November 2020 - openSUSE Factory - openSUSE Mailing Lists

[opensuse-factory] Package Removal announcement: eletra
by Dominique Leuenberger / DimStar 27 Nov '20

27 Nov '20

Hi everybody, I'd like to inform you that the package 'elektra' will be removed from openSUSE:Factory if nobody cares to fix it. This package has not had a successful build since May 2020 - 6 months grace period sounds like enough to justify its removal. This will have a few side-effects to other packages, that must also be removed, as they depend on elektra (but are currently not installable, due to elektra requiring libraries that no longer exist for a while already) So, the packages in question to be removed will be: * elektra * oyranos (color management system, depends on elektra) * icc-examin (depends on oyranos) * synnefo (depends on oyranos) * kolor-manager * xcm There is potentially more showing up, based on what the bot finds which I did not yet see, but this should give some information as to what is going to happen. Cheers, Dominique PS: of course, if somebody volunteers and commits to fixing elektra,we can consider keeping it around. There are like 10 version updates available upstream - which shows tha maintenance is not high up on this package.

3 9

[opensuse-factory] new package: upmpdcli
by Michael Pujos 26 Nov '20

26 Nov '20

Hi, I'm submitting new package upmpdcli in multimedia:apps to Factory, as well as its 2 lib dependencies libnpupnp and libupnpp in multimedia:libs OBS project: https://build.opensuse.org/package/show/multimedia:apps/upmpdcli homepage: https://www.lesbonscomptes.com/upmpdcli/ git repo: https://framagit.org/medoc92/upmpdcli upmpdcli implements a robust UPnP AV / OpenHome renderer for playing audio using mpd as the backend for playback. It is used by several hardware manufacturers and distros geared toward audio use (Volumio, Moode, ...), often for running on the Raspberry Pi. upmpdcli can be controlled from any UPnP AV / OpenHome Control Point program. On Linux, there is upplay that is also in multimedia:apps but that I will submit to Factory a bit later. On mobile there is quite a bit of choice for suitable Control Points apps On macOS and Windows there is Linn Kazoo The main difference between UPnP AV and OpenHome is that for the latter the playback queue is stored on the renderer (upmpdcli) side meaning that playback can continue when the Control Point app is not running. OpenHome also allow to have several Control Points connected to the same renderer at the same time and show identical state. The project is very well maintained upstream with regular updates. It has also in-depth user documentation.

1 0

[opensuse-factory] Maintainer request: proftpd
by Dominique Leuenberger / DimStar 26 Nov '20

26 Nov '20

Dear Users and packagers, It appears as if the package proftpd is in need of an additional (or new?) maintainer. The package has been unresolvable in openSUSE:Factory for a very long time. I did the work of upgrading and fixing this, all submitted as https://build.opensuse.org/request/show/849450 But seems nobody is picking up the pieces. There is currently only one maintainer assigned (Christian) and the devel prj maintainers (rightly) wait for the actual package maintainer. I'm sure Christian would welcome somebody else designated to co- maintain this package. Any volunteers? Your first act as maintainer would be to make the package build in Tumbleweed again :) cheers, Dominique

4 4

[opensuse-factory] Presenting Cockpit Wicked
by Imobach González Sosa 26 Nov '20

26 Nov '20

Hi all, If you are into systems management, you most likely have heard about Cockpit[1]. In a nutshell, it offers a good looking web-based interface to perform system tasks, like inspecting the logs, applying system updates, configuring the network, managing services, and so on. Recently, the YaST team got informed that MicroOS developers wanted to offer Cockpit as an option for system management tasks. Unfortunately, Cockpit does not have support for Wicked[2], a network configuration framework included in SUSE-based distributions. So we were given the task of solving that problem. Today we are announcing the first public release of such a module[3]. You can read the full announcement in our blog[4]. Bear in mind that it is still a work in progress (actually, there is a silly UI bug with routes handling that we are fixing now), but some basic use cases are already supported and we would love to get from feedback from you. Thanks in advance! Regards, Imo [1] https://cockpit-project.org/ [2] https://en.opensuse.org/Portal:Wicked [3] https://github.com/openSUSE/cockpit-wicked/ [4] https://yast.opensuse.org/blog/2020-11-25/presenting-cockpit-wicked -- Imobach González Sosa YaST Team at SUSE LLC https://imobachgs.github.io/

3 5

[opensuse-factory] New Tumbleweed snapshot 20201124 released!
by Dominique Leuenberger 26 Nov '20

26 Nov '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: clazy mutt (1.14.7 -> 2.0.2) rubygem-rubocop (1.2.0 -> 1.3.1) technisat-usb2-firmware === Details === ==== clazy ==== - Make sure the clang executables matching the libraries we link to are installed (mitigates boo#1178637). ==== mutt ==== Version update (1.14.7 -> 2.0.2) Subpackages: mutt-doc mutt-lang - update to 2.0.2: * CVE-2020-28896: Ensure IMAP connection is closed after a connection error to avoid sending credentials over an unencrypted connection boo#1179035 - update to 2.0.0 (2020-11-07): + Domain-literal support for email addresses, e.g user@[IPv6:fcXX:...] ! Buffy completion only occurs for the "change-folder" set of functions. It has been disabled for <attach-message>, <write-fcc>, the fcc mailbox prompt, and the autocrypt scan mailbox prompt. ! The "save/copy message to mailbox" set of functions use the "mailbox" history list, instead of the "filename" list. ! Message-ID extraction permits values missing angle brackets and '@' to allow properly threading the garbage sent by some providers. Mutt will add missing angle brackets when sending out replies, however. ! When adding multiple attachments, via <attach-file> in the compose menu, the browser menu can be exiting via <quit> after tagging the files. Previously, <select-entry> had to be used. ! ctrl-p/ctrl-n are by default bound to <history-up>/<history-down> in the editor menu. + The "cd" command allows changing the current working directory. As part of this, Mutt expands relative paths internally. There may be a change to some "prettified" relative paths because of this. ! Some configuration variable default values are localizable by translators. Currently these are: $attribution, $compose_format, $forward_attribution_intro, $forward_attribution_trailer, $status_format, $ts_icon_format, $ts_status_format. + Mutt will try to automatically reconnect to an IMAP mailbox on error, and will merge unsync'ed changes if possible. ! $crypt_protected_headers_subject defaults to "...", following the protected headers revised specification. ! Date, From, To, Cc, and Reply-To headers are stored as protected headers. + XOAUTH2 support. Please see the manual, contrib script mutt_oauth2.py, and mutt_oauth.py.README for more details. + $tunnel_is_secure, default set, assumes a connection via $tunnel is encrypted. Unsetting this will cause $ssl_starttls and $ssl_force_tls to be respected. + Patterns are tab-completable in the editor menu. ! $reply_to is consulted before $reply_self. + $copy_decode_weed, default unset, controls header weeding for <decode-copy> and <decode-save>. + $pipe_decode_weed, default set, enables header weeding for <pipe-message>. + $print_decode_weed, default set, enables header weeding for <print-message>. ! format=flowed attachments are space-unstuffed when viewed, saved, piped, and printed. + The "run" command will execute MuttLisp. $muttlisp_inline_eval, if set, will execute unquoted parenthesized command arguments as MuttLisp. Please see the manual for more details about both. + $cursor_overlay, when set, will overlay the indicator, tree, sidebar_highlight, and sidebar_indicator colors onto the current line. "default" colors will be overridden and attributes will be merged. ! The message-id generation algorithm uses a random number instead of the step counter and PID. ! $ssl_force_tls defaults set. (Trying this again for 2.0). ! $hostname is set *after* muttrc processing. It can be manually set in the muttrc to avoid using DNS calls to obtain the FQDN. + $attach_save_dir specifies a directory to use when saving attachments. - Port the patches to mutt 2.0.0 * aw.listreply.diff * bug-676388-largefile.patch * mutt-1.10.1-imap.patch * mutt-1.13.3.dif * mutt-1.5.15-wrapcolumn.diff * mutt-1.5.20-sendgroupreplyto.diff * mutt-1.5.21-mailcap.diff * mutt-1.5.23-carriage-return.path * mutt-1.6.1-opennfs.dif * mutt-Fix-SIGQUIT-handling.patch * patch-1.5.24.vk.pgp_verbose_mime * widechar.sidebar.dif ==== rubygem-rubocop ==== Version update (1.2.0 -> 1.3.1) New upstream release 1.3.1 [#]# 1.3.1 (2020-11-16) [#]## Bug fixes * [#9037](https://github.com/rubocop-hq/rubocop/pull/9037): Fix `required_ruby_version` issue when using `Gem::Requirement`. ([@cetinajero][]) * [#9039](https://github.com/rubocop-hq/rubocop/pull/9039): Fix stack level too deep error if target directory contains `**`. ([@unasuke][]) * [#6962](https://github.com/rubocop-hq/rubocop/issues/6962): Limit `Layout/ClassStructure` constant order autocorrect to literal constants. ([@tejasbubane][]) * [#9032](https://github.com/rubocop-hq/rubocop/issues/9032): Fix an error for `Style/DocumentDynamicEvalDefinition` when using eval-type method with interpolated string that is not heredoc without comment doc. ([@koic][]) * [#9049](https://github.com/rubocop-hq/rubocop/issues/9049): Have `Lint/ToEnumArguments` accept `__callee__`. ([@marcandre][]) * [#9050](https://github.com/rubocop-hq/rubocop/issues/9050): Fix a false positive for `Style/NegatedIfElseCondition` when `if` with `!!` condition. ([@koic][]) * [#9041](https://github.com/rubocop-hq/rubocop/issues/9041): Fix a false positive for `Naming/VariableNumber` when using integer symbols. ([@koic][]) [#]## Changes * [#9045](https://github.com/rubocop-hq/rubocop/pull/9045): Have `cut_release` handle "config/default" and generate cops doc. ([@marcandre][]) * [#9036](https://github.com/rubocop-hq/rubocop/pull/9036): Allow `enums` method by default for `Lint/ConstantDefinitionInBlock`. ([@koic][]) * [#9035](https://github.com/rubocop-hq/rubocop/issues/9035): Only complain about `SafeYAML` if it causes issues. ([@marcandre][]) [#]# 1.3.0 (2020-11-12) [#]## New features * [#8761](https://github.com/rubocop-hq/rubocop/issues/8761): Read `required_ruby_version` from gemspec file if it exists. ([@HeroProtagonist][]) * [#9001](https://github.com/rubocop-hq/rubocop/pull/9001): Add new `Lint/EmptyClass` cop. ([@fatkodima][]) * [#9025](https://github.com/rubocop-hq/rubocop/issues/9025): Add `AllowedMethods` option to `Lint/ConstantDefinitionInBlock`. ([@koic][]) * [#9014](https://github.com/rubocop-hq/rubocop/pull/9014): Support auto-correction for `Style/IfInsideElse`. ([@koic][]) * [#8483](https://github.com/rubocop-hq/rubocop/pull/8483): Add new `Style/StaticClass` cop. ([@fatkodima][]) * [#9020](https://github.com/rubocop-hq/rubocop/pull/9020): Add new `Style/NilLambda` cop to check for lambdas that always return nil. ([@dvandersluis][]) * [#8404](https://github.com/rubocop-hq/rubocop/pull/8404): Add new `Lint/DuplicateBranch` cop. ([@fatkodima][]) [#]## Bug fixes * [#8499](https://github.com/rubocop-hq/rubocop/issues/8499): Fix `Style/IfUnlessModifier` and `Style/WhileUntilModifier` to prevent an offense if there are both first-line comment and code after `end` block. ([@dsavochkin][]) * [#8996](https://github.com/rubocop-hq/rubocop/issues/8996): Fix a false positive for `Style/MultipleComparison` when comparing two sides of the disjunction is unrelated. ([@koic][]) * [#8975](https://github.com/rubocop-hq/rubocop/issues/8975): Fix an infinite loop when autocorrecting `Layout/TrailingWhitespace` + `Lint/LiteralInInterpolation`. ([@fatkodima][]) * [#8998](https://github.com/rubocop-hq/rubocop/issues/8998): Fix an error for `Style/NegatedIfElseCondition` when using negated condition and `if` branch body is empty. ([@koic][]) * [#9008](https://github.com/rubocop-hq/rubocop/pull/9008): Mark `Style/InfiniteLoop` as unsafe. ([@marcandre][]) [#]## Changes * [#8978](https://github.com/rubocop-hq/rubocop/issues/8978): Update `Layout/LineLength` autocorrection to be able to handle method calls with long argument lists. ([@dvandersluis][]) * [#9015](https://github.com/rubocop-hq/rubocop/issues/9015): Update `Lint/EmptyBlock` to allow for empty lambdas. ([@dvandersluis][]) * [#9022](https://github.com/rubocop-hq/rubocop/issues/9022): Add `NOTE` to keywords of `Style/CommentAnnotation`. ([@koic][]) * [#9011](https://github.com/rubocop-hq/rubocop/issues/9011): Mark autocorrection for `Lint/Loop` as unsafe. ([@dvandersluis][]) * [#9026](https://github.com/rubocop-hq/rubocop/issues/9026): Update `Style/DocumentDynamicEvalDefinition` to detect comment blocks that document the evaluation. ([@dvandersluis][]) * [#9004](https://github.com/rubocop-hq/rubocop/pull/9004): Remove obsolete gem `SafeYAML` compatibility. ([@marcandre][]) * [#9023](https://github.com/rubocop-hq/rubocop/issues/9023): Mark unsafe for `Style/CollectionCompact`. ([@koic][]) * [#9012](https://github.com/rubocop-hq/rubocop/issues/9012): Allow `AllowedIdentifiers` to be specified for `Naming/VariableNumber`. ([@dvandersluis][]) ==== technisat-usb2-firmware ==== - use %_firmwaredir

1 0

[opensuse-factory] openSUSE Release Engineering Meeting 25.11.2020
by Lubos Kocman 25 Nov '20

25 Nov '20

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting ## Participants dleuenberger,guillaume_g,rbrown, lkocman, adrians, maxlin, dirk !!! Please be aware that this meeting is hosted on https://meet.opensuse.org/ReleaseEngineeringMeeting (?) ## Leap Discussing KDE version in Leap 15.3 5.18 LTS (in 15.2) will be maintained only until August 2021, so unmaintained by upstream for most of 15.3 software-o-o Leap 15.3 setup + media placement. Do we keep the ports tab? Since we no longer have ports (with exception of ARMv7) https://github.com/openSUSE/software-o-o/pull/908 TODO: publishing of 15.3 to download.opensuse.org. What publish script can be used in this case? **Ongoing s390x discussion** Ongoing discussion with Sarah about her involvement. We have a meeting on 25th to confirm information. **ARMv7 topic ** Over 200 responses so far (463 responses in total, however I'd say half will be empty). Initial review of responses is next survey.opensuse.org **SLE 15 SP3 binaries ** hopefully this Friday https://progress.opensuse.org/issues/76219 Waiting for Beta1 to be released, sync of SP3 binaries is currently blocked on this. ## openSUSE Tumbleweed * RPM 4.16 in Staging:A, together with brp-check-suse. Some progress done, less failures week over week * i586 builds now use a x86_64 kernel on OBS; the i586 kernel has immense trouble with the memory offered by some of the OBS workers, which slowed down builds more and more. Kernel folks (SUSE & upstream) don't consider performance regressions on 24GB RAM boxes on i586 to be relevant * GNOME 3.38.1 is published in Snapshot 20201119 - GNOME 3.38.2 on the horizon * Active work won rpmlint 2.0 is ongoing; integration work is messy, due to its huge dep chain * DNS on openQA/ariel is back on the GOOGLE ## Richard (Kubic/TW MicroOS) MicroOS is moving to selinux by default (but not Kubic, yet). Please join the selinux(a)lists.opensuse.org mailinglist for all discussions related to improving SELinux on openSUSE. Still Investigating removing MicroOS patterns from Tumbleweed media to stop people making horrific unsupportable unworking hybrid installations. Only use MicroOS media to install MicroOS please.. Dramatically reduced MicroOS/Kubic's Minimum System Requirements from 20GB disk space to 5GB for / (root). Changes on released https://meet.opensuse.org/ReleaseEngineeringMeeting Released latest bug fixes to Kubernetes 1.18, 1.17 and 1.19. MicroOS tasks being tracked on a public github project tracker - https://github.com/orgs/kubic-project/projects/4 . Everyone should please feel free to leave suggestions or (even better) work on the issues tracked there. Spoke about MicroOS Desktop at GNOME Asia 2020 Recertifying k8s 1.19 on Kubic ## Max Blocked on 15 SP3 Beta1. Leap: * Dirty DoD problem still was there, hopefully this will be fixed after switch to SP3 * We're missing online repos setup in pontifex, oss, non-oss, debug, update, etc. (lkocman I'll check repos I suppose we have tasks for it) lkocman: will do Backports: * Many packages unable start to build due to missing package from pool repo * Most of build unresolvables are regarding to java, python, HPC or desktop-data/branding ## Guillaume - Arm Tumbleweed: * PAC/BTI enablement (aarch64 only): Enabled in Factory since Friday evening. No openQA snapshot yet due to a full rebuild (take time) + few build failure being fixed (most of them related to the full rebuild itself, but few of them are related to this change: LLVM). Leap 15.3 ARM: * armv7 support is still an open question. Let's check the survey results soon. https://survey.opensuse.org/index.php/125963 (See Leap section) WSL: WIP to have WSL on aarch64 on https://build.opensuse.org/project/show/home:Guillaume_G:WSL The goal is to have WSL-DistroLauncher package built for aarch64. Will be done today: On this topic I have an agreement with WSL team to publish a blog post about how to get this working manually via wsl.exe import of aarch64 binary archive from OBS. Fedora recently published something like this, but for x86. WSL information: https://en.opensuse.org/openSUSE:WSL https://en.opensuse.org/WSL/Building_in_OBS ## Michel Not Present Lubos requested additional HW resources for openqa, Hector (our Power TPM) is on it. Adrian: there is support for ppc VM in the script, but we need KVM for building images. ## s390x (TBD) lkocman: next meeting with Sarah - Mainframe configuration is ongoing - Deployment failure during DASD configuration (test issue): https://progress.opensuse.org/issues/80188 - Sarah has got the approval by her Manager and his Manager. That has to be made "official" in the next step (this week). She can start next week. - There is the possibility to use the LinuxONE Community Cloud as additional hardware resource for test cases with latest s390x hardware. ## Doug * gnome.asia summit 24.11 - 26.11 * Working on changing section in https://www.opensuse.org/ Will propose changes as some translations will need updating. * metric.o.o. 15.2 * Submit Request to openSUSE:Factory complete * https://build.opensuse.org/request/show/849363 * metrics.o.o. 15.2 still not functioning. Still needs updated package in openSUSE:Leap:15.2:Update and finally upgrade the system. * https://github.com/openSUSE/openSUSE-release-tools/pull/2464 * Updated progress https://progress.opensuse.org/issues/77782 ## Dirk Finished rewording of Distribution Architecture Policy and posted update (was: Tier1 Policy): https://en.opensuse.org/openSUSE:OpenSUSE_Distribution_Architectures_Policy Various Tumbleweed package updates: Reviewed https://github.com/openSUSE/software-o-o/pull/908 ## Gerald No update, just observing. ## Wolfgang (Package Hub) We're currently building against SP2:Update. Rpmlint checks are currently broken, so that's something that I'm currently looking into. So we can be ready when SP3 is synced over. ## Adrian - CtLG No Update Lubos was reached out to by Marco Strigl, about remaining work on the SR mirroring. Will be postponed. We've clarified what is still pending. * Drop of openSUSE:Jump:15.2 setup to be removed after we have a first successful openSUSE 15.3 build based on SP3. Adrian: we will keep it for a little while until the SP3 setup is finished. publishing of 15.3 to download.opensuse.org is also blocked on 15 SP3 Beta1 release.

1 0

[opensuse-factory] [RFC] OpenSUSE Distribution Tiers Policy
by Dirk Müller 24 Nov '20

24 Nov '20

Hi all, I would like to get your input and start a discussion around : https://en.opensuse.org/openSUSE:OpenSUSE_Distribution_Tiers_Policy This is a draft aiming to define what a Premium Tier openSUSE Distribution architecture is. Currently this is mostly x86_64 as it stands today out of historic reasons, and rather than letting historic reasons define the future, I'd like to make it a bit more transparent on why that is and what quality standards an openSUSE distribution has to offer for other architectures to be considered also a main / premium Tier openSUSE Distribution. Please be aware that this does not silently introduce aarch64 as a premium tier, however it is aimed to define the rules that any architecture port including aarch64 would have to meet in order to be considered a premium tier. So once we agree on the terms and scope, AArch64 would be requested to be evaluated against this. For the interest of tracking, please refrain from editing the main page, and use either the mailing list discussion here or the Talk page for comments/questions/considerations/feedback. Thanks! Dirk -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

18 54

[opensuse-factory] tmpfs for /tmp does not work always
by Frans de Boer 24 Nov '20

24 Nov '20

LS, I have several machines running TW only and one with multiple versions of OpenSuse. On the latter machine I can't get the /tmp directory as a memory based directory, but only when using TW. The line in fstab are everywhere the same but when enabled for TW, I can't get services being started because the system is always in read-only mode. Even when I add rw to the mount instruction, it stays in ro mode only. As said before, on other TW machines no problem. Has anybody encountered a similar situation? Regards, Frans. -- A: Yes, just like that A: Ja, net zo Q: Oh, Just like reading a book backwards Q: Oh, net als een boek achterstevoren lezen A: Because it upsets the natural flow of a story A: Omdat het de natuurlijke gang uit het verhaal haalt Q: Why is top-posting annoying? Q: Waarom is Top-posting zo irritant?

4 4

[opensuse-factory] New Tumbleweed snapshot 20201121 released!
by Dominique Leuenberger 23 Nov '20

23 Nov '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaThunderbird (78.4.3 -> 78.5.0) c-ares (1.16.1 -> 1.17.0) distribution-logos-openSUSE (20190414 -> 20201117) drbd-utils fwupd gnome-documents gpg2 (2.2.23 -> 2.2.24) gpgme (1.14.0 -> 1.15.0) gpgmeqt (1.14.0 -> 1.15.0) java-11-openjdk (11.0.9.0 -> 11.0.9.1) libfido2 mariadb (10.5.6 -> 10.5.8) mozilla-nss (3.57 -> 3.58) ovmf pam_mount (2.16 -> 2.17) polkit-default-privs (1550+20201103.994a5ed -> 1550+20201119.2c1dce4) python-qt5 rubygem-rubocop-ast (1.1.0 -> 1.1.1) samba (4.13.0+git.138.ff2d5480c67 -> 4.13.2+git.176.0a5e55b510c) sudo (1.9.2 -> 1.9.3p1) systemd-presets-branding-openSUSE tigervnc ucode-intel (20201110 -> 20201118) xlockmore (5.65 -> 5.66) xtables-addons (3.11_k5.9.8_2 -> 3.12_k5.9.8_2) === Details === ==== MozillaThunderbird ==== Version update (78.4.3 -> 78.5.0) Subpackages: MozillaThunderbird-translations-common - Mozilla Thunderbird 78.5.0 MFSA 2020-52 (bsc#1178894) * CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code * CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls * CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI * CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API) * CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions * CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService * CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray * CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype * CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses * CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords * CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5 - removed obsolete mozilla-rust-1.47.patch ==== c-ares ==== Version update (1.16.1 -> 1.17.0) - ares_dns.h, missing_header.patch: re-add missing header in last release - Version update to 1.17.0 Security: * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing * Avoid theoretical buffer overflow in RC4 loop comparison * Empty hquery->name could lead to invalid memory access * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in (bsc#1178882, CVE-2020-8277) Changes: * Update help information for adig, acountry, and ahost * Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers * Detect remote DNS server does not support EDNS using rules from RFC 6891 * Source tree has been reorganized to use a more modern layout * Allow parsing of CAA Resource Record Bug fixes: * readaddrinfo bad sizeof() * Test cases should honor HAVE_WRITEV flag, not depend on WIN32 * FQDN with trailing period should be queried first * ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints. * ares_gethostbyname() with AF_UNSPEC and an ip address would fail * Properly document ares_set_local_ip4() uses host byte order For details, see https://c-ares.haxx.se/changelog.html - add missing upstream sources, to be removed for next release - remove unnecessary BuildRequires - fix building on SLE12 systems ==== distribution-logos-openSUSE ==== Version update (20190414 -> 20201117) - Add favicon.ico format - Remove obsolete Groups tag (fate#326485) ==== drbd-utils ==== - prepare usrmerge (boo#1029961) ==== fwupd ==== Subpackages: fwupd-lang libfwupd2 libfwupdplugin1 typelib-1_0-Fwupd-2_0 - Obsoletes and Provides dbxtool since fwupd 1.5.0+ now embeds dbxtool in the dbxtool plugin ==== gnome-documents ==== Subpackages: gnome-documents-lang gnome-shell-search-provider-documents - Remove BuildRequires pkgconfig(libgepub-0.6), no longer needed since epub support is in gnome-books now. ==== gpg2 ==== Version update (2.2.23 -> 2.2.24) Subpackages: dirmngr gpg2-lang - GnuPG 2.2.24: * gpg: New command --quick-revoke-sig * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt * gpg: Switch to AES256 for symmetric encryption in de-vs mode * gpg: Silence weak digest warnings with --quiet * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys * agent: Keep some permissions of private-keys-v1.d * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds * dirmngr: Fix the pool keyserver case for a single host in the pool * scd: Fix the use case of verify_chv2 by CHECKPIN * scd: Various improvements to the ccid-driver * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions * i18n: Complete overhaul and completion of the Italian translation ==== gpgme ==== Version update (1.14.0 -> 1.15.0) Subpackages: libgpgme11 libgpgmepp6 python3-gpg - gpgme 1.15.0: * New function gpgme_op_setexpire to make changing the expiration easier * New function gpgme_op_revsig to revoke key signatures * Support exporting secret keys * cpp: Support for set expire operations in the C++ bindings * cpp: Support for revoking key signatures in the C++ bindings * qt: Extended ChangeExpiryJob to support changing the expiry of subkeys * qt: Extended QuickJob to support revoking of key signatures * qt: Added QDebug stream operator for GpgME::Error. * Require libgpg-error 1.36 ==== gpgmeqt ==== Version update (1.14.0 -> 1.15.0) - gpgme 1.15.0: * New function gpgme_op_setexpire to make changing the expiration easier * New function gpgme_op_revsig to revoke key signatures * Support exporting secret keys * cpp: Support for set expire operations in the C++ bindings * cpp: Support for revoking key signatures in the C++ bindings * qt: Extended ChangeExpiryJob to support changing the expiry of subkeys * qt: Extended QuickJob to support revoking of key signatures * qt: Added QDebug stream operator for GpgME::Error. * Require libgpg-error 1.36 ==== java-11-openjdk ==== Version update (11.0.9.0 -> 11.0.9.1) Subpackages: java-11-openjdk-headless - Update to upstream tag jdk-11.0.9.1-1 * Fix: + JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool) - Removed patch: * JDK-8250861.patch + Integrated upstream ==== libfido2 ==== Subpackages: libfido2-1 libfido2-udev - Add Conflicts: to supersede version 1.0.0. This is needed for a clean upgrade path on SLE. ==== mariadb ==== Version update (10.5.6 -> 10.5.8) Subpackages: libmariadbd19 mariadb-client mariadb-errormessages - Update to 10.5.8 * release notes and changelog: https://mariadb.com/kb/en/library/mariadb-1058-release-notes https://mariadb.com/kb/en/library/mariadb-1058-changelog * fixes for the following security vulnerabilities: 10.5.7: CVE-2020-14812, CVE-2020-14765, CVE-2020-14776, CVE-2020-14789 10.5.8: none - tracker bugs: [bsc#1177472] and [bsc#1178428] - refresh mariadb-10.2.19-link-and-enable-c++11-atomics.patch - update suse_skipped_tests.list ==== mozilla-nss ==== Version update (3.57 -> 3.58) Subpackages: libfreebl3 libfreebl3-hmac libsoftokn3 libsoftokn3-hmac mozilla-nss-certs mozilla-nss-tools - update to NSS 3.58 Bugs fixed: * bmo#1641480 (CVE-2020-25648) Tighten CCS handling for middlebox compatibility mode. * bmo#1631890 - Add support for Hybrid Public Key Encryption (draft-irtf-cfrg-hpke) support for TLS Encrypted Client Hello (draft-ietf-tls-esni). * bmo#1657255 - Add CI tests that disable SHA1/SHA2 ARM crypto extensions. * bmo#1668328 - Handle spaces in the Python path name when using gyp on Windows. * bmo#1667153 - Add PK11_ImportDataKey for data object import. * bmo#1665715 - Pass the embedded SCT list extension (if present) to TrustDomain::CheckRevocation instead of the notBefore value. ==== ovmf ==== Subpackages: qemu-ovmf-x86_64 qemu-uefi-aarch64 - Add ovmf-jscSLE-16075-SEV-ES-fixes.patch to merge upstream SEV-ES fixes (jsc#SLE-16075) ==== pam_mount ==== Version update (2.16 -> 2.17) Subpackages: libcryptmount0 libcryptmount0-32bit pam_mount-32bit - Update to release 2.17 * Abandon /sbin as a location - Drop pam_mount-2.16-fix-luks2-mount.patch (merged) ==== polkit-default-privs ==== Version update (1550+20201103.994a5ed -> 1550+20201119.2c1dce4) - Update to version 1550+20201119.2c1dce4: - cleanup of dead and inconsistent polkit actions: * profiles: drop the now rather confusing comment from nwfilter-binding actions * profiles: harmonize and normalize profile syntax and style * profiles: harmonize spice-space.lowlevelusbaccess actions * profiles: remove dead pantheon actions * profiles: remove dead org.gnome.DejaDup.duplicity action * profiles: drop dead com.redhat.tuned.gui.run action * profiles: fix brltty action(s) * profiles: remove dead netvisix action * profiles: realmd.discover-realm action: fix restrictive any setting * profiles: remove dead com.redhat.lvm2.* actions * profiles: group together org.kde.powerdevil actions * profiles: remove dead org.kde.powerdevil.backlighthelper actions * profiles: fix FirewallD1.info action in standard profile * profiles: remove dead org.kde.baloo action * profiles: remove dead kwallet actions and fix kwallet5 restrictive setting * profiles: selinux actions: make restrictive profile no weaker than upstream * profiles: remove dead gufw pkexec action * profiles: adjust mate actions better to upstream defaults * profiles: remove dead org.libvirt.api.newfilter.bind-* actions * profiles: clear dead nepomuk.filewatch.raiselimit action * profiles: remove dead kcmlightdm actions * profiles: adjust gnome.controlcenter actions better to upstream defaults * profiles: remove dead org.kde.recorditnow helper * profiles: remove dead de.berlios.smb4k.mounthelper actions * profiles: adjust user-administration action better to upstream defaults * profiles: cleanup urfkill actions * profiles: adjust ModemManager1 actions better to upstream settings * profiles: cleanup ModemManager actions * profiles: sync hp.driveguard.* actions with upstream settings * profiles: gnome settings, xfce backlight-helper actions: sanitize settings * profiles: cleanup dead and sync existing org.gnome actions * profiles: sync timedate1 actions in restrictive profile with standard profile * profiles: remove dead sytemd1.bus-access action * profiles: remove dead org.kde actions * profiles: make org.kde settings no weaker than upstream settings * profiles: remove leftover dead yast actions * profiles: remove dead yast.modules.yapi actions * profiles: remove dead yast.modules.ysr actions * profiles: remove dead yast.modules actions * profiles: remove dead yast.module-manager and yast.scr actions * profiles: remove dead upower actions * profiles: add missing udisks2 actions in restrictive profile * profiles: remove dead udisks (1) actions * profiles: remove dead policykit.lockdown action, harmonize .exec setting * profiles: adjust RealtimeKit actions to upstream settings * profiles: remove dead SuSEfirewall2 zone switcher action * profiles: remove dead backupmanager action * profiles: remove dead smpppd action * profiles: remove dead consolekit actions * profiles: polkit example action run-frobnicate: adjust to upstream settings * profiles: remove dead org.gnome.policykit.examples.* actions * profiles: remove unused pulseaudio realtime actions * profiles: cleanup PackageKit actions * profiles: cleanup gnome-settings-daemon actions * profiles: cleanup network manager actions * profiles: cleanup outdated PolicyKit actions ==== python-qt5 ==== - Fix boo#1178814: migration of old /usr/share/sip/PyQt5 to update-alternatives needs special treatment - add QtRemoteObjects bindings to nonring build ==== rubygem-rubocop-ast ==== Version update (1.1.0 -> 1.1.1) - New upstream release 1.1.1 [#]# 1.1.1 (2020-11-04) [#]## Bug fixes * [#146](https://github.com/rubocop-hq/rubocop-ast/pull/146): Fix `IfNode#branches` to return both branches when called on ternary conditional. ([@fatkodima][]) ==== samba ==== Version update (4.13.0+git.138.ff2d5480c67 -> 4.13.2+git.176.0a5e55b510c) Subpackages: libdcerpc-binding0 libdcerpc-binding0-32bit libdcerpc0 libdcerpc0-32bit libndr-krb5pac0 libndr-krb5pac0-32bit libndr-nbt0 libndr-nbt0-32bit libndr-standard0 libndr-standard0-32bit libndr1 libndr1-32bit libnetapi0 libnetapi0-32bit libsamba-credentials0 libsamba-credentials0-32bit libsamba-errors0 libsamba-errors0-32bit libsamba-hostconfig0 libsamba-hostconfig0-32bit libsamba-passdb0 libsamba-passdb0-32bit libsamba-policy0-python3 libsamba-util0 libsamba-util0-32bit libsamdb0 libsamdb0-32bit libsmbclient0 libsmbconf0 libsmbconf0-32bit libsmbldap2 libsmbldap2-32bit libtevent-util0 libtevent-util0-32bit libwbclient0 libwbclient0-32bit samba-client samba-client-32bit samba-doc samba-libs samba-libs-32bit samba-libs-python3 samba-python3 samba-winbind samba-winbind-32bit - Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); - Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469). - Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355); - Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245) - Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency ==== sudo ==== Version update (1.9.2 -> 1.9.3p1) Subpackages: sudo-plugin-python - Update to 1.9.3p1 * Fixed a regression introduced in sudo 1.9.3 where the configure script would not detect the crypt(3) function if it was present in the C library, not an additional library. * Fixed a regression introduced in sudo 1.8.23 with shadow passwd file authentication on OpenBSD. BSD authentication was not affected. * Sudo now logs when a user-specified command-line option is rejected by a sudoers rule. Previously, these conditions were written to the audit log, but the default sudo log file. Affected command line arguments include -C (--close-from), -D (--chdir), - R (--chroot), -g (--group) and -u (--user). - News in 1.9.3 * Fixed building the Python plugin on systems with a compiler that doesn't support symbol hiding. * Sudo now uses a linker script to hide symbols even when the compiler has native symbol hiding support. This should make it easier to detect omissions in the symbol exports file, regardless of the platform. * Fixed the libssl dependency in Debian packages for older releases that use libssl1.0.0. * Sudo and visudo now provide more detailed messages when a syntax error is detected in sudoers. The offending line and token are now displayed. If the parser was generated by GNU bison, additional information about what token was expected is also displayed. Bug #841. * Sudoers rules must now end in either a newline or the end-of-file. Previously, it was possible to have multiple rules on a single line, separated by white space. The use of an end-of-line terminator makes it possible to display accurate error messages. * Sudo no longer refuses to run if a syntax error in the sudoers file is encountered. The entry with the syntax error will be discarded and sudo will continue to parse the file. This makes recovery from a syntax error less painful on systems where sudo is the primary method of superuser access. The historic behavior can be restored by add "error_recovery=false" to the sudoers plugin's optional arguments in sudo.conf. Bug #618. * Fixed the sample_approval plugin's symbol exports file for systems where the compiler doesn't support symbol hiding. * Fixed a regression introduced in sudo 1.9.1 where arguments to the "sudoers_policy" plugin in sudo.conf were not being applied. The sudoers file is now parsed by the "sudoers_audit" plugin, which is loaded implicitly when "sudoers_policy" is listed in sudo.conf. Starting with sudo 1.9.3, if there are plugin arguments for "sudoers_policy" but "sudoers_audit" is not listed, those arguments will be applied to "sudoers_audit" instead. * The user's resource limits are now passed to sudo plugins in the user_info[] list. A plugin cannot determine the limits itself because sudo changes the limits while it runs to prevent resource starvation. * It is now possible to set the working directory or change the root directory on a per-command basis using the CWD and CHROOT options. There are also new Defaults settings, runchroot and runcwd, that can be used to set the working directory or root directory on a more global basis. * New -D (--chdir) and -R (--chroot) command line options can be used to set the working directory or root directory if the sudoers file allows it. This functionality is not enabled by default and must be explicitly enabled in the sudoers file. - add sudo-1.9.3p1-pam_xauth.patch to stay setuid until just before executing the command. Fixes a problem with pam_xauth which checks effective and real uids to get the real identity of the user [bsc#1174593] ==== systemd-presets-branding-openSUSE ==== - Fix package description mention of 'systemd-presets-common-SUSE' ==== tigervnc ==== Subpackages: libXvnc1 xorg-x11-Xvnc xorg-x11-Xvnc-module - xvnc@.service: fixed path for %libexecdir (boo#1178601) ==== ucode-intel ==== Version update (20201110 -> 20201118) - Updated Intel CPU Microcode to 20201118 official release. (bsc#1178971) - Removed TGL/06-8c-01/80 due to functional issues with some OEM platforms. ==== xlockmore ==== Version update (5.65 -> 5.66) - update to 5.66: GL mode atunnels, juggler3d, atlantis, lament, invert, solitaire, text3d, and text3d2 fixed up by EoflaOE ViceCity and myself to build in xscreensaver. bomb, helix, lightning, penrose, petal, scooter fixes for xscreensaver port (clear screen issue). Clock fixed to run by changing a spot from "Clock" to "CLOCK". A few updates from xscreensaver-5.44/hacks/xlockmore.c for xscreensaver port. Duplicate resources and unloadable resources for xscreensaver port fixed by EoflaOE. Double free removed for xscreensaver port fixed by EoflaOE and myself. Removed some warnings in xscreensaver port in fzort, rubik, skewb, and sproingies. Xpm textures added to xscreensaver ports that need them. image, puzzle, decay, bat now work but use xscreensaver bitmap/pixmap in xscreensaver port. Bug fix in qix and toneclock for xscreensaver port, xlock was not affected by negative NRAND input. euler2d synced up with xscreensaver version. Change to fzort to use __asm__ instead of asm as its probably more likely to work. Fixed solitaire so deckPile changes just a little bit as it doles out cards. Updated bomb to use size 18 font when USE_MB is not set as it seems 34 is not widely available anymore. pacman now has different colored ghosts (no green ghost) and also oscillating dress and eyes. See README for a notice for this mode. Fixed some bad drawings in solitaire and pacman noticed on Windows side. Warnings removed for -Wstrict-prototypes -Wmissing-prototypes - Wdeclaration-after-statement ==== xtables-addons ==== Version update (3.11_k5.9.8_2 -> 3.12_k5.9.8_2) - Update to release 3.12 * Support for Linux 5.10 and the API/ABI change in 5.9.9

1 0

[opensuse-factory] Ad-hoc openSUSE s390x meeting 06.11.2020
by Lubos Kocman 23 Nov '20

23 Nov '20

Original meeting minutes: https://etherpad.opensuse.org/p/ReleaseEngineering-20200611-s390x-openqa Discussion about openSUSE/s390x Attendees: Lubos, Oliver, Ihno Lubos: my understanding is that following is the issue https://progress.opensuse.org/issues/72880 Oliver: to summarize situation we don't have any commitment to get s390x maintaining Oliver this issue is currently specific for openSUSE: [o3][s390x] Early fail on s390x workers: connection refused https://progress.opensuse.org/issues/69328 Oliver: we need more commitment from QA department to maintain openQA/s390x or even SUSE as a whole. Ihno: number of s390x guests has no real limits. Oliver: when we talk about openSUSE, the very single instance was either not fully used or working. Ihno: I can work on the cases where guests are not working. Oliver: I'm Product Owner for maintaining openQA as a software as well as the infrastructure of openqa.opensuse.org. What is outside our scope is to fix tests, review the tests or getting the distribution published (not only for s390x). That is responsibility of "release managers". We are lucky to have Guillaume G. to keep ARM working. okurz was asked by Andrew Waafa at an openSUSE Conference what could be done and the advice was to simply ask every day or as often as possible about the state of the builds, why tests are not executed, report tickets, find the right people to delegate to, etc. . Agreement with Andrew Waffa in discussion to make openSUSE/ARM a thing Ihno: it will be our top priority to get s390x/openQA working. If you need HW resources, we can give it to you. Lubos: we need to revisit our current dedicated QA resources with introduction of s390x in Leap Oliver: I don't think that the current contract works, reality is more like a reactive support which is nice but either there is no one asking or tickets are not properly triaged and ignored. Ihno: externals can only do just a certain part of openQA work, many things have to be done by SUSE employees. Oliver: We have a dedicated s390x "QE core" product owner for openQA tests, that is Timo Jyrinki https://confluence.suse.com/display/qasle/QE+squads+-+new+structure. The scope is basic test suite (install login and so on). For installer the product owner of the corresponding QE team is Rodion Iafarov. Tasks: Lubos to talk to Marita or possibly Ralf regarding dedicated resources in Leap 15.3 interlock document. We have more arches to support, we'll need more people to maintain openqa as well. Note by okurz: The important point to reach is the common understanding that openSUSE is part of SUSE's business. IBM are interested and happy about any "good publicity" for IBM Mainframes, i.e. s390x. Lubos to see if we can find external IBM s390x/openSUSE contact. The problem is that the person would not have the possibility to fix all of the openqa issues due to the fact that some issues can be addressed only by SUSE Employees. openqa.opensuse.org is available for administration for non-SUSE employees as well. See https://progress.opensuse.org/projects/openqav3/wiki/#Accessing-o3-infrastr… for details Ihno: to reach out to Ralf U. regarding importance of s390x/openSUSE openqa and basic ticket triaging as a responsibility for the QE department. Current situation is bad no tests were finished in last 6 months or so and nothing was even communicated in tickets. Ihno: revisit current s390x resources for openQA. And make sure that they're online. Oliver: I will update ticket and link it accordingly, but I would be really happy if Release Manager can first get commitment from not-only QE management. Side note: we have only one power8 worker for openqa. Ihno: are build hosts and testing hosts in different network? Oliver: yes Success story from ARM: external machines not maintained by QE Tools team (within SUSE). openQA and openqa.opensuse.org can and is using any machine that is reachable over internet with sufficient bandwidth, e.g. cloud instances, physical machines at SUSE partners, etc. This is an opportunity for SUSE partners to have easier access with less effort to contribute to the testing of openSUSE and SUSE distributions. Lubos: I'll consinder the Power topic for Leap 15.3 interlock as well.

8 16