How does the Rocky Linux build system provide trust?
This short clip explains how the Rocky Linux build system adds trust to the packages that make up the distribution. Rocky Linux has been using the Fedora build tools, including Koji and the module build service, to build sources. Those tools work well once running, but they did not integrate cleanly into the cloud-native tool chains the team wanted to use.
The result is a build system called Peridot. Its central aim is greater transparency into everything from the sources ingested upstream at git.centos.org to the artifacts published at dl.rockylinux.org. Anyone curious about supply chain trust in Rocky Linux gets a concise view of the motivation behind Peridot.
Key takeaways
- Rocky Linux has been using the Fedora build tools, including Koji and the module build service, to build its sources.
- Those tools work well once set up but did not integrate well with the cloud-native tool chains the team wanted.
- Peridot is the resulting build system, designed to provide more transparency across the entire build process.
- The transparency goal spans from upstream sources at git.centos.org to the artifacts published at dl.rockylinux.org.
Questions this video answers
What is Peridot and why did Rocky Linux build it?
Peridot is the build system Rocky Linux developed after finding that the Fedora tools it had been using, such as Koji and the module build service, did not integrate well with cloud-native tool chains. Its goal is to provide better transparency into everything from the upstream sources ingested to the final published artifacts, strengthening trust in the operating system supply chain.
About this video
Rocky Linux is currently using the Fedora build tools like Koji and MBS to build the sources. These are great tools that have served us very well, but didn't align with our goals of having a cloud native build system. With the soon-to-be released Peridot, the entire ecosystem of Linux Distribution building tools will be incorporated into a microservice infrastructure and extended to create forks, extended builds, and provide better transparency and trust into the operating system supply chain.
This video is part of the RLC+ playlist. Browse every CIQ video by product and topic.
Transcript
how how does the build system we have offer additional trust to the resulting packages that come out that make up rocky linux sure yeah and uh so just to clarify rocky is currently using the fedora build tools so koji module service um those sorts of artifacts to build the sources for centos 8 and those tools are awesome they they take a lot of time to wrap your head around but once you get them up and running they work great what we found when we were learning about these tools is that uh they didn't integrate great into the tool chains that we wanted to use uh
and wanted to try and integrate into our stacks in a more cloud-native way um what resulted from all of this was essentially a build system that we are calling peridot one of the things that we're really just trying to do with the entire build system including with peridot is provide better transparency and more transparency into everything that goes on from the sources that we're ingesting upstream from gitzindos.org to the artifacts that we publish down at dl.rockylinux.org
Built for scale. Chosen by the world’s best.
2.75M+
Rocky Linux instances
Being used world wide
90%
Of fortune 100 companies
Use CIQ supported technologies
250k
Avg. monthly downloads
Rocky Linux
9
Enterprise products
Spanning the kernel to the orchestrator
Have questions about your infrastructure?
Talk to a CIQ engineer about Rocky Linux, HPC, and AI infrastructure.