January 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1127591] New: zypper option "ssl_capath" not working for mirror URLs from metalink file
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1127591 Bug ID: 1127591 Summary: zypper option "ssl_capath" not working for mirror URLs from metalink file Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: x86-64 OS: SUSE Other Status: NEW Severity: Normal Priority: P5 - None Component: libzypp Assignee: zypp-maintainers(a)forge.provo.novell.com Reporter: cunix(a)bitmessage.ch QA Contact: qa-bugs(a)suse.de CC: security-team(a)suse.de Found By: --- Blocker: --- Using zypper (version: 1.14.12) for the update repository of openSUSE Leap 15.0 with the option baseurl=https://download.opensuse.org/update/leap/15.0/oss/?proxy=127.0.0.1… does not use the here configured trusted root certificates for mirror URLs, probably retrieved from a metalink file. The configured path is used for the initial connection to download.opensuse.org but following requests to mirrors seem to fallback to the system trusted certs from /etc/ssl/certs. If the mirrors' root CA is trusted in "ssl_capath=/path/to/directory/with/c_rehash/rootCAs" but not in /etc/ssl/certs, zypper,libzypp, multi-curl or something else aborts the TLS-Handshake with failure "Unknown CA (48)" and falls futher back to http (without transport layer encryption). Question for cc'ed security-team to answer: If using clear text is considered a security flaw where zypper is configured to use (https-)encryption, this might have security implications. Some Scenarios: Assume download.opensuse.org is signed by CA A and the mirror by CA B Assume further, ssl_capath=/path/to/directory/with/c_rehash/rootCAs is directory C and directory D is /etc/ssl/certs 1. If C includes A and B and in D at least B is not available, I would expect zypper to encrypt both connection, but the request to the mirror is not. 2. If A is not in C, no data (meta link file) is retrieved and therefore no mirror is connected - Good! No fallback of looking for A in D occurs. 3. If A is in C and B in D, both connections are encrypted. 4. If A is in C and B not in C and not in D, the mirror is contacted unencrypted - here I'm unsure if using plain text in this scenario is correct or if it should fail. So, in my opinion, 1. is the bug, 3. a workaround and 4. perhaps needs a zypper option to configure, if clear text fallback should be allowed. Another question is, if /etc/ssl/certs should actually be consulted when the option "ssl_capath" is used and pointing to a different directory. https://bugzilla.opensuse.org/show_bug.cgi?id=933839 might be related (similar setup). Problem and solution might be similar, too. By the way, is there a debugging option to dump the traffic from inside the encrypted connection? Especially being able to read the metalink file with the listed mirrors is of interest. -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1206065] New: [trackerbug] Docker 20.10.21-ce update
by bugzilla_noreply＠suse.com 28 Mar '23

28 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1206065 Bug ID: 1206065 Summary: [trackerbug] Docker 20.10.21-ce update Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Containers Assignee: containers-bugowner(a)suse.de Reporter: asarai(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- - Update to Docker 20.10.21-ce. See upstream changelog online at <https://docs.docker.com/engine/release-notes/#201021>. -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1204559] New: /proc/sys/kernel/random/poolsize is in bits, not bytes
by bugzilla_noreply＠suse.com 28 Mar '23

28 Mar '23

https://bugzilla.suse.com/show_bug.cgi?id=1204559 Bug ID: 1204559 Summary: /proc/sys/kernel/random/poolsize is in bits, not bytes Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: YaST2 Assignee: yast2-maintainers(a)suse.de Reporter: snwint(a)suse.com QA Contact: jsrain(a)suse.com Found By: --- Blocker: --- yast copies the entropy pool during installation. But the pool size is actually provided in bits, not bytes, as this code assumes: https://github.com/yast/yast-installation/blob/master/src/lib/installation/… See docs: https://docs.kernel.org/admin-guide/sysctl/kernel.html#random -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1051881] New: clang can't find libc.so with -m32
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1051881 Bug ID: 1051881 Summary: clang can't find libc.so with -m32 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Running: $ clang --version clang version 4.0.1 (tags/RELEASE_401/final 305264) $ cat a.c int main() {} $ clang -m32 a.c /usr/bin/ld: skipping incompatible /usr/bin/../lib64/gcc/x86_64-suse-linux/7/../../../libc.so when searching for -lc /lib/libc.so.6: error adding symbols: File format not recognized clang-4.0.1: error: linker command failed with exit code 1 (use -v to see invocation) I've noticed we have openSUSE specific patches: https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/clang-r… https://build.opensuse.org/package/view_file/openSUSE:Factory/llvm4/assume-… But it does not work properly with -m32. Note the code in DetectDistro.cpp checks for /etc/SuSE-release, which is legacy. One should use /etc/os-release. I can fix that after we resolve this issue. Thanks, Martin -- You are receiving this mail because: You are on the CC list for the bug.

2 7

[Bug 1133084] New: [META] GCC + LTO package failures
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1133084 Bug ID: 1133084 Summary: [META] GCC + LTO package failures Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Meta issue that will track all packages that fail with enabled Link Time Optimization (LTO). For more detail description, please see: https://en.opensuse.org/openSUSE:LTO -- You are receiving this mail because: You are on the CC list for the bug.

2 189

[Bug 1136670] New: LTO: libkate build fails on i586
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1136670 Bug ID: 1136670 Summary: LTO: libkate build fails on i586 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… due to: [ 38s] Checking Kate namespace [ 38s] /usr/bin/nm: '../lib/.libs/*.a': No such file [ 38s] 00000022 W kate.c.1d9f1982 -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1133099] New: LTO: rdma-core build fails
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1133099 Bug ID: 1133099 Summary: LTO: rdma-core build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to: [ 17s] : && /usr/bin/cc -fPIC -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -flto=160 -g -DNDEBUG -Wall -Wextra -Wno-sign-compare -Wno-unused-parameter -Wmissing-prototypes -Wmissing-declarations -Wwrite-strings -Wformat=2 -Wcast-function-type -Wshadow -Wstrict-prototypes -Wold-style-definition -Wredundant-decls -O3 -DNDEBUG -Wl,--as-needed -Wl,--no-undefined -Wl,-z,now -Wl,--as-needed -Wl,--no-undefined -Wl,--version-script,/home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/libibverbs/libibverbs.map -shared -Wl,-soname,libibverbs.so.1 -o lib/libibverbs.so.1.5.23.0 libibverbs/CMakeFiles/ibverbs.dir/all_providers.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_ah.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_counters.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_cq.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_device.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_dm.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_fallback.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_flow.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_flow_action.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_ioctl.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_mr.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_mw.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_pd.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_rwq_ind.c.o libibverbs/CMakeFiles/ibverbs.dir/cmd_xrcd.c.o libibverbs/CMakeFiles/ibverbs.dir/compat-1_0.c.o libibverbs/CMakeFiles/ibverbs.dir/device.c.o libibverbs/CMakeFiles/ibverbs.dir/dummy_ops.c.o libibverbs/CMakeFiles/ibverbs.dir/dynamic_driver.c.o libibverbs/CMakeFiles/ibverbs.dir/enum_strs.c.o libibverbs/CMakeFiles/ibverbs.dir/init.c.o libibverbs/CMakeFiles/ibverbs.dir/marshall.c.o libibverbs/CMakeFiles/ibverbs.dir/memory.c.o libibverbs/CMakeFiles/ibverbs.dir/neigh.c.o libibverbs/CMakeFiles/ibverbs.dir/static_driver.c.o libibverbs/CMakeFiles/ibverbs.dir/sysfs.c.o libibverbs/CMakeFiles/ibverbs.dir/verbs.c.o ccan/libccan_pic.a util/librdma_util_pic.a -lnl-route-3 -lnl-3 -lpthread -ldl kernel-headers/libkern-abi.a && : [ 17s] ../libibverbs/verbs.c: In function 'ibv_resolve_eth_l2_from_gid': [ 17s] ../libibverbs/verbs.c:1040:8: warning: 'ret_vid' may be used uninitialized in this function [-Wmaybe-uninitialized] [ 17s] 1040 | *vid = ret_vid; [ 17s] | ^ [ 17s] ../libibverbs/verbs.c:976:11: note: 'ret_vid' was declared here [ 17s] 976 | uint16_t ret_vid; [ 17s] | ^ [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_resolve_eth_l2_from_gid': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:980: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_init_ah_from_wc': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:720: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:720: undefined reference to `ibv_query_gid' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `ibv_create_ah_from_wc': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/verbs.c:904: undefined reference to `ibv_create_ah' [ 17s] /usr/lib64/gcc/x86_64-suse-linux/9/../../../../x86_64-suse-linux/bin/ld: /tmp/libibverbs.so.1.5.23.0.Z9fe9e.ltrans0.ltrans.o: in function `verbs_open_device': [ 17s] /home/abuild/rpmbuild/BUILD/rdma-core-23.0.43adee5e3196/build/../libibverbs/device.c:315: undefined reference to `ibv_query_port' The package uses symbol versioning: https://en.opensuse.org/openSUSE:LTO#Symbol_versioning -- You are receiving this mail because: You are on the CC list for the bug.

2 3

[Bug 1142586] New: LTO: gstreamer-plugins-base build fails on aarch64
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1142586 Bug ID: 1142586 Summary: LTO: gstreamer-plugins-base build fails on aarch64 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails here: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:ARM/gstr… -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1138813] New: LTO: libsepol build fails
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1138813 Bug ID: 1138813 Summary: LTO: libsepol build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to symbol versioning: https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:… -- You are receiving this mail because: You are on the CC list for the bug.

2 2

[Bug 1133278] New: LTO: pulseaudio build fails
by bugzilla_noreply＠novell.com 28 Mar '23

28 Mar '23

http://bugzilla.opensuse.org/show_bug.cgi?id=1133278 Bug ID: 1133278 Summary: LTO: pulseaudio build fails Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: martin.liska(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- Fails due to: libtool: error: not configured to extract global symbols from dlpreopened files <artificial>:(.text+0x1643): undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' <artificial>:(.text+0x164f): undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' -- You are receiving this mail because: You are on the CC list for the bug.

2 3