September 2023 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1214232] New: [FTBFS] crash/crash-trace fail to build against glibc 2.38
by bugzilla_noreply＠suse.com 08 Dec '23

08 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1214232 Bug ID: 1214232 Summary: [FTBFS] crash/crash-trace fail to build against glibc 2.38 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- glibc 2.38 has been introduced to Factory recently. crash and crash-trace are among the few packages that fail to build with this update. Both fail very similar: [ 5s] /usr/include/crash/defs.h:5517:8: error: conflicting types for 'strlcpy'; have 'size_t(char *, char *, size_t)' {aka 'long unsigned int(char *, char *, long unsigned int)'} [ 5s] 5517 | size_t strlcpy(char *, char *, size_t); [ 5s] | ^~~~~~~ [ 5s] In file included from /usr/include/features.h:503, [ 5s] from /usr/include/bits/libc-header-start.h:33, [ 5s] from /usr/include/stdio.h:27, [ 5s] from /usr/include/crash/defs.h:22: [ 5s] /usr/include/bits/string_fortified.h:150:1: note: previous definition of 'strlcpy' with type 'size_t(char * restrict, const char * restrict, size_t)' {aka 'long unsigned int(char * restrict, const char * restrict, long unsigned int)'} [ 5s] 150 | __NTH (strlcpy (char *__restrict __dest, const char *__restrict __src, [ 5s] | ^~~~~ -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1215546] New: [Build 20230920] openQA test fails in command_not_found: cnf-rs does not offer can't command
by bugzilla_noreply＠suse.com 08 Dec '23

08 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1215546 Bug ID: 1215546 Summary: [Build 20230920] openQA test fails in command_not_found: cnf-rs does not offer can't command Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3591100/modules/comm and_not_found/steps/8 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation cnf-rs was introduced which steps into place of scout-command-not-found by means of provides/obsoletes Unfortunately, the main usage of calling 'cnf binname' is not supported. It would be great to have this command supported with a similar UI/cli interface, making the transition for users seamless openQA test in scenario opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-extra@64bit_virtio-2G fails in [command_not_found](https://openqa.opensuse.org/tests/3591100/modules/comman… ## Test suite description Same as jeos, plus some more tests. ## Reproducible Fails since (at least) Build [20190311](https://openqa.opensuse.org/tests/877894) ## Expected result Last good: (unknown) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1214875] New: [Build 20230831] ltp: openQA test fails in clone302
by bugzilla_noreply＠suse.com 08 Dec '23

08 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1214875 Bug ID: 1214875 Summary: [Build 20230831] ltp: openQA test fails in clone302 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other URL: https://openqa.opensuse.org/tests/3541571/modules/clon e302/steps/7 OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Kernel Assignee: kernel-bugs(a)opensuse.org Reporter: dimstar(a)opensuse.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: openQA Blocker: Yes ## Observation clone302.c:101: TPASS: invalid args: clone3() failed as expected: EFAULT (14) clone302.c:101: TPASS: zero size: clone3() failed as expected: EINVAL (22) clone302.c:91: TFAIL: short size: clone3() passed unexpectedly clone302.c:101: TPASS: extra size: clone3() failed as expected: EFAULT (14) clone302.c:101: TPASS: sighand-no-VM: clone3() failed as expected: EINVAL (22) openQA test in scenario opensuse-Tumbleweed-JeOS-for-kvm-and-xen-x86_64-jeos-ltp-syscalls@uefi_virtio-2G fails in [clone302](https://openqa.opensuse.org/tests/3541571/modules/clone302/steps/… ## Test suite description ## Reproducible Fails since (at least) Build [20230831](https://openqa.opensuse.org/tests/3541222) ## Expected result Last good: [20230830](https://openqa.opensuse.org/tests/3538425) (or more recent) ## Further details Always latest result in this scenario: [latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensus… -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1215652] New: polkit: please whitelist polkit rule change
by bugzilla_noreply＠suse.com 08 Dec '23

08 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1215652 Bug ID: 1215652 Summary: polkit: please whitelist polkit rule change Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: lnussel(a)suse.com QA Contact: qa-bugs(a)suse.de CC: meissner(a)suse.com, otto.hollmann(a)suse.com Target Milestone: --- Found By: --- Blocker: --- https://build.opensuse.org/request/show/1112333 see jsc#PED-260 [ 52s] polkit.x86_64: E: polkit-file-digest-mismatch (Badness: 10000) /usr/share/polkit-1/rules.d/50-default.rules expected sha256:aea3041de2c15db8683620de8533206e50241c309eb27893605d5ead17e5e75f, has:3b5781af8a450c5184c7a2d5408f4af7d3c65f23548ee0962ad0eabb70072c32 [ 52s] A polkit rule file changed in content. Packaging polkit rules requires a [ 52s] review and whitelisting by the SUSE security team. If the package is intended [ 52s] for inclusion in any SUSE product please open a bug report to request review [ 52s] of the package by the security team. Please refer to [ 52s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 52s] more information. -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1213006] New: VUL-0: CVE-2023-34457: python-MechanicalSoup: malicious web server can read arbitrary files on client using file input inside HTML form
by bugzilla_noreply＠suse.com 07 Dec '23

07 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1213006 Bug ID: 1213006 Summary: VUL-0: CVE-2023-34457: python-MechanicalSoup: malicious web server can read arbitrary files on client using file input inside HTML form Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.4 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: toddrme2178(a)gmail.com Reporter: carlos.lopez(a)suse.com QA Contact: security-team(a)suse.de Target Milestone: --- Found By: --- Blocker: --- CVE-2023-34457 A malicious web server can read arbitrary files on the client using a <input type="file" ...> inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took very specific (and manual) steps to reset HTML form field values. https://github.com/MechanicalSoup/MechanicalSoup/security/advisories/GHSA-x… References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-34457 https://bugzilla.redhat.com/show_bug.cgi?id=2219755 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1214412] New: mirror shows Old package separator "'" deprecated warnings after upgrade to perl 5.38
by bugzilla_noreply＠suse.com 07 Dec '23

07 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1214412 Bug ID: 1214412 Summary: mirror shows Old package separator "'" deprecated warnings after upgrade to perl 5.38 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Network Assignee: screening-team-bugs(a)suse.de Reporter: walter.haidinger(a)gmx.at QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Package mirror-2.9-910.23.noarch throws many warnings: Old package separator "'" deprecated. Found in /usr/bin/mirror and it's modules: /usr/lib/perl5/vendor_perl/5.38.0/dateconv.pl /usr/lib/perl5/vendor_perl/5.38.0/lchat.pl /usr/lib/perl5/vendor_perl/5.38.0/lftp.pl /usr/lib/perl5/vendor_perl/5.38.0/lsparse.pl -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1212932] New: sddm 0.20 puts $XAUTHORITY in /tmp instead of $XDG_RUNTIME_DIR
by bugzilla_noreply＠suse.com 06 Dec '23

06 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1212932 Bug ID: 1212932 Summary: sddm 0.20 puts $XAUTHORITY in /tmp instead of $XDG_RUNTIME_DIR Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: KDE Workspace (Plasma) Assignee: opensuse-kde-bugs(a)opensuse.org Reporter: arvidjaar(a)gmail.com QA Contact: qa-bugs(a)suse.de CC: fabian(a)ritter-vogt.de Target Milestone: --- Found By: --- Blocker: --- user@uefi:~> rpm -q sddm sddm-0.20.0-1.1.x86_64 user@uefi:~> env | grep XAUTHORITY XAUTHORITY=/tmp/xauth_srfSMD user@uefi:~> This is likely due to commit eb4a7d564cd9385d089ec9ff4ce68042d31ee93c Author: Fabian Vogt <fabian(a)ritter-vogt.de> Date: Sat Feb 4 21:11:53 2023 +0100 Use QTemporaryFile with xauth_XXXXXX ih XAuth Use proper temporary files instead of UUIDs. This makes the file's purpose more obvious and also takes care of cleanup. -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1213219] New: mariadb: fails to build against fmt 10.0
by bugzilla_noreply＠suse.com 06 Dec '23

06 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1213219 Bug ID: 1213219 Summary: mariadb: fails to build against fmt 10.0 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: danilo.spinella(a)suse.com Reporter: ana.guerrero(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 868149 --> https://bugzilla.suse.com/attachment.cgi?id=868149&action=edit mariadb ftbs with fmt 10 fmt 10.0 has been submitted for inclusion into Factory. During the staging process we have observed mariadb failing to build, I'm attaching the full log. -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1215590] New: Showing the "Authentication Required" root prompt not immediately after clicking "Install" or "Update" in GNOME software is possibly fundamentally insecure
by bugzilla_noreply＠suse.com 05 Dec '23

05 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1215590 Bug ID: 1215590 Summary: Showing the "Authentication Required" root prompt not immediately after clicking "Install" or "Update" in GNOME software is possibly fundamentally insecure Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.5 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: el(a)horse64.org QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Showing the "Authentication Required" root prompt not immediately after clicking "Install" or "Update" in GNOME software seems to me like it is fundamentally insecure, and I would argue it destroys all security benefits this prompt might possibly bring. The problem is that you're essentially training the user to just consent to this prompt no matter what horrible malicious actor might be showing it, since it contains zero information allowing the user to verify it was triggered by a legitimate source. I also can't think of any way you could possibly provide that information, since even if you showed the process id and name, another process could just name itself "gnome-software" and the user isn't going to remember the process id. As a consequence, the only somewhat reliable mechanism the user has for verifying that this prompt is legitimate and not a bad actor is that the prompt showed right after they triggered an action that is actually intended. This however appears to be destroyed by delaying this prompt until the download or whatever preparation steps are complete, rather than as instant as possible after clicking the "Install" or "Update" button in GNOME software. (Because I assume nobody will be just keeping the GNOME software window and stare at it to check that the prompt happened right after some progress bar reached 100%, at least I certainly don't.) -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1214169] New: cloud-init fails to install with "/usr/lib/rpm/fdupes_wrapper: No such file or directory"
by bugzilla_noreply＠suse.com 04 Dec '23

04 Dec '23

https://bugzilla.suse.com/show_bug.cgi?id=1214169 Bug ID: 1214169 Summary: cloud-init fails to install with "/usr/lib/rpm/fdupes_wrapper: No such file or directory" Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: carsten.tschense(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Updating cloud-init on MicroOS fails with (1/1) Installing: cloud-init-23.1-2.1.aarch64 [........ /var/tmp/rpm-tmp.JzYOr4: line 4: /usr/lib/rpm/fdupes_wrapper: No such file or directory warning: %post(cloud-init-23.1-2.1.aarch64) scriptlet failed, exit status 127 .done] -- You are receiving this mail because: You are on the CC list for the bug.

1 1