Baserock now has an OStree artifact cache

[Sam Thursfield <sam thursfield codethink co uk>]

Hi all
This is a quick note that https://ostree.baserock.org/ now exists and 
can be used as a BuildStream artifact cache.

There's a bit of documentation here: 
http://wiki.baserock.org/BuildStream/ (feel free to improve)

I have been trying to set up the GitLab CI to automatically push 
artifacts to the cache. That is now working! So far only on my 
sam/buildstream branch.

Unfortunately *pulling* from the cache seems broken on GitLab CI at time 
of writing -- https://gitlab.com/BuildStream/buildstream/issues/46 -- so 
this isn't fully in action yet.


As with previous Baserock cache serves (kbas and morph-cache-server), we 
have no way yet of verifying that what people push actually corresponds 
to the cache key. The GitLab config for definitions.git has an SSH 
private key that grants push access to ostree.baserock.org, which is a 
"protected variable" named `baserock_ostree_cache_private_key`. You can 
only access this on protected branches; this is a security measure that 
avoids a risk of someone pushing a .gitlab-ci.yml file that displays the 
private key by doing `echo $baserock_ostree_cache_private_key`.

If you want to push BuildStream artifacts on other branches, copy what I 
did here...


https://gitlab.com/baserock/definitions/blob/sam/buildstream/.gitlab-ci.yml

...and make sure your branch is set as 'protected' in the repo config 
(you can still give yourself push access of course, just be careful!)

Enjoy!
Sam

--
Sam Thursfield, Codethink Ltd.
Office telephone: +44 161 236 5575