Justin Garrison: But - so yeah, we have all these things, and then we throw them in websites, and then just everyone downloads them from there. And we say “Okay, we have a website, you can download all the tars you want… Here’s how you discover which tar you want”, whether that’s an APK file for installing a package, or layers of containers… And those layers are broken up into other things, and referenced by other JSON files, right? So my container image is a collection of other tars. What work have you done on that side? Because you’ve got that distribution side of it. We could package it performantly, and then distribute it, and then as people are downloading it, it’s usually like “Oh, we make them small.” It’s like “Well, that’s not the only way.”

Jason Hall: [37:37] Yeah. As an example of that, APKs have the ability to run scripts when they’re installed, right? A lot of package managers do. When you apt install foo, it can actually run another script and do something else, because it needs to set up a user, it needs to set up a directory, it needs all kinds of those things. APK has that ability too, but apko doesn’t use it. So if the APK describes some script to run after startup, the image we build with that APK won’t run that script; in the APK layer there’s no arbitrary script execution. So that encourages us to put everything we need encoded in the APK‘s file system, instead of in who knows what in the trigger that runs after that package is installed. That’s absolutely an artifact of that we are building for the container ecosystem of 2024, and not the mainframe ecosystem of 1985.

Computers have changed a lot. We have very – we prefer immutable infrastructure, we prefer… Nobody’s exacting into Docker containers and doing upgrades on these packages. We just nuke the whole thing and restart it, possibly in a new node.

Ariadne Conill: So there was a logic error in the way that certain package updates were ingested, which would cause the package update itself to get published, but the package update itself would not get published in the index. So the way that we discovered this is we have continuous vulnerability scanning of our images. Every night we run Trivy, and Grype, and Snyk against all of the public images that we produce. But there was recently a CVE with zlib, and the xlib CVE we mitigated in version 1.2.12-r3. Well, we kept getting alerts that the zlib CVE was not mitigated in our images, and we couldn’t figure out why. So last night, when somebody was investigating the alert, we’ve found out that the image had 1.2.12-r2. So we did a whole bunch of investigating into why that was the case, and we’ve found out that even though the r3 packages were published, they weren’t in the index. And if it’s not in an index, then the apk doesn’t know about it.

So basically, we were publishing the security updates, but in certain circumstances, those updates were not making their way to the index, and as a result, those updates weren’t making their way into the images, and that was triggering the scanning… And so we had to go and fix all of that. But it’s fixed now, and updates are following the way that they’re supposed to… And that’s basically all I can say about it, because it relates to an internal microservice that’s not open source.

Daniel Thompson: We’ve been waiting until the 1.0 landed in order to bring them kind of more to the forefront. The place where they exist is in one of those three libraries that we talked about, in TAO and WRY. So we can do windowing, we can communicate with them, and now we have to raise them up to the Tauri layer, where they then interact with the APIs that you need, like the file system, the camera, the Bluetooth… And then also create the final APK, or Apple blob, and get those on the app stores. So it’s very early days for that…

We’re also interested in getting the apps on other devices. I remember when – gosh, when was it? This was a year or two ago, when one of SpaceX’s rockets went up, and somebody mentioned “That window - isn’t that Electron?” And it turns out that we’re using Electron on the rocket ship.

[59:41] And I think that – okay, it’s a nice dream to have, but as and if our civilization keeps on progressing, I do expect us to start being able to ship apps to other devices, like augmented reality, and to watches, and to your Smart TV, and even to embedded systems. I mean, one of the neat parts about Tauri is that you can use it as a CLI. You can interact with it from the perspective of a CLI. You can hook apps up together so that they’re communicating in a distributed way. And I think, as people start to realize, “Okay, we can think about these applications, these devices that we’re using - we can still think of them as thick clients, right?” It’s not like it’s just a dumb screen and a keyboard; these things have amazing processing power, and we can reduce these requirements of putting our data into corporate silos… And that’s where the privacy comes back in, right? By allowing people to own their own data, to own their own identities, to manage their own things, because their devices are capable of it. Maybe that destroys some business models, but I think that for a growing type of engineer, it just makes more sense. Like, why would you pay for a cluster of highly available database servers and some API endpoints behind the CDN, when you can just have the apps talk to each other? You just have to negotiate a point where they can meet and they can send all their data. Why bother having databases when you can trust your users? And that might be the final paradigm shift that we’re after.

Adolfo García Veytia: There are still ways that you can run it. You can point it to source code directories and it will produce an SBOM of those, including the dependencies that it finds. You can point it to container images, and it has support, for example, going inside of the container images, and it has support for listing the packages that are installed in the images, the operating system packages… You can point it to single files, for example SBOM-listing all of your binaries; we use that for Kubernetes.

[16:08] It also has support for other not as widely used artifacts, like for example image archives… And we are - I hope I can finish this one for KubeCon - also adding support to indexing inside of the operating system packages. So say you point a tool to an RPM, or an APK file, and it’ll list everything inside of it.

Carlos Becker: Basically, a tool that builds your Go projects to whatever, GOOS, GOARCH, and any combinations you want, and it creates Linux packages, homebrew-tap recipes, or whatever the name is. Also, Snap packages for Linux, .deb, .rpm, .apk, Docker images, and pushes to S3, and whatever other thing you want to, basically.