http://bugzilla.opensuse.org/show_bug.cgi?id=1127591
Bug ID: 1127591
Summary: zypper option "ssl_capath" not working for mirror URLs
from metalink file
Classification: openSUSE
Product: openSUSE Distribution
Version: Leap 15.0
Hardware: x86-64
OS: SUSE Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: libzypp
Assignee: zypp-maintainers(a)forge.provo.novell.com
Reporter: cunix(a)bitmessage.ch
QA Contact: qa-bugs(a)suse.de
CC: security-team(a)suse.de
Found By: ---
Blocker: ---
Using zypper (version: 1.14.12) for the update repository of openSUSE Leap
15.0 with the option
baseurl=https://download.opensuse.org/update/leap/15.0/oss/?proxy=127.0.0.1…
does not use the here configured trusted root certificates for mirror URLs,
probably retrieved from a metalink file.
The configured path is used for the initial connection to download.opensuse.org
but following requests to mirrors seem to fallback to the system trusted certs
from /etc/ssl/certs.
If the mirrors' root CA is trusted in
"ssl_capath=/path/to/directory/with/c_rehash/rootCAs" but not in
/etc/ssl/certs, zypper,libzypp, multi-curl or something else aborts the
TLS-Handshake with failure "Unknown CA (48)" and falls futher back to http
(without transport layer encryption).
Question for cc'ed security-team to answer:
If using clear text is considered a security flaw where zypper is configured to
use (https-)encryption, this might have security implications.
Some Scenarios:
Assume download.opensuse.org is signed by CA A
and the mirror by CA B
Assume further,
ssl_capath=/path/to/directory/with/c_rehash/rootCAs
is directory C
and directory D is
/etc/ssl/certs
1.
If C includes A and B and in D at least B is not available, I would expect
zypper to encrypt both connection, but the request to the mirror is not.
2.
If A is not in C, no data (meta link file) is retrieved and therefore no mirror
is connected - Good!
No fallback of looking for A in D occurs.
3.
If A is in C and B in D, both connections are encrypted.
4.
If A is in C and B not in C and not in D, the mirror is contacted unencrypted -
here I'm unsure if using plain text in this scenario is correct or if it should
fail.
So, in my opinion, 1. is the bug, 3. a workaround and 4. perhaps needs a zypper
option to configure, if clear text fallback should be allowed.
Another question is, if /etc/ssl/certs should actually be consulted when the
option "ssl_capath" is used and pointing to a different directory.
https://bugzilla.opensuse.org/show_bug.cgi?id=933839
might be related (similar setup).
Problem and solution might be similar, too.
By the way, is there a debugging option to dump the traffic from inside the
encrypted connection?
Especially being able to read the metalink file with the listed mirrors is of
interest.
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1051881
Bug ID: 1051881
Summary: clang can't find libc.so with -m32
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Running:
$ clang --version
clang version 4.0.1 (tags/RELEASE_401/final 305264)
$ cat a.c
int main() {}
$ clang -m32 a.c
/usr/bin/ld: skipping incompatible
/usr/bin/../lib64/gcc/x86_64-suse-linux/7/../../../libc.so when searching for
-lc
/lib/libc.so.6: error adding symbols: File format not recognized
clang-4.0.1: error: linker command failed with exit code 1 (use -v to see
invocation)
I've noticed we have openSUSE specific patches:
https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/clang-r…https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/assume-…
But it does not work properly with -m32. Note the code in DetectDistro.cpp
checks for /etc/SuSE-release, which is legacy. One should use /etc/os-release.
I can fix that after we resolve this issue.
Thanks,
Martin
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1133084
Bug ID: 1133084
Summary: [META] GCC + LTO package failures
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Meta issue that will track all packages that fail with enabled Link Time
Optimization (LTO). For more detail description, please see:
https://en.opensuse.org/openSUSE:LTO
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1136670
Bug ID: 1136670
Summary: LTO: libkate build fails on i586
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:…
due to:
[ 38s] Checking Kate namespace
[ 38s] /usr/bin/nm: '../lib/.libs/*.a': No such file
[ 38s] 00000022 W kate.c.1d9f1982
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1142586
Bug ID: 1142586
Summary: LTO: gstreamer-plugins-base build fails on aarch64
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/gstr…
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1138813
Bug ID: 1138813
Summary: LTO: libsepol build fails
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Fails due to symbol versioning:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:…
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1133278
Bug ID: 1133278
Summary: LTO: pulseaudio build fails
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Fails due to:
libtool: error: not configured to extract global symbols from dlpreopened
files
<artificial>:(.text+0x1643): undefined reference to
`lt__PROGRAM__LTX_preloaded_symbols'
<artificial>:(.text+0x164f): undefined reference to
`lt__PROGRAM__LTX_preloaded_symbols'
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1117095
Bug ID: 1117095
Summary: vc4: Failed to allocate from CMA, graphics freezes
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: aarch64
OS: openSUSE Factory
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Kernel
Assignee: kernel-maintainers(a)forge.provo.novell.com
Reporter: jimc(a)math.ucla.edu
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
On a Raspberry Pi 3B (not plus) with OpenSuSE Tumbleweed
openSUSE-release-20181101-934.1.aarch64 and
kernel-default-4.18.15-1.2.aarch64. Kernel command line (/proc/cmdline):
BOOT_IMAGE=/boot/Image-4.18.15-1-default
root=UUID=38fbf451-5579-43d1-bdd2-84cfd886ad00
loglevel=3 splash=silent plymouth.enable=0 swiotlb=512 cma=300M
console=ttyS1,115200n8 console=tty resume=/dev/mmcblk0p3
/boot/efi/config.txt (minus comments):
kernel=u-boot.bin
gpu_mem=32
force_turbo=0
initial_turbo=30
over_voltage=0
enable_uart=1
avoid_warnings=1
dtoverlay=upstream +upstream-mmc +upstreame-aux-interrupt
include ubootconfig.txt
arm_control=0x200
include extraconfig.txt
dtparam=audio=on
dtoverlay=vc4-kms-v3d (similar symptom with vc4-fkms-v3d)
/etc/X11/xorg.conf.d/20-kms.conf says:
Section "Device"
Identifier "kms gfx"
Driver "modesetting"
#Option "AccelMethod" "none" [Commented out]
EndSection
/var/log/Xorg.0.log says:
modeset(0): [DRI2] DRI driver: vc4
AIGLX: Loaded and initialized vc4
GLX: Initialized DRI2 GL provider for screen 0
In this configuration, glmark2-0.0+git.20180608-1.1.aarch64
runs without freezing or crashing and gets an overall score of 74,
whereas with software rendering the score is 17, so GPU acceleration is
really happening.
>From the LightDM greeter I log in and start the default XFCE desktop.
I start various programs and eventually get the symptom complained about;
in the simplest case I start one xterm, one xload -update 2 (secs), and
xscreensaver-5.37-4.3.aarch64 is active, blanking the screen only, DPMS
off after 20 min. I let it incubate overnight.
At the start, CmaTotal (from /proc/meminfo) is 307200kB and CmaFree
is 206856 kB; CmaFree went up gradually to 241684 kB by the time the
screensaver shut off video (DPMS).
After 5 hours CmaFree was static at 234252 kB. With no change in CmaFree
this message appeared in syslog:
Nov 22 01:15:25 orion kernel: [34890.524661] [drm:vc4_bo_create [vc4]]
*ERROR* Failed to allocate from CMA:
Nov 22 01:15:25 orion kernel: [34890.524683] [drm] kernel: 8100kb BOs (1)
Nov 22 01:15:25 orion kernel: [34890.524691] [drm] V3D: 26904kb BOs
(121)
Nov 22 01:15:25 orion kernel: [34890.524699] [drm] V3D shader: 272kb BOs (65)
Nov 22 01:15:25 orion kernel: [34890.524706] [drm] dumb: 48kb BOs (3)
Nov 22 01:15:25 orion kernel: [34890.524713] [drm] binner: 16384kb BOs (1)
Nov 22 01:15:25 orion kernel: [34890.524721] [drm] total purged BO: 8kb BOs (2)
Nov 22 01:15:25 orion kernel: [34890.524741] vc4_v3d 3fc00000.v3d: Failed to
allocate memory for tile binning: -12. You may need to enable CMA or
give it more memory.
In other tests this message appears at the same time that graphics freezes.
When I woke up the screensaver, video came on, but the screen was black,
except the cursor was visible, confined within the screensaver's
authentication box. In other tests the screen content at the time of
freezing remains unchanging, but the cursor changes shape according to
what it's over, including not changing shape if the program (e.g. xterm)
owning the window was killed. Keystrokes directed to an xterm are
received and executed (with no visible effect on the screen), e.g.
"echo Test File > /tmp/testfile", and the file appears. I can do
"DISPLAY=:0 XAUTHORITY=/run/lightdm/root/:0 xwd -root > image.xwd"
and the image will be complete and will show the current windows, not
those at the time of freezing.
The same symptoms can be elicited quicker if I run Firefox or Chromium.
Heavy work in the browser did not seem to make the failure happen earlier;
the 2 tests (one after the other) were to scroll quickly through 1.16Mb of
text/html (no Javascript nor images), then 221 JPEG images in simple
HTML pages. The freeze typically happens when I am doing nothing on the
RPi, writing up notes on another machine. With either web browser, but
not in the simple test case, CmaFree declined in non-reproducible
patterns until the freeze occurred, and continued to decline to near
zero (like 3000kB). I believe that this "death spiral" behavior is
consequential damage from something freezing up, not the actual cause of
the freeze.
This is a known bug, though the exact symptoms seem to change with small
variations in the test conditions, and with one or another kernel commit
being excluded.
https://github.com/raspberrypi/linux/issues/2680 (2018-09-12, OP cbxbiker61)
He reports it began for him with approx. kernel 4.14.62 and someone else
reports that it's still there in 4.18.11. Jimc sees it in 4.18.15 .
Other forum and bug posters in various distros (Arch, Red Hat) report
various similar-sounding problems, starting around 2018-09-xx.
Could the SuSE distro managers please identify a combination of commits
that gives the best results in the OpenSuSE context and push out that
kernel, and keep an eye on progress in finding and killing the actual
bug that is causing these freezeups? Thank you.
I'm going to try to do the same thing, and I'll report back if I succeed,
not a sure thing given my limited skills with git.
--
You are receiving this mail because:
You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1138833
Bug ID: 1138833
Summary: LTO: libxcrypt build fails
Classification: openSUSE
Product: openSUSE Tumbleweed
Version: Current
Hardware: Other
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: Basesystem
Assignee: bnc-team-screening(a)forge.provo.novell.com
Reporter: martin.liska(a)suse.com
QA Contact: qa-bugs(a)suse.de
Found By: ---
Blocker: ---
Fails due to symbol versioning:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:…
--
You are receiving this mail because:
You are on the CC list for the bug.