November 2020 - openSUSE Factory - openSUSE Mailing Lists

[opensuse-factory] openSUSE Release Engineering Meeting 04.11.2020
by Lubos Kocman 04 Nov '20

04 Nov '20

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting ## Participants dleuenberger,guillaumeg, lkocman, marina, maxlin, adrians, ddemaio, rbrown !!! Please be aware that this meeting will be already hosted on!!! https://meet.opensuse.org/ReleaseEngineeringMeeting ## Leap Small kickoff event on jitsi today/16:30 UTC (17:30 CET) to celebrate **today's start of openSUSE Leap 15.3 Development phase** https://news.opensuse.org/2020/10/28/opensuse-community-to-kickoff-session-… SLE 15 SP3 Binaries/sources will start to be synced after Beta1 (late November) because of partner NDA. We'll be initially using SLE 15 SP2:Update core (very same problem existed before). Tracker https://progress.opensuse.org/issues/76219 https://en.opensuse.org/openSUSE:Roadmap Leap 15.3 progress-o-o tickets were created https://progress.opensuse.org/projects/opensuse-leap-15-3/issues/gantt ## openSUSE Tumbleweed * Perl 5.32 in Factory, big rebuilds in the queue * LLVM 11 also caused some rebuilds of large packages * RPM 4.16 is back in the queue * GNOME 3.38.1 is ready in GNOME:Next; mozjs78 is in Factory by now and GNOME 3.38.1 is being pushed to GNOME:Factory -> openSUSE:Factory (malcontent sec review seems to be the main blocker for now) * Chromium found a new maintainer with Callum ## Richard (Kubic/TW MicroOS) Requested an selinux mailinglist to help coordinate selinux efforts. MicroOS is moving to selinux by default (but not Kubic, yet). Investigating removing MicroOS patterns from Tumbleweed media to stop people making horrific unsupportable unworking hybrid installations. Only use MicroOS media to install MicroOS please. ## Max * Already set up openSUSE:Leap:15.3 project on OBS * The tooling side for Leap 15.3 is done(pipeline) * openQA's settings is done * The next step is enabling Leap 15.3 in openqa-trigger-from-obs :ToTest publishing happens it was just triggered manually by Adrian. We do publish from :ToTest to staging. Publish ftp-prod is blocked on admin(a)opensuse.org request. Lubos and Max to check on this topic. There is a ticket Adrian re-published Jump manually due to work regarding release- compare/obsgendiff release-compare is on codestreams 12 and 15 but still build issues for codestream 11 ## Guillaume - Arm Tumbleweed: * kernel 5.9.x build fixed thanks to dwarves update: https://build.opensuse.org/request/show/844380 * PAC/BTI enablement blocked by: - performances issue on the main openQA worker (see below) - too old binutils - https://build.opensuse.org/request/show/834649 blocked by a bug in QT Leap 15.3 ARM: * AArch64 build enabled: https://build.opensuse.org/project/show/openSUSE:Leap:15.3 * armv7 support is still an open question Lubos to create survey at survey.opensuse.org for the armv7 usage and usecases openQA: - Since main openqa worker has been upgraded to Leap 15.2, we have performance problems -https://progress.opensuse.org/issues/72079 WSL: WIP to have WSL on aarch64 on https://build.opensuse.org/project/show/home:Guillaume_G:WSL The goal is to have WSL-DistroLauncher package built for aarch64. ## Michel No available until end of October. ppc64 (BE) TW publishing blocked by core dump at install https://bugzilla.opensuse.org/show_bug.cgi?id=1176793 Will be in vacation next week for all October. ## ddemaio * openSUSE + LibreOffice Conference * waiting on access to videos * Marketing material * Leap 15.3 Kickoff * Calendar syncing for developer events ## Dirk No update TODO: Finalize Tier1 Policy and start Tumbleweed Subsection Helping with various failures there and there. Meeting with SLE Product Management on ARMv7 topic this Friday. ## Gerald || Marina no relevant news from me (Marina) apart from the kick-off session from today ## Tom Not present ## Wolfgang (Package Hub and s390x) Not present ## Ludwig Not present Leap 15.2 MicroOS is temporarily paused. ## Adrian - Jump Working on Jump based Leap:15.3 setup, but being blocked atm due to missing SP3. No update on: Re-implemented the filtering mechanism for the Update. Were still missing patchinfo metadata. Working on the mirroring for SRs * Drop of openSUSE:Jump:15.2 setup to be removed after we have a first successful openSUSE 15.3 build based on SP3

1 0

[opensuse-factory] Lightweight imapproxy
by Togan Muftuoglu 04 Nov '20

04 Nov '20

Hi, As the subject mentions, I am looking for a lightweight imapproxy, to be used on the firewall/gateway server which should provide access to the inside (NO DMZ) located cyrus-imap server. Any suggestions that work (almost with no problems would be great) on TW. Thanks -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

3 4

[opensuse-factory] Update on weekly SLE/Leap feature reviews
by Lubos Kocman 04 Nov '20

04 Nov '20

Hello team, we're experiencing issues with meet.opensuse.org, specifically screensharing during feature review. We spent half of last two meetings on troubleshooting and that's just wrong. We're currently looking for an alternative solution. Current workaround is teams, but I'd prefer to use something OSS. Perhaps the big blue button. If you want to be part of these meetings, then please message me so I can add you to the invitation. Heads up on next events: 9th and 23rd November are cancelled as I have vacation. Same goes for X-mass break 21st, 28th December, so these meetings are cancelled as well. Thank you very much for your understanding -- Lubos Kocman, Release Manager openSUSE Leap SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nürnberg - Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Felix Imendörffer

3 3

[opensuse-factory] Different development models of Tumbleweed and Leap
by Hans-Peter Jansen 03 Nov '20

03 Nov '20

Hi, yesterday, I found myself digging in the guts of a kernel 5.9.3 build, that succeeded with TW and failed with 15.2. This is the second time, a build failed due to stale symlink checking with Leaps (at least). Given, that all kernel related development is done on TW, this is rather unfortunate. Therefore, I kindly ask to enable the symlink checks, that are enforced with Leaps, for TW as well. While such issues aren't a big deal, they're a PITA nevertheless. Examples: https://lkml.org/lkml/2020/9/8/303 https://lkml.org/lkml/2020/11/2/1185 Cheers, Pete -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

3 6

[opensuse-factory] Chromium - looking for maintainer
by Tomáš Chvátal 03 Nov '20

03 Nov '20

Heya all, with the growing demands of chromium and my diminishing free time I won't be really able to care for chromium in the future. Any interested volunteers to take over its maintenance? You need to be able to patch out gcc compilation issues and patch out support for Leap as we have too old libs in some cases there. In general most of the work can be cherry-picked from Fedora/Gentoo with only minor tweaks on our side. Most complex and breaking part is the vaapi hardware acceleration. Which is currently borked as I don't have time to debug it further :( If you are interested please request maintainership on the network:chromium project and feel free to drop me an email if you happen to have any questions. Cheers Tom -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

6 6

[opensuse-factory] Thunderbird 78 and encryption status
by Wolfgang Rosenauer 03 Nov '20

03 Nov '20

Hi, since there have been multiple threads on different lists about availability of Thunderbird 78 for openSUSE please let me share the latest news. Upstream released Thunderbird 78.2.2 last week. Upstream did not enable automatic updates to 78 from 68 and also recommended to distros to not upgrade until now. It's likely that this changes with 78.2.2 being released now. The main reason is that there was no finished PGP support in TB 78. Previously it was provided by enigmail but as TB 78 does only allow webextensions enigmail cannot work anymore to provide PGP support. Therefore upstream implemented their own OpenPGP support natively in Thunderbird 78 which has been finally enabled by default in recent versions. You can find the upstream FAQ here and if you are using Thunderbird with enigmal today you really should read it carefully: https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq So what about the current status for openSUSE: The "mozilla" OBS repository (which is for ages the official project you get current versions as backports to supported openSUSE distros) currently contains Thunderbird 78.2.2 enigmail 2.2.2 (which requires 78.2.2) (please find its purpose in the FAQ above) how those will soon be submitted to Tumbleweed. When this "soon" will be depends a bit on your feedback if there are still major issues found during the next days. So please feel free to provide feedback on the list, in bugzilla, or directly to me. After Tumbleweed I'm quite sure that the SUSE guys will also move along putting the version into supported Leap versions. Wolfgang -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

12 21

[opensuse-factory] X11 -> wayland
by Frans de Boer 03 Nov '20

03 Nov '20

LS, Development of X11 seems already a long time ago to be halted. Thus i am thinking of switching from X11 to wayland on my server running xCFE and TW. Of course, I do not like to reinstall all packages again - assuming it is anyhow possible under TW - and am wondering if there is a way to accomplish this without a reinstall. Maybe first starting with the X11 server under wayland is an option and later migrating packages to use native wayland? Has anybody already had some experience with this transition? --- Frans. -- A: Yes, just like that A: Ja, net zo Q: Oh, Just like reading a book backwards Q: Oh, net als een boek achterstevoren lezen A: Because it upsets the natural flow of a story A: Omdat het de natuurlijke gang uit het verhaal haalt Q: Why is top-posting annoying? Q: Waarom is Top-posting zo irritant? -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

14 16

[opensuse-factory] Heads-up: AppArmor 3.0
by Christian Boltz 02 Nov '20

02 Nov '20

Hello, I just submitted AppArmor 3.0 to Tumbleweed (SR 845533). Since this is a major release, there are also some changes worth mentioning ;-) First and most important: Existing profiles will continue to work - but might cause some warnings on load. However, you'll probably need to take action if you have a program that uses hats, and if you use php-fpm. So, what's new in AppArmor 3.0? * Support for new rule types dbus and unix rules are now enforced. The profiles now also support a xattr conditional. Note that this requires an abi declaration in the profile (next bulletpoint ;-) * abi declarations in the profiles Profiles can (and should) declare for which version of the feature abi they were developed. In most cases, you can simply add abi <abi/3.0>, as the first line of the profile preamble and you are done. This line will enable enforcement of dbus and unix rules - so if your application needs one of these, you'll need to add the needed rules to the profile. Note that enforcement of dbus rules is done in userspace, so AppArmor dbus events will end up in the syslog instead of audit.log. (Hint: use aa-logprof -f /var/log/messages to read from syslog.) If a profile does not have this abi declaration, it will behave as in the 2.x releases and not apply any dbus or unix restrictions. If you package profiles also for older AppArmor versions, the abi rule will cause a warning with 2.x apparmor_parser, but won't break anything. * path-based profile names are deprecated Instead of starting a profile with /bin/foo { it's now recommended to give it a more readable name: profile foo /bin/foo { The name "foo" will be used in the audit.log and also for peer= in some rules, for example signal rules. Named profiles are supported since years and will work on older AppArmor versions without problems. * support for new apparmor proc attr interface In addition to /proc/*/attr/current libapparmor now also supports and uses /proc/*/attr/apparmor/current If you have profiles that allow access to /proc/*/attr/current (for binaries that use hats), you should also allow the new path with the additional "apparmor/" in it. (Make sure you allow the new path in the main profile and all hats.) * new profile for php-fpm AppArmor now ships a profile for php-fpm which is enabled by default. While I hope that this doesn't cause too much trouble, you might need to extend it to match your php-fpm config. https://nordisch.org/posts/php-fpm-apparmor/ should give you some inspiration how you can configure php-fpm to use subprofiles for a pool, and aa-complain / aa-logprof / aa-enforce will make updating the profile easy. As usual - if you have a profile addition that you consider useful for more people, please submit it as a bugreport or patch. * new profile modes kill and unconfined - kill is a sledge hammer-variant of enforce and will kill a process if it violates its AppArmor policy - unconfined is similar to running a process without AppArmor restrictions, with the difference that you can later load a "real" profile to confine the process without restarting it. Note that these flags are still considered experimental. * "under the hood" changes There are also several changes "under the hood", which I'll simply copy from apparmor.changes: - rewritten aa-status (in C), including support for new profile modes - rewritten aa-notify (in python), finally dropping the perl requirement at runtime - new tool aa-features-abi for extracting feature abis from the kernel - update profiles to have profile names and to use 3.0 feature abi - introduce @{etc_ro} and @{etc_rw} profile variables - several updates to profiles and abstractions (including boo#1166007) - fully support 'include if exists' in the aa-* tools - rewrite handling of alias, include, link and variable rules in the aa-* tools - rewrite and simplify log handling in the aa-logprof and aa-genprof * ... and more See https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0 for the detailed upstream changelog - and be aware that I've also applied some post-release fixes to the package before submitting it to Tumbleweed ;-) Regards, Christian Boltz -- "sudo make me a secure IoT device" <world disintegrates with a DIV0 exception> [Stefan G. Lesser on https://plus.google.com/+KristianK%C3%B6hntopp/posts/H7iqYLmomXL] -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

1 0

[opensuse-factory] Weird installation of tumbleweed
by Togan Muftuoglu 02 Nov '20

02 Nov '20

I've installed TW from DVD with the option small server or whatever it's called /etc/os-release identifies as: ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20201030" PRETTY_NAME="openSUSE Tumbleweed" What is weird is some packages are creating /home/package directories. Is this the intended behaviour (which I doubt because my normal desktop doesn't do that). Any ideas where things are broken ? drwxr-xr-x 1 root root 202 Nov 2 20:43 ./ drwxr-xr-x 1 root root 132 Nov 2 16:49 ../ drwx------ 1 root root 30 Nov 2 16:56 bin/ drwx------ 1 root root 30 Nov 2 16:56 daemon/ drwx------ 1 root root 30 Nov 2 17:35 dnsmasq/ drwx------ 1 root root 30 Nov 2 16:56 lp/ drwx------ 1 root root 30 Nov 2 16:56 mail/ drwx------ 1 root root 30 Nov 2 16:56 man/ drwx------ 1 root root 30 Nov 2 16:56 messagebus/ drwx------ 1 root root 30 Nov 2 16:56 nobody/ drwx------ 1 root root 30 Nov 2 16:58 nscd/ drwx------ 1 root root 30 Nov 2 20:43 opendkim/ drwx------ 1 root root 30 Nov 2 16:56 postfix/ drwx------ 1 root root 30 Nov 2 16:56 rpc/ drwx------ 1 root root 30 Nov 2 16:56 sshd/ drwx------ 1 root root 30 Nov 2 16:57 statd/ drwx------ 1 root root 30 Nov 2 17:32 stunnel/ drwx------ 1 root root 30 Nov 2 17:35 tftp/ drwxr-xr-x 1 toganm users 136 Nov 2 17:21 toganm/ drwx------ 1 root root 30 Nov 2 20:43 unbound/ drwx------ 1 root root 30 Nov 2 17:28 vscan/ -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

4 4

[opensuse-factory] Heads-up: Kernel 5.9.1 in Snapshot 20201026+
by Dominique Leuenberger / DimStar 02 Nov '20

02 Nov '20

Dear Tumbleweed users, I would like to inform you that Snapshot 20201025 will be the last one to be released with a kernel from the 5.8 family (in fact, 5.8.15, which was there since 1020 - no later updates) Starting with Snapshto 20201026, the kernel will be bumped to Version 5.9.1 (and newer in the future). Cheers, Dominique

9 10