January 2025 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1203308] Astroprojection cursor after opening the steam client.
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1203308 https://bugzilla.suse.com/show_bug.cgi?id=1203308#c7 Rylee K <adamska156(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |adamska156(a)gmail.com --- Comment #7 from Rylee K <adamska156(a)gmail.com> --- It's been over 2 years and there's not been a single reply to this bug report, meanwhile most other major distros have already merged this libei patch into xwayland. Is there any chance this will ever happen with Tumbleweed? -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1231000] New: VUL-0: CVE-2024-47197: Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recomm ...
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1231000 Bug ID: 1231000 Summary: VUL-0: CVE-2024-47197: Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recomm ... Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/422045/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: fstrba(a)suse.com Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: stoyan.manolov(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0. Users are recommended to upgrade to version 3.3.0, which fixes the issue. Archetype integration testing creates a file called ./target/classes/archetype-it/archetype-settings.xml This file contains all the content from the users ~/.m2/settings.xml file, which often contains information they do not want to publish. We expect that on many developer machines, this also contains credentials. When the user runs mvn verify again (without a mvn clean), this file becomes part of the final artifact. If a developer were to publish this into Maven Central or any other remote repository (whether as a release or a snapshot) their credentials would be published without them knowing. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-47197 https://www.cve.org/CVERecord?id=CVE-2024-47197 https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96 -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1232244] AUDIT-WHITELIST: xfce4-power-manager: new polkit action to pkexec xfce4-pm-helper
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1232244 https://bugzilla.suse.com/show_bug.cgi?id=1232244#c15 Wolfgang Frisch <wolfgang.frisch(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED --- Comment #15 from Wolfgang Frisch <wolfgang.frisch(a)suse.com> --- Backport released -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1235148] New: Fedora 40 packages are being signed with expired keys
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235148 Bug ID: 1235148 Summary: Fedora 40 packages are being signed with expired keys Classification: openSUSE Product: openSUSE.org Version: unspecified Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: BuildService Assignee: screening-team-bugs(a)suse.de Reporter: pstivanin(a)suse.com QA Contact: adrian.schroeter(a)suse.com Target Milestone: --- Found By: --- Blocker: --- Hello, it seems that since a month or so, Fedora 40 pkgs are being signed with an expired key: Running transaction test RPM: error: Verifying a signature using certificate B2437D2BAFEBA93384F8F25FFB161AA97C614E92 (home:polslinux OBS Project <home:polslinux@build.opensuse.org>): RPM: 1. Certificate FB161AA97C614E92 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: 2. Key FB161AA97C614E92 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: error: Verifying a signature using certificate B2437D2BAFEBA93384F8F25FFB161AA97C614E92 (home:polslinux OBS Project <home:polslinux@build.opensuse.org>): RPM: 1. Certificate FB161AA97C614E92 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: 2. Key FB161AA97C614E92 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: error: Verifying a signature using certificate B2437D2BAFEBA93384F8F25FFB161AA97C614E92 (home:polslinux OBS Project <home:polslinux@build.opensuse.org>): RPM: 1. Certificate FB161AA97C614E92 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: 2. Key FB161AA97C614E92 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: error: Verifying a signature using certificate B2437D2BAFEBA93384F8F25FFB161AA97C614E92 (home:polslinux OBS Project <home:polslinux@build.opensuse.org>): RPM: 1. Certificate FB161AA97C614E92 invalid: certificate is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z RPM: 2. Key FB161AA97C614E92 invalid: key is not alive RPM: because: The primary key is not live RPM: because: Expired on 2024-11-18T03:25:17Z The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: Transaction test error: package libcotp3-3.1.0-1.44.x86_64 does not verify: Header V3 RSA/SHA256 Signature, key ID 7c614e92: NOTTRUSTED package otpclient-4.0.2-1.74.x86_64 does not verify: Header V3 RSA/SHA256 Signature, key ID 7c614e92: NOTTRUSTED This is happening to multiple users. Is there something I need to do on my side? Thanks -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1102408] trackerbug: packages do not build reproducibly from race conditions
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1102408 https://bugzilla.suse.com/show_bug.cgi?id=1102408#c44 --- Comment #44 from OBSbugzilla Bot <bwiedemann+obsbugzillabot(a)suse.com> --- This is an autogenerated message for OBS integration: This bug (1102408) was mentioned in https://build.opensuse.org/request/show/1235499 Factory / nethack -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1235146] New: [6.13] vbox kmp fails to build with kernel 6.13
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235146 Bug ID: 1235146 Summary: [6.13] vbox kmp fails to build with kernel 6.13 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Virtualization:Other Assignee: virt-bugs(a)suse.de Reporter: jslaby(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- https://build.opensuse.org/package/live_build_log/Kernel:HEAD:KMP/virtualbo… > [ 83s] vbox_drv.c:43:11: fatal error: drm/drm_aperture.h: No such file or directory > [ 83s] 43 | # include <drm/drm_aperture.h> -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1228441] New: python-spyder-notebook fails to build
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1228441 Bug ID: 1228441 Summary: python-spyder-notebook fails to build Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: code(a)bnavigator.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mcepl(a)suse.com Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our python-spyder-notebook fails to build. Steps To Reproduce: osc co openSUSE:Factory/python-spyder-notebook && cd $_ osc build --noservice --vm-type=kvm --clean -j4 standard Actual Results: /var/tmp/rpm-tmp.xbK78N: line 85: 2912 Segmentation fault PYTHONPATH=${PYTHONPATH:+$PYTHONPATH:}/home/abuild/rpmbuild/BUILDROOT/python-spyder-notebook-0.5.1-0.x86_64/usr/lib/python3.11/site-packages PYTHONDONTWRITEBYTECODE=1 pytest-3.11 --ignore=_build.python3 -v Full build log: https://rb.zq1.de/other/python-spyder-notebook/build.log -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1235097] zypper output cluttered by failed assertions
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1235097 https://bugzilla.suse.com/show_bug.cgi?id=1235097#c7 Alynx Zhou <alynx.zhou(a)suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(jdelvare(a)suse.com | |) | --- Comment #7 from Alynx Zhou <alynx.zhou(a)suse.com> --- Hi, First please try `env | grep proxy` because the ENVs could also be lower case. And if you still have no lower case ENVs, please try remove PROXY related configs in sysconfig files directly. While the error could be suppressed by <https://github.com/libproxy/libproxy/pull/308> (ignore invalid URLs), I still want to know what triggered it. Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

1 0

[Bug 1234709] New: static-initrd: embeds random tmpdir
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1234709 Bug ID: 1234709 Summary: static-initrd: embeds random tmpdir Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de Blocks: 1062303 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our static-initrd:base package varies in every build, with such a diff: --- old//usr/share/initrd/static-initrd-base-6.11.8-1-default.unsigned.cpio/usr/lib/dracut/build-parameter.txt 2024-12-19 09:14:55.079200953 +0000 +++ new//usr/share/initrd/static-initrd-base-6.11.8-1-default.unsigned.cpio/usr/lib/dracut/build-parameter.txt 2024-12-19 09:14:55.367202831 +0000 @@ -1 +1 @@ - --confdir '/tmp/tmp.k0puBDnkWn' --kernel-image '/boot/vmlinuz' --kver '6.11.8-1-default' --kmoddir '/lib/modules/6.11.8-1-default' --fwdir '/lib/firmware' --no-hostonly --no-hostonly-cmdline --no-hostonly-default-device --conf './dracut.conf' --kernel-cmdline 'rw security=apparmor rd.multipath=0' --omit 'iscsi lunmask multipath memstrack' --xz --show-modules --add-drivers 'fat vfat' --filesystems 'vfat ext4 xfs btrfs overlay' + --confdir '/tmp/tmp.OQ9MWRE5Lv' --kernel-image '/boot/vmlinuz' --kver '6.11.8-1-default' --kmoddir '/lib/modules/6.11.8-1-default' --fwdir '/lib/firmware' --no-hostonly --no-hostonly-cmdline --no-hostonly-default-device --conf './dracut.conf' --kernel-cmdline 'rw security=apparmor rd.multipath=0' --omit 'iscsi lunmask multipath memstrack' --xz --show-modules --add-drivers 'fat vfat' --filesystems 'vfat ext4 xfs btrfs overlay' because: static-initrd.spec:228 has dracut \ --confdir $(mktemp -d) \ -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1231548] New: rusty_v8: packages .o files
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1231548 Bug ID: 1231548 Summary: rusty_v8: packages .o files Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: aavindraa(a)gmail.com Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: amajer(a)suse.com Blocks: 1062303 Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our rusty_v8 package contains files that it probably should not. These have varying names (probably from LTO) such as /usr/lib64/crates/rusty_v8/false/build_script_build-0knbljou9qk3j/s-h0nd8jyxiz-07i8ehl-b7257ohw54kiru274s258lfjp/019rsrysgg6rpjdf91ex4lbvj.o The 'false' in the path makes me think that someone tried to disable it, but failed. -- You are receiving this mail because: You are on the CC list for the bug.

1 3