June 2023 - openSUSE Factory - openSUSE Mailing Lists

Build of kernel with `make binrpm-pkg` fails
by Mark Rubin 20 Jul '23

20 Jul '23

(Yes, I seem to be spamming this list. If it's any excuse, please know that I spend 24/48/more hours trying to solve each problem on my own before asking for help here.) I'm trying to build the current openSUSE kernel. This isn't something I want to be spending time on, but for the reasons why, see https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… I've done the following: ``` $ git clone https://github.com/openSUSE/kernel $ cp -p /boot/config-6.3.9-1.g0df701d-default .config $ make olddefconfig $ make menuconfig ``` The last ("menuconfig") is required to make some changes to fix: ``` make[2]: *** No rule to make target '.kernel_signing_key.pem', needed by 'certs/signing_key.x509'. Stop. make[2]: *** Waiting for unfinished jobs.... CERT certs/x509_certificate_list make[1]: *** [scripts/Makefile.build:495: certs] Error 2 make[1]: *** Waiting for unfinished jobs.... ... make: *** [Makefile:2041: .] Error 2 ``` Finding the magic settings to fix that wasn't easy, but no matter. Continuing: ``` $ make binrpm-pkg ... depmod: ERROR: could not open directory /usr/local/home/mark/rpmbuild/BUILDROOT/kernel-6.4.0_rc7_1.g0df701d_default+-1.x86_64/usr/lib/modules/99.98.6.4.0-rc7-1.g0df701d-default+: No such file or directory depmod: FATAL: could not search modules: No such file or directory make[2]: *** [Makefile:1971: modules_install] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.UXaZfI (%install) ... RPM build errors: Bad exit status from /var/tmp/rpm-tmp.UXaZfI (%install) make[1]: *** [scripts/Makefile.package:91: binrpm-pkg] Error 1 make: *** [Makefile:1672: binrpm-pkg] Error 2 ``` Much investigation reveals that `rpmbuild`, invoked from "scripts/Makefile.package" via the "binrpm-pkg" target ... ``` binrpm-pkg: $(MAKE) -f $(srctree)/Makefile $(CONFIG_SHELL) $(MKSPEC) prebuilt > $(objtree)/binkernel.spec +rpmbuild $(RPMOPTS) --define "_builddir $(objtree)" --target \ $(UTS_MACHINE)-linux -bb $(objtree)/binkernel.spec ``` ... is creating a "/var/tmp/rpm-tmp.<some-tempname-hash>" file which is later executed. That script creates many directories, but not the missing one in the error message above. I've tried to hack in some workarounds, but all fail. It doesn't do any good to edit the /var/tmp/rmp-tmp.<hash> file because a new one is created on the next run of `make binrpm-pkg`. Likewise, creating the missing directory doesn't help because the script first cleans up the previous run with `rm -rf /usr/local/home/mark/rpmbuild/BUILDROOT/..." before recreating that whole directory tree, and that wipes out the hack-in subdirectory. So ... the questions (for anyone who has experience building kernels and would be willing to offer help): - Is there any reason why the "binrpm" target doesn't work or shouldn't be used? It seems (and is documented online) to be a better alternative to `make install` because it can't break the running system (it can be done as a non-root user and the resulting RPM later installed). - Is this a bug either in `rpmbuild` or the makefile's invocation of it? - Is doing `make rpm-pkg` (which is advertised to make two RPMs, one binary and one source) necessary instead? I've tried, and it errors with yet more problems which I'm trying to address, but predict that once it makes the source RPM it will break on the binary (the only thing I really want) with the same failure I'm already seeing. - Is doing `make module_install` followed by `make install` what everyone uses, and I'm going down some untested and unsupported path? As always, thanks for any advice or suggestions (including, I suppose, "If you don't know how to build the kernel you shouldn't be doing it.")

6 7

Please reboot after upgrading to SDDM 0.20 (Snapshot 20230630+)
by Fabian Vogt 14 Jul '23

14 Jul '23

Hi, in SDDM 0.20, the protocol between the greeter and the daemon changed a bit, which means the greeter from 0.20 will not start properly if the daemon from 0.19 is still running. It's not possible to restart the daemon automatically during/after the upgrade, as this would stop all sessions. The result is that directly after upgrading to sddm 0.20, performing a logout will end up in a black screen. So instead of logging out, just select reboot or shut down directly. If you by accident end up at the black screen, press Ctrl-Alt-F1 to switch to a console and press Ctrl-Alt-Del to trigger a reboot. Or log in as root and run "rcxdm restart; exit" to restart the daemon. Cheers, Fabian

4 6

The lockdown function be enabled in master branch of openSUSE kernel
by joeyli 12 Jul '23

12 Jul '23

Hi folks, After testing NVIDIA kmp with lockdown kernel, the lockdown function be enabled in master branch of openSUSE Tumbleweed kernel again. (SLE and Leap kernels are already enabled) The following patches are unmartked: patches.suse/0001-security-lockdown-expose-a-hook-to-lock-the-kernel-down.patch patches.suse/0002-efi-Add-an-EFI_SECURE_BOOT-flag-to-indicate-secure-boot-mode.patch patches.suse/0003-efi-Lock-down-the-kernel-if-booted-in-secure-boot-mode.patch patches.suse/0004-efi-Lock-down-the-kernel-at-the-integrity-level-if-b.patch patches.suse/arm64-lock-down-kernel-in-secure-boot-mode.patch The following config be enabled. It will load MOK (machine owner key) to kernel keyring: CONFIG_IMA_ARCH_POLICY=y CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y The following downstream config be enabled on x86_64 and aarch64. It will connect lockdown function with secure boot option in EFI firmware: CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT=y Kernel will set to integrity lockdown mode when secure boot be enabled: linux/security.h enum lockdown_reason { LOCKDOWN_NONE, LOCKDOWN_MODULE_SIGNATURE, // kernel module verification LOCKDOWN_DEV_MEM, LOCKDOWN_EFI_TEST, LOCKDOWN_KEXEC, LOCKDOWN_HIBERNATION, LOCKDOWN_PCI_ACCESS, LOCKDOWN_IOPORT, LOCKDOWN_MSR, LOCKDOWN_ACPI_TABLES, LOCKDOWN_DEVICE_TREE, LOCKDOWN_PCMCIA_CIS, LOCKDOWN_TIOCSSERIAL, LOCKDOWN_MODULE_PARAMETERS, LOCKDOWN_MMIOTRACE, LOCKDOWN_DEBUGFS, // restricted debugfs LOCKDOWN_XMON_WR, LOCKDOWN_BPF_WRITE_USER, // BPF write LOCKDOWN_DBG_WRITE_KERNEL, LOCKDOWN_RTAS_ERROR_INJECTION, LOCKDOWN_INTEGRITY_MAX, // integrity mode LOCKDOWN_KCORE, LOCKDOWN_KPROBES, LOCKDOWN_BPF_READ_KERNEL, // BPF read LOCKDOWN_DBG_READ_KERNEL, LOCKDOWN_PERF, LOCKDOWN_TRACEFS, LOCKDOWN_XMON_RW, LOCKDOWN_XFRM_SECRET, LOCKDOWN_CONFIDENTIALITY_MAX, // confidentiality mode }; As you see, the kernel module verification will be enabled. So please sign your self-built kernel module. You can reference this section in openSUSE UEFI wiki page: https://en.opensuse.org/openSUSE:UEFI#Signing_kernel_module_for_verification Please enroll your key to MOK by mokutil. If you didn't use shim, e.g. systemd-boot/dracut solution. I have created a bug bsc#1211224. Currently we do not support it with secure boot. Let's discuss it in bsc#1211224. Regards Joey Lee

13 54

[IMPORTANT] Switching from wtmp to wtmpdb
by Thorsten Kukuk 09 Jul '23

09 Jul '23

Hi, as already told ;), wtmp has a Y2038 problem which the glibc developers don't plan to fix, but instead they want deprecate that API. (For background see https://www.thkukuk.de/blog/Y2038_glibc_wtmp_64bit/) On openSUSE Tumbleweed/MicroOS/... we introduced meanwhile wtmpdb, which solves the Y2038 problem and some others, too. "wtmpdb last" should work already today and show you similar output compared with "last" itself. The next and final step will be, making "last" a link to "wtmpdb last" and rename the old last to "last.legacy". There are currently no plans to disable writing of wtmp entries completly, I expect that this will come most likely together with utmp. So the applications reading wtmp directly (currently I'm only aware of accounts-daemon, maybe samba, haven't analyzed that code yet) should continue to work. The other 99% of applications accessing wtmp do only create new entries, this should cause no issues. But: due to a one year old bug in systemd-presets-common-SUSE, the service files didn't got always enabled. IMPORTANT: please check that the wtmpdb-update-boot.service and wtmpdb-rotate.timer are enabled, if not, please enable them: systemctl enable --now wtmpdb-update-boot.service systemctl enable wtmpdb-rotate.timer This is only necessary if you did updates, not for systems which got fresh installed this week. Thanks, Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect, Future Technologies SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nuernberg, Germany Managing Director: Ivo Totev, Andrew Myers, Andrew McDonald, Martje Boudien Moerman (HRB 36809, AG Nürnberg)

14 32

install updates on reboot when needed
by Daniele Granata 06 Jul '23

06 Jul '23

Dears, in recent months make a zypper dup cause some problems to my system, logout from kde broken, session that will not close properly keeping open sw like Chromium or DBeaver, all resolved with a hard power off. May I ask some sort of option in zypper dup to apply the file installation only before the next boot? Thank you -- Daniele

7 19

When are upstream kernel commits merged into Tumbleweed?
by Mark Rubin 02 Jul '23

02 Jul '23

The nouveau driver has had a serious, longstanding bug that seemingly only exhibits itself with the 6.3 and onward kernels, and only with older Nvidia chipsets. For details, see https://forums.opensuse.org/t/older-laptop-tumbleweed-nvidia-and-nouveau-dr… and https://gitlab.freedesktop.org/drm/nouveau/-/issues/213. After several weeks of hard work by developers at Freedesktop and RedHat (it was a very difficult bug to track down) a fix was accepted at https://github.com/torvalds/linux/commit/c8a5d5ea3ba6a18958f8d76430e4cd68ee… and is in both https://github.com/torvalds/linux/blob/master/drivers/gpu/drm/nouveau/nouve… and https://github.com/openSUSE/kernel/blob/master/drivers/gpu/drm/nouveau/nouv… But the change has not yet been merged into the kernel-source-6.3.7-1.2.noarch package's /usr/src/linux-6.3.7-1/drivers/gpu/drm/nouveau/nouveau_drm.c file, nor (as evidenced by the kernel fault still happening at boot) in 20230620's vmlinuz-6.3.7-1-default kernel. Should I expect that it will be included in an upcoming Tumbleweed snapshot/repo/ISO in the near future? If not, how can I advocate that it should be? There are already several related Bugzillas (1212553, 1211217, 1211568, 1211216, 1209197), none of which seem to be aware of the root cause nor this newly-released fix. Note that although the bug currently only triggers with specific, older Nvidia GPUs and "has never caused problems before", the previous code is undeniably wrong and the patch should be applied regardless. And once again, it has been accepted into the mainstream kernel sources. Thanks for any insights into the Tumbleweed release process, and on how to proceed.

8 17

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 30 Jun '23

30 Jun '23

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - monero: Fails to build - monero-gui: Fails to build - python-efl: Fails to build - spek: Fails to build Unless somebody is stepping up and submitting fixes, the listed package(s) are going to be removed from openSUSE:Factory. Kind regards, DimStar / Dominique Leuenberger <dimstar(a)opensuse.org>

1 0

Tumbleweed - Review of the week 2023/26
by Dominique Leuenberger 30 Jun '23

30 Jun '23

Dear Tumbleweed users and hackers, We have just finished week 26, meaning half of the year is over. This week was a ‘super fast’ one for Tumbleweed: in the 7 days since the last review we published 9 snapshots. Go figure! The 9 snapshots covered this week are 0621…0629. The most relevant changes that were delivered during this week were: * Mozilla Firefox 114.0.2 * KDE Plasma 5.27.6 * IceWM 3.4.0 * Node.JS 20.3.1 * AppArmor 3.1.6 * PHP 8.2.7 * Mesa 23.1.3 * Linux kernel 6.3.9 * util-linux 2.39 * firewalls 2.0.0 * strace 6.4 * transactional-update 4.3.0 As you come to expect, staging projects are filled up and the following few things are being worked on and tested: * Protobuf 22 * linux-glibc-devel 6.4.0 * Linux kernel 6.4: kernel lockdown enabled, see the announcement[0] * exiv2 0.28.0 * wine 8.11: this was part of a single snapshot (0627) last week, but was quickly reverted in 0628 as there were issues[1] starting apps. The problem could be identified and fixed. * Python 3.12.0b3 Cheers, Dominique [0] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… [1] https://bugzilla.opensuse.org/show_bug.cgi?id=1212823

1 0

New Tumbleweed snapshot 20230629 released!
by Dominique Leuenberger 30 Jun '23

30 Jun '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: SDL2 (2.26.5 -> 2.28.0) irqbalance (1.9.2 -> 1.9.2.24.git+184c950) libburn (1.5.4 -> 1.5.6) libdb-4_8 libisofs (1.5.4 -> 1.5.6) libjcat (0.1.13 -> 0.1.14) libjpeg-turbo libzip (1.9.2 -> 1.10.0) openexr (3.1.8 -> 3.1.9) openssl-1_1 openssl-3 openssl perl-Bootloader (1.4 -> 1.5) policycoreutils sddm (0.19.0 -> 0.20.0) systemd transactional-update (4.2.1 -> 4.3.0) === Details === ==== SDL2 ==== Version update (2.26.5 -> 2.28.0) - Update to release 2.28 * Added SDL_HasWindowSurface() and SDL_DestroyWindowSurface() to switch between the window surface and rendering APIs. * Added a display event SDL_DISPLAYEVENT_MOVED which is sent when the primary monitor changes or displays change position relative to each other. * Added the hint SDL_HINT_ENABLE_SCREEN_KEYBOARD to control whether the on-screen keyboard should be shown when text input is active. - Delete 0001-Cleanup-add-brace-6545.patch, 0002-Update-for-SDL3-coding-style-6717.patch, 0003-Clang-Tidy-fixes-6725.patch (inapplicable), 0004-evdev_kbd-Use-current-keymap.patch (merged). ==== irqbalance ==== Version update (1.9.2 -> 1.9.2.24.git+184c950) Subpackages: irqbalance-ui - Resurrect _service file and old git patch no versioning A _service A _servicedata A irqbalance.obsinfo - Update to version 1.9.2.24.git+184c950: * procinterrupts: fix initialisation of regex_t struct * Fix it so we actually stop when we hit an interrupt condition * Fix signedness of error handling * Revert "Fix CPU number condition in service file" * Issue 259: select NL_SKIP / NL_STOP based on error * fix CPU number condition in service file - Already included upstream: D irqbalance-systemd-netlink.patch ==== libburn ==== Version update (1.5.4 -> 1.5.6) - Update to 1.5.6 - Upstream changes: * Bug fix: Overburning with cdrskin option -force ended by a libburn error * New API call burn_write_opts_set_bdr_obs_exempt() * New cdrskin option --bdr_obs_exempt * Officially enabled overburning with burn_write_opts_set_force(,1) ==== libdb-4_8 ==== Subpackages: db48-utils - Fix incomplete license tag. [bsc#1099695] ==== libisofs ==== Version update (1.5.4 -> 1.5.6) - update to 1.5.6: * Bug fix: iso_write_opts_set_part_like_isohybrid() did not cause a MBR partition table if the partitions are data files in the ISO rather than appended * Bug fix: The lseek methods of IsoFileSource for local filesystem and loaded ISO returned libisofs error codes as positive off_t numbers * Bug fix: Freshly cloned data files from imported image were not marked as imported. * Bug fix: Size of further CE area was calculated wrong if its CE entry ended exactly at a block boundary * New iso_write_opts_set_system_area() option bits 16: GPT "Legacy BIOS bootable" and 17: GPT writable * New API calls iso_assess_written_features(), iso_read_image_feature_named(), iso_read_image_features_text() * Allowed lseekable device files with iso_tree_add_new_cut_out_node(). * Proof-of-concept by Ivan Shmakov. * New API call iso_write_opts_set_max_ce_entries() ==== libjcat ==== Version update (0.1.13 -> 0.1.14) - update to 0.1.14: * Fix header includes (Daisuke Fujimura) * Fix prefix of LIBJCAT_CHECK_VERSION (Richard Hughes) * Use project_source_root to fix building as a subproject ==== libjpeg-turbo ==== Subpackages: libjpeg8 libturbojpeg0 - merge two spec files into one ==== libzip ==== Version update (1.9.2 -> 1.10.0) - version update to 1.10.0 * Make support for layered sources public. * Add `zip_source_zip_file` and `zip_source_zip_file_create`, deprecate `zip_source_zip` and `zip_source_zip_create`. * Allow reading changed file data. * Fix handling of files of size 4294967295. * `zipmerge`: copy extra fields. * `zipmerge`: add option to keep files uncompressed. * Switch test framework to use nihtest instead of Perl. * Fix reading/writing compressed data with buffers > 4GiB. * Restore support for torrentzip. * Add warnings when using deprecated functions. * Allow keeping files for empty archives. * Support mbedTLS>=3.3.0. * Support OpenSSL 3. * Use ISO C secure library functions, if available. ==== openexr ==== Version update (3.1.8 -> 3.1.9) Subpackages: libIex-3_1-30 libIlmThread-3_1-30 libOpenEXR-3_1-30 - version update to 3.1.9 * Patch release that addresses miscelleneous build and doc issues, as well as: . OSS-fuzz 59382 Heap-buffer-overflow in internal_huf_decompress ==== openssl-1_1 ==== Subpackages: libopenssl1_1 - Improve cross-package provides/conflicts [boo#1210313] * Add Provides/Conflicts: ssl-devel * Remove explicit conflicts with other devel-libraries ==== openssl-3 ==== Subpackages: libopenssl3 libopenssl3-32bit - Improve cross-package provides/conflicts [boo#1210313] * Add Provides/Conflicts: ssl-devel * Remove explicit conflicts with other devel-libraries * Remove Provides: openssl(cli) - it's managed by meta package ==== openssl ==== - Improve cross-package provides/conflicts [boo#1210313] * Add Conflicts: openssl(cli) for mutual exclusion between openssl, openssl-1_0_0 and libressl. ==== perl-Bootloader ==== Version update (1.4 -> 1.5) - merge gh#openSUSE/perl-bootloader#153 - check whether grub2-install supports --suse-force-signed option - 1.5 ==== policycoreutils ==== Subpackages: policycoreutils-lang policycoreutils-python-utils python3-policycoreutils - Recommend setools-console as these cli tools compliment policycoreutils for analysis and debugging of policy issues - Add requires for policycoreutils-devel for selinux-policy-devel as policycoreutils-devel requires this - Adjust python requirement for newer SLES versions - Add Leap compatibility symlinks between /usr/sbin and /sbin (bsc#1210482) - Refresh GPG keyring ==== sddm ==== Version update (0.19.0 -> 0.20.0) Subpackages: sddm-branding-openSUSE - Add patch to fix parsing some session .desktop files: * 0001-Session-Parse-.desktop-files-manually-again.patch - Update to 0.20.0: + Initial Qt6 support (Will break themes which rely on Qt 5) + **Experimental** support for running the greeter with Wayland + Enable HiDPI scaling by default + Support for running X11 display server without root privileges + Greeter: Support setting environment variables + Allow additional env vars to be defined in session files (#1370) + Make accountsservice data directory overridable via CMake + Add support for X11 cursor size configuration + Search XDG Base Directories for session files + Display information and errors from PAM in the greeter (#1486) * Remove the Passwd backend, make PAM mandatory * Bump minimum CMake version to 3.4 * Introduce SDDM_INITIAL_VT as the TTY to reach out to * Set XCURSOR_SIZE in XorgDisplayServer::start * Make it possible to start ConsoleKit D-Bus service during SDDM startup * pam: Do not use tally2 if faillock is present * Bump to Qt 5.15, port away from deprecated APIs * remove `-logfile` arg that causes server to fail - Set RUNTIME_DIR to /run/sddm when using systemd to follow FHS 3.0 - Use avatars in FacesDir first and if not found search other locations - Switch to using libxau with `FamilyWild` (#1230) - New interface to access config values from themes (#1097) - Session names are translated now (#1645) - Many more bugfixes - Important change: SDDM now uses the first free VT, it no longer prefers tty7 (the InitialVT option in 00-general.conf has no effect anymore) - Remove patches, now upstream: * 0001-Use-PAM-s-username.patch * 0001-Add-fish-etc-profile-and-HOME-.profile-sourcing-1331.patch * 0004-Retry-starting-the-display-server.patch * 0001-disable-automatic-portal-launching.patch * 0001-Remove-suffix-for-Wayland-session.patch * 0001-Redesign-Xauth-handling.patch * 0002-Use-QTemporaryFile-with-xauth_XXXXXX-ih-XAuth.patch * 0001-Process-all-available-auth-messages-in-a-loop.patch * 0001-Avoid-starting-a-new-session-on-exit.patch - Remove files, now upstream: * sddm-tmpfiles.conf * system-user-sddm.conf - Rebased patches: * 0001-Redesign-Xauth-handling.patch * 0001-Write-the-daemon-s-PID-to-a-file-on-startup.patch * 0001-Set-XAUTHLOCALHOSTNAME-in-sessions.patch * 0001-Read-the-DISPLAYMANAGER_AUTOLOGIN-value-from-sysconf.patch * sddm-service-handle-plymouth.patch * 0003-Leave-duplicate-symlinks-out-of-the-SessionModel.patch - Drop patches, not applicable anymore: * 0001-Systemd-service-unit-Use-tty7-by-default.patch - Add 11-kwin_wayland.conf to use kwin_wayland as wayland compositor ==== systemd ==== Subpackages: libsystemd0 libsystemd0-32bit libudev1 systemd-32bit systemd-container systemd-coredump systemd-lang udev - Change the group owner of /run/lock from "lock" to "root" (bsc#1212674) This allows to drop the dependency "Requires: group(lock)" that was introduced previously to make sure that the "lock" group will be kept around. This dependency introduced a dependency cycle. - file-triggers: fix a typo that sneaked in the script dealing with tmpfiles (bsc#1212733) ==== transactional-update ==== Version update (4.2.1 -> 4.3.0) Subpackages: dracut-transactional-update libtukit4 transactional-update-zypp-config tukit tukitd - Version 4.3.0 - Replace custom tu-rebuild-kdump-initrd with call to mkdumprd [gh#openSUSE/transactional-update#107]. - Add support for libmount 2.39. The behaviour change was not intended and will be changed in 2.39.1 (see [gh#util-linux/util-linux#2326], but it was easy to fix it anyway. - Honor LIBMOUNT_DEBUG variable for additional output.

1 0

python-aiobotocore removed?
by Adrian Glaubitz 30 Jun '23

30 Jun '23

Hello! I just wanted to update python-aiobotocore in d:l:p:aws but noticed the package is no longer there. I can't seem to find any hint on why the package was removed and I'm a bit surprised since it has still some reverse dependencies such as python- s3fs. Anyone knows? Adrian

4 6