incentive for me to collaborate with corporations.

• Virtio fix 1
• Virtio Fix 2

Combined with the LibMKS merge request !53 I can have both minimal damage rectangles all the way to host GPU scanout as well as drag windows around in the guest quite fast.

Google is giving publishers a new way to fight declining referral traffic from AI-powered search by letting them embed a "Preferred Sources" button that readers can use to favor their sites across Search, Discover, and Google News. "The idea is to make it easier for readers to find links from the sites they know and trust when they're searching for content or interacting with Google's AI to learn about a topic or read the latest news," reports TechCrunch. "As of May's launch, the company said that people across the web had already selected over 345,000 unique sources through this method." From the report: Becoming a preferred source can drive more traffic to publishers' websites, Google said. In earlier studies, it found that people are twice as likely to click through to a preferred source when available. By offering publishers these additional tools, Google is trying to assuage the damage that the rapid growth of AI-powered search features has had on traffic-dependent businesses. Alongside the new button, Google said that readers will soon be able to customize their Discover feed in Google's app in their own words. To use this feature, readers will tap any three-dot menu in the feed and then tell Google what topics they'd like to see more or less of, using natural language commands. This helps Google refine the feed in real time.

Read more of this story at Slashdot.