June 2021 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1186315] New: Flatpak packages installed without pre-configured repo, making "out-of-the-box" usage impossible
by bugzilla_noreply＠suse.com 30 Mar '23

30 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1186315 Bug ID: 1186315 Summary: Flatpak packages installed without pre-configured repo, making "out-of-the-box" usage impossible Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: x86-64 OS: openSUSE Leap 15.2 Status: NEW Severity: Enhancement Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: blst(a)arcor.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Flatpak's goal to make software installation easier on Linux systems. This approach was also designed for less experienced users. But the way it is implemented in Leap 15.2 makes it hard to use. 1) It is not installed per default (other distributions install the packages during the setup process) 2) The user can install the Flatpak system via the package manager, but after the installation it requires additional configuration. It seems that there are no Flatpak repos configured per default. The main source for Flakpak is flathub.org. To make at least the install command lines at Flathub working, I had to >flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo Suggestion a) add the Flathub repo per default or b) make a seperate flathub.org repo installation package available -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1175219] New: OpenVPN fails with certificates on smart cards on Leap 15.2 and TW
by bugzilla_noreply＠suse.com 29 Mar '23

29 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1175219 Bug ID: 1175219 Summary: OpenVPN fails with certificates on smart cards on Leap 15.2 and TW Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.2 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: bjoernv(a)arcor.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- After upgrading from Leap 15.1 to Leap 15.2 working OpenVPN setups with PKCS11 certificates on Yubikeys are failing. The same applies to openSUSE Tumbleweed. Also other smart card devices may be affected. OpenVPN does not show many details, even with highest logging level. # openvpn --cd /etc/openvpn --config openvpn-yubikey-test.ovpn [...] Thu Aug 13 10:21:21 2020 VERIFY OK: depth=1, CN=Test CA Thu Aug 13 10:21:21 2020 VERIFY KU OK Thu Aug 13 10:21:21 2020 Validating certificate extended key usage Thu Aug 13 10:21:21 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Thu Aug 13 10:21:21 2020 VERIFY EKU OK Thu Aug 13 10:21:21 2020 VERIFY OK: depth=0, CN=host1.example.com Thu Aug 13 10:21:21 2020 OpenSSL: error:141F0006:SSL routines:tls_construct_cert_verify:EVP lib Thu Aug 13 10:21:21 2020 TLS_ERROR: BIO read tls_read_plaintext error Thu Aug 13 10:21:21 2020 TLS Error: TLS object -> incoming plaintext read error Thu Aug 13 10:21:21 2020 TLS Error: TLS handshake failed Thu Aug 13 10:21:21 2020 Fatal TLS error (check_tls_errors_co), restarting Thu Aug 13 10:21:21 2020 SIGUSR1[soft,tls-error] received, process restarting Thu Aug 13 10:21:21 2020 Restart pause, 5 second(s) The bug can be resolved by upgrading the pkcs11-helper packages from pkcs11-helper-1.25.1 to pkcs11-helper-devel-1.26.0. # openvpn --cd /etc/openvpn --config openvpn-yubikey-test.ovpn [...] Thu Aug 13 10:32:36 2020 VERIFY OK: depth=1, CN=Test CA Thu Aug 13 10:32:36 2020 VERIFY KU OK Thu Aug 13 10:32:36 2020 Validating certificate extended key usage Thu Aug 13 10:32:36 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Thu Aug 13 10:32:36 2020 VERIFY EKU OK Thu Aug 13 10:32:36 2020 VERIFY OK: depth=0, CN=host1.example.com Enter user1 token Password: (press TAB for no echo) There is a problem with inconsistent padding between OpenSSL 1.1.1 and pkcs11-helper-1.25.1. The details are described here: http://openssl.6102.n7.nabble.com/Issue-with-smartcard-authentication-for-o… The pkcs11-helper-devel-1.26.0 Changelog contains this line: - openssl: support RSA_NO_PADDING padding, thanks to Selva Nair -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1157881] New: mount.nfs improve error reporting: "Connection *WHERE*TO* timed out"
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1157881 Bug ID: 1157881 Summary: mount.nfs improve error reporting: "Connection *WHERE*TO* timed out" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Network Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: 7eggert(a)gmx.de QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- When one of the nfs mounts times out, it gets reported as "Connection timed out". This is semi-helpful and thus semi-qualifies as a bug as well as a feature request. Please forward this to upstream. (Also not being able to mount triggers a bug in systemd to unmount unrelated mounts. One of my nfs servers is currently unresponsive but the other servers do work, yet systemd unmounts several other mounts. mount.nfs not reporting the cause didn't help me to find the cause.) -- You are receiving this mail because: You are on the CC list for the bug.

2 1

[Bug 1127591] New: zypper option "ssl_capath" not working for mirror URLs from metalink file
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1127591 Bug ID: 1127591 Summary: zypper option "ssl_capath" not working for mirror URLs from metalink file Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: cunix(a)bitmessage.ch QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- Using zypper (version: 1.14.12) for the update repository of openSUSE Leap 15.0 with the option baseurl=https://download.opensuse.org/update/leap/15.0/oss/?proxy=127.0.0.1… does not use the here configured trusted root certificates for mirror URLs, probably retrieved from a metalink file. The configured path is used for the initial connection to download.opensuse.org but following requests to mirrors seem to fallback to the system trusted certs from /etc/ssl/certs. If the mirrors' root CA is trusted in "ssl_capath=/path/to/directory/with/c_rehash/rootCAs" but not in /etc/ssl/certs, zypper,libzypp, multi-curl or something else aborts the TLS-Handshake with failure "Unknown CA (48)" and falls futher back to http (without transport layer encryption). Question for cc'ed security-team to answer: If using clear text is considered a security flaw where zypper is configured to use (https-)encryption, this might have security implications. Some Scenarios: Assume download.opensuse.org is signed by CA A and the mirror by CA B Assume further, ssl_capath=/path/to/directory/with/c_rehash/rootCAs is directory C and directory D is /etc/ssl/certs 1. If C includes A and B and in D at least B is not available, I would expect zypper to encrypt both connection, but the request to the mirror is not. 2. If A is not in C, no data (meta link file) is retrieved and therefore no mirror is connected - Good! No fallback of looking for A in D occurs. 3. If A is in C and B in D, both connections are encrypted. 4. If A is in C and B not in C and not in D, the mirror is contacted unencrypted - here I'm unsure if using plain text in this scenario is correct or if it should fail. So, in my opinion, 1. is the bug, 3. a workaround and 4. perhaps needs a zypper option to configure, if clear text fallback should be allowed. Another question is, if /etc/ssl/certs should actually be consulted when the option "ssl_capath" is used and pointing to a different directory. https://bugzilla.opensuse.org/show_bug.cgi?id=933839 might be related (similar setup). Problem and solution might be similar, too. By the way, is there a debugging option to dump the traffic from inside the encrypted connection? Especially being able to read the metalink file with the listed mirrors is of interest. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1051881] New: clang can't find libc.so with -m32
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1051881 Bug ID: 1051881 Summary: clang can't find libc.so with -m32 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Running: $ clang --version clang version 4.0.1 (tags/RELEASE_401/final 305264) $ cat a.c int main() {} $ clang -m32 a.c /usr/bin/ld: skipping incompatible /usr/bin/../lib64/gcc/x86_64-suse-linux/7/../../../libc.so when searching for -lc /lib/libc.so.6: error adding symbols: File format not recognized clang-4.0.1: error: linker command failed with exit code 1 (use -v to see invocation) I've noticed we have openSUSE specific patches: https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/clang-r… https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/assume-… But it does not work properly with -m32. Note the code in DetectDistro.cpp checks for /etc/SuSE-release, which is legacy. One should use /etc/os-release. I can fix that after we resolve this issue. Thanks, Martin -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1133084] New: [META] GCC + LTO package failures
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1133084 Bug ID: 1133084 Summary: [META] GCC + LTO package failures Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Meta issue that will track all packages that fail with enabled Link Time Optimization (LTO). For more detail description, please see: https://en.opensuse.org/openSUSE:LTO -- You are receiving this mail because: You are on the CC list for the bug.

2 189

[Bug 1136670] New: LTO: libkate build fails on i586
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1136670 Bug ID: 1136670 Summary: LTO: libkate build fails on i586 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… due to: [ 38s] Checking Kate namespace [ 38s] /usr/bin/nm: '../lib/.libs/*.a': No such file [ 38s] 00000022 W kate.c.1d9f1982 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1133099] New: LTO: rdma-core build fails
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1133099 Bug ID: 1133099 Summary: LTO: rdma-core build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to: [ 17s] : && /usr/bin/cc -fPIC -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -flto=160 -g -DNDEBUG -Wall -Wextra -Wno-sign-compare -Wno-unused-parameter -Wmissing-prototypes -Wmissing-declarations -Wwrite-strings -Wformat=2 -Wcast-function-type -Wshadow -Wstrict-prototypes -Wold-style-definition -Wredundant-decls -O3 -DNDEBUG -Wl,--as-needed -Wl,--no-undefined -Wl,-z,now -Wl,--as-needed -Wl,--no-undefined -Wl,--version-script,/home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/libibverbs/libibverbs.map -shared -Wl,-soname,libibverbs.so.1 -o lib/libibverbs.so.1.5.23.0 libibverbs/CMakeFiles/ibverbs.dir/all_providers.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_ah.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_counters.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_cq.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_device.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_dm.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_fallback.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_flow.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_flow_action.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_ioctl.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_mr.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_mw.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_pd.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_rwq_ind.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_xrcd.c.o libibverbs/CMakeFiles/ibverbs.dir/compat-1_0.c.o libibverbs/CMakeFiles/ibverbs.dir/device.c.o libibverbs/CMakeFiles/ibverbs.dir/dummy_ops.c.o libibverbs/CMakeFiles/ibverbs.dir/dynamic_driver.c.o libibverbs/CMakeFiles/ibverbs.dir/enum_strs.c.o libibverbs/CMakeFiles/ibverbs.dir/init.c.o libibverbs/CMakeFiles/ibverbs.dir/marshall.c.o libibverbs/CMakeFiles/ibverbs.dir/memory.c.o libibverbs/CMakeFiles/ibverbs.dir/neigh.c.o libibverbs/CMakeFiles/ibverbs.dir/static_driver.c.o libibverbs/CMakeFiles/ibverbs.dir/sysfs.c.o libibverbs/CMakeFiles/ibverbs.dir/verbs.c.o ccan/libccan_pic.a util/librdma_util_pic.a -lnl-route-3 -lnl-3 -lpthread -ldl kernel-headers/libkern-abi.a && : [ 17s] ../libibverbs/verbs.c: In function 'ibv_resolve_eth_l2_from_gid': [ 17s] ../libibverbs/verbs.c:1040:8: warning: 'ret_vid' may be used uninitialized in this function [-Wmaybe-uninitialized] [ 17s] 1040 | *vid = ret_vid; [ 17s] | ^ [ 17s] ../libibverbs/verbs.c:976:11: note: 'ret_vid' was declared here [ 17s] 976 | uint16_t ret_vid; [ 17s] | ^ [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_resolve_eth_l2_from_gid': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:980: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_init_ah_from_wc': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:720: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:720: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_create_ah_from_wc': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:904: undefined reference to `ibv_create_ah' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `verbs_open_device': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/device.c:315: undefined reference to `ibv_query_port' The package uses symbol versioning: https://en.opensuse.org/openSUSE:LTO#Symbol_versioning -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1142586] New: LTO: gstreamer-plugins-base build fails on aarch64
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1142586 Bug ID: 1142586 Summary: LTO: gstreamer-plugins-base build fails on aarch64 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/gstr… -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1138813] New: LTO: libsepol build fails
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1138813 Bug ID: 1138813 Summary: LTO: libsepol build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to symbol versioning: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… -- You are receiving this mail because: You are on the CC list for the bug.

2 2