openSUSE Factory January 2023

factory@lists.opensuse.org

72 participants
75 discussions

Start a nNew thread

New Tumbleweed snapshot 20230125 released!
by Dominique Leuenberger 26 Jan '23

26 Jan '23

1 0

openSUSE Release Engineering meeting 25.01.2023
by Lubos Kocman 26 Jan '23

26 Jan '23

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting Meeting is hosted here https://meet.opensuse.org/ReleaseEngineeringMeeting ## Attendees rbrown, DimStar, lkocman, dirk, wengel, DocB, ddemaio **THE MEETING ON 1ST of FEBRUARY WILL BE SKIPPED DUE TO HACKWEEK** https://hackweek.opensuse.org/ ## Leap Code submission deadline for SLES 15 SP5 Beta4 is today (Jan 25th) at 15:00. Leap Builds were stuck on https://bugzilla.opensuse.org/show_bug.cgi?id=1207395 and previously https://bugzilla.suse.com/show_bug.cgi?id=1206718 Due to this we were not able to produce a decent build that would give us good idea about quality. I'm bit worried that the actual beta release might be delayed. Cisco openh264 setup is finialized on our side https://news.opensuse.org/2023/01/24/opensuse-simplifies-codec-install/ ## openSUSE Tumbleweed openSUSE:Factory build fail stats: 217 failed 16 unresolvable (last week: 21 / 24) https://tinyurl.com/ysy4nnnz * Staging:H Ruby 3.2 made some progress, only 3 more yast build fails (y2-config-management, y2-packager, y2-storage-ng) * Staging:L has a few failures collected: * boost: breaks libreoffice (incl. libetonyek) * gpg2: breaks gpgme * ant and xmlgraphics-common: breaking ant-antlr and xmlgraphics- fop * Staging:M test to also build python311 modules * Staging:N openssl-3-as-default testing: almost ready! All build fails have been fixed (or are in the queue) * Staging:O: preparation work to identify the minimal list of 'i586' builds to enable in openSUSE:Factory to allow wine/steam to build/install (currently 992 packages, and counting; big part of it is for rpmlint and such things) * Staging:Gcc7: early experiments to set GCC 13 as distro compiler * openSUSE:Factory has switched to a 4k RSA key * https://news.opensuse.org/2023/01/23/new-4096-bit-signing-key/ * osc build (with chroot) complains about missing keys (we did not do a full rebuild, osc gets the 4k project key, RPMs are signed with the 2k key. workaround: use osc build --vm-type=kvm (setup oscrc to have sufficient ram and disk size; I use 2GB of RAM and 10GB disk for most cases) i586 carve-out from Factory => Migration (manual so far) is possible for users. The first 'zypper dup' after changing the repo could include a bunch of 'package downgrades' as the rebuild counters are not synced across projects. Automatic migration of users (by means of openSUSE-release) will happen by end of January (giving the braves ones time to test and report issues before we mass-switch) ## Richard (MicroOS) Desktop-GNOME: The Road to Release: transactional-update-notifier is in Factory! WIP making it configured by default Working on a "mod-check" tool to report the following to users List of installed (1st party) packages, with comparisions to both an upstream pristine list and previous snapshots Automatically reset official packages to that upstream pristine list, or previous snapshots Any 3rd party packages and their origin Any known unsupported configurations/alterations and offer remedies if possible mod-check doesn't really 'check' as much as planned at the moment, instead going way further and effectively reinstalling MicroOS Desktop (GNOME) in place, making that new snapshot the new boot target. This will be awesome for any user who wants to 'freshen' up an otherwise heavily altered MicroOS Desktop, or when major Tumbleweed/MicroOS changes occur that otherwise cant be easily modeled in patterns. It also potentially could be a method of migrating non-transactional systems to a transactional one. Heavy testing/development underway..and possibly a rename if mod-check doesn't start actually -checking stuff soon. Bugs still WIP osinfo-db still doesn't recognise MicroOS as a seperate distribution - debates with upstream ongoing Working on YaST-less installation media with FDE by default ## Max Leap Micro 5.4 * The project has been bootstrapped * The missing bits ** Tweak Leap specific patches ** Enable pkglistgen lkocman: is on it Leap 15.5 * The fixed kernel for bsc#1206718 has got merged to SLE15-SP5(just yesterday) * Build stats in Backports(x86_64): 8 unresolvables, 59 fails(last week: 8 unresolvables, 54 fails) ## Guillaume - Arm Tumbleweed: * Blocked due to a broken binutils patch for armv7. Will be unblocked by https://build.opensuse.org/request/show/1060656 * WiFi works again on RPi3/4 (and other systems): https://bugzilla.suse.com/show_bug.cgi?id=1206697 * Pointer Authentication issue, seen in zypper has been fixed: https://bugzilla.suse.com/show_bug.cgi?id=1206684 * NVIDIA: tester with aarch64 server and NVIDIA card wanted - Proprietary drivers are now available for aarch64 (only G06): https://download.nvidia.com/opensuse/tumbleweed/ - New opengpu driver also available in OBS: https://build.opensuse.org/project/monitor/X11:Drivers:Video lkocman to check on who is the aarch64 + nvidia effort blocked on. I recall that there was a chosen point of contact. Leap: * 15.5 aarch64: covered by Leap section above * 15.5 armv7: no blocker ALP: * No aarch64 specific issues WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server ## Sarah - s390x Tumbleweed * kdump is fixed (with calibrate.conf by SLE because of blocked builds for s390x) -> Tumbleweed is rolling again Leap: * tests are failing because of timeout (my next ToDo) * qore updated Question: What should we do with packages buildable only on s390x and not on x86? Example: https://build.opensuse.org/package/show/home:AdaLovelace:branches:server:da… lkocman: I'd start with a bug against the package, then let's agree on next steps with maintainer. Please use bug against openSUSE.org choose 3rd party package. Can be used for anything that is from OBS. ## Doug * articles * 4096 bit RSA signing key published (thx to mmeissner) * openh264 article published * openSUSE Community booth at CLT2023 lkocman: Do we have some sort of list/calendar with events where openSUSE is usually present? * GSoC * Updating GSoC wiki pages * New projects being added * Additional admins added * Application nearly complete. * Need to complete "How many potential mentors have agreed to mentor this year?" * Workshop to finalize projects & application scheduled for on Feb. 7 (deadline at 18:00 UTC) * oSC23 * Waiting on contract signature (in legal review) * 13 registered, 9 submissions * FOSDEM * Booth in Building/Hall H (we have traditionally be in Building/Hall K) * Bus has 29 sign ups * Passangers to be briefed on bus departure location * Contact ddemaio if you're in Nuremberg and want to take the bus to FOSDEM. Space may be limited. * FLOSS Weekly * Test call on 26.01 * Podcast scheduled for Feb. 8 ## Dirk * Initial x86_64-v3 glibc hwcaps package has landed in Factory (libxmlb - visible in GNOME repositories openqa runs) * Determine list of extra shared libraries to enable (likely all compression and media decoding libraries (libpng, jpeg and so on) * Helped with OpenSSL 3.x switch and Python 3.11 modules enablement * Starting to draft https://en.opensuse.org/openSUSE:OpenSUSE_Tumbleweed_Maintainer_Policy (draft, will be announced on the mailing list when ~ ready) DimStar: ~150 python modules are currently failing with 3.11, a lot of fallout is expected. (enabling 3.11 will roughly double those numbers judging from the current devel project state) * Continued work on SUSE:ALP:RISCV * force published 15.4 and 15.5 for armv7 builds, openqa builds have been triggered it appears it is set to do post-release testing? * qemu/libseccomp 15.5 failure still in investigation Biggest speedup can be observed by switching zlib to zlib-ng, so looked into fixing the build failures caused by switching to zlibo-ng- compat ## Wolfgang (Package Hub), Scott Bahling Discussion about moving ipxe package to SLE and release ipxe-bootimgs for x86_64 and aarch64 to HPC-Module (SLE-15-SP5). Needs to be accepted by Michal Svec. If that is the case ipxe will be removed from openSUSE:Backports:SLE-15-SP5 and subpackage ipxe-bootimgs for ppc64le and s390x will be released via subpackages repository. Need to sync with Max regarding the package list for subpackages repository for SLE-15-SP5 when he is back from vacation. 15 SP5 Package HUB channel is set up. Stefan did initial testing and looks good. Some packages are still missing, this is on agenda for today and next week. The workshop regarding Package HUB equivalent for ALP Lubos will schedule a call with wolfgang and Scott to ensure that they're in loop for the High Level requirements document. https://en.opensuse.org/openSUSE:ALP/Workgroups/Community/Workshops/Consumi… Package Hub for SLE-15-SP5 product definition added and SCC is currently picking it up so it will be ready for testing with the beta of SLE-15-SP5 ## Maintenance team (Marcus or Maurizio (m4u)) Fixed a long standing issue with gnome-music that was blocking openqa for a long time. 15.4 is working 5.3 is working 15.5 setup TBD (Mid-to-End February would be preferred). Nothing worrysome, preannoucement for 15.3 EOL was sent to mainling list End of December 2022. There were three chromium updates in single week. lkocman: 15.3 EOL could lead to stopping our physical Source DVD effort, as it seems we will not produce. As this was the last release which you could still get on a physical media. Configuration setup problem for Maintenance of Leap 15.4 maintenance updates / openQA Marcus regarding Leap 15.4 Image respin - package set will change, we do need to refresh the packagelist * Lubos to talk to Jan Stehlik, we can't put all on Marcuses shoulder. https://etherpad.opensuse.org/p/ReleaseEngineering-20221110-maintenance-dis… Confirmation that QA/QA-maint team will oversee the setup (issues) Lubos: I was asked to provide requirements for the QA team. Mostly for the GA/current release but also for the update. Lubos will make wiki with requirements (something like maintenance plan perhaps). Marcus will review it. * Leap Micro 5.3 maint setup done ffmpeg - (still unsolved) possible file conflict on the next update, no idea how to avoid vendor switching at the moment. Removing the patch on the openSUSE side (that might contain security fixes) or releasing update on the packman side could fix the issue. Lubos to give Marcus some working contact for the team. ## Adrian - OBS After changing the signing key of Factory without rebuilding the distribution "osc build" using chroot builds run into the problem that gpg verification of the rpm's failed. To tell osc to use also the old gpg key we introduced a temporary openSUSE:Tumbleweed:OldKey project. We will remove this project again after full rebuild of Factory. This should work for all arches. Users get additional question if they want to trust the additional project once. This solves the issue for people who build against openSUSE:Tumbleweed/standard or openSUSE:Factory/snapshot. It does not solve it when building against openSUSE:Factory/standard directly (not the default in OBS). Dirk: Recommended solution is to use the kvm build (add `build-type = kvm` to your ~/.oscrc) Adrian: Agreed that we should aim for switching the osc default here (also wanted by security team). Still some issues to solve to make it more convinient. ## Project maintainer work flow Status * Base policy to be developed Background on topic found at https://etherpad.opensuse.org/p/ReleaseEngineering-20221221 For me it comes down to a matter of communication. A note like 'thx for your SR, I think we should adapt the following ' or ' we are reviewing your SR, and quite stuck with work...' could already change a lot. Silence for more then 4 week is clearly a perfect way to annoy contributors. And the question should be asked if those unresponsive maintainers are still willing to maintain their projects. Or they may even not be active anymore, another discussion we are having

1 0

New Tumbleweed snapshot 20230124 released!
by Dominique Leuenberger 25 Jan '23

25 Jan '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apache2 (2.4.54 -> 2.4.55) apache2-manual (2.4.54 -> 2.4.55) apache2-prefork (2.4.54 -> 2.4.55) apache2-utils (2.4.54 -> 2.4.55) dracut (057+suse.353.g6dab83eb -> 059+suse.358.g8ecd6e83) ffmpeg-4 ffmpeg-5 gdm gdm-branding-openSUSE gedit (44.1 -> 44.2) glib2 (2.74.4 -> 2.74.5) gnome-desktop (43 -> 43.1) gpgme gpgmeqt kpipewire libraw (0.21.0 -> 0.21.1) live555 (2022.12.01 -> 2023.01.19) microos-tools (2.17 -> 2.18) nautilus (43.1 -> 43.2) python-numpy soundtouch (2.3.1 -> 2.3.2) sudo (1.9.12p1 -> 1.9.12p2) transactional-update (4.1.0 -> 4.1.2) urlview vim (9.0.1188 -> 9.0.1234) vte yast2-network (4.5.12 -> 4.5.14) yast2-trans (84.87.20230116.80083546af -> 84.87.20230123.08c503a922) === Details === ==== apache2 ==== Version update (2.4.54 -> 2.4.55) - Update to 2.4.55: * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (cve.mitre.org) Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer) * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling (cve.mitre.org) Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group * ) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write of zero byte (cve.mitre.org) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. * ) mod_dav: Open the lock database read-only when possible. PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu] * ) mod_proxy_http2: apply the standard httpd content type handling to responses from the backend, as other proxy modules do. Fixes PR 66391. Thanks to JÃ©rÃ´me Billiras for providing the patch. [Stefan Eissing] * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981 [Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez <alejandro.alvarez.ayllon cern.ch>] * ) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic] * ) mod_http2: version 2.0.10 of the module, synchronizing changes with the gitgub version. This is a partial rewrite of how connections and streams are handled. - an APR pollset and pipes (where supported) are used to monitor the main connection and react to IO for request/response handling. This replaces the stuttered timed waits of earlier versions. - H2SerializeHeaders directive still exists, but has no longer an effect. - Clients that seemingly misbehave still get less resources allocated, but ongoing requests are no longer disrupted. - Fixed an issue since 1.15.24 that "Server" headers in proxied requests were overwritten instead of preserved. [PR by @daum3ns] - A regression in v1.15.24 was fixed that could lead to httpd child processes not being terminated on a graceful reload or when reaching MaxConnectionsPerChild. When unprocessed h2 requests were queued at the time, these could stall. See #212. - Improved information displayed in 'server-status' for H2 connections when Extended Status is enabled. Now one can see the last request that IO operations happened on and transferred IO stats are updated as well. - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection send a GOAWAY frame much too early on new connections, leading to invalid protocol state and a client failing the request. See PR65731 at <https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>. The module now initializes the HTTP/2 protocol correctly and allows the client to submit one request before the shutdown via a GOAWAY frame is being announced. - :scheme pseudo-header values, not matching the connection scheme, are forwarded via absolute uris to the http protocol processing to preserve semantics of the request. Checks on combinations of pseudo-headers values/absence have been added as described in RFC 7540. Fixes #230. - A bug that prevented trailers (e.g. HEADER frame at the end) to be generated in certain cases was fixed. See #233 where it prevented gRPC responses to be properly generated. - Request and response header values are automatically stripped of leading and trialing space/tab characters. This is equivalent behaviour to what Apache httpd's http/1.1 parser does. The checks for this in nghttp2 v1.50.0+ are disabled. - Extensive testing in production done by Alessandro Bianchi (@alexskynet) on the v2.0.x versions for stability. Many thanks! * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when request ':authority' is known. Improved test case that did not catch that the previous 'fix' was incorrect. * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski] * ) mod_proxy: The AH03408 warning for a forcibly closed backend connection is now logged at INFO level. [Yann Ylavic] * ) mod_ssl: When dumping the configuration, the existence of certificate/key files is no longer tested. [Joe Orton] * ) mod_authn_core: Add expression support to AuthName and AuthType. [Graham Leggett] * ) mod_ssl: when a proxy connection had handled a request using SSL, an error was logged when "SSLProxyEngine" was only configured in the location/proxy section and not the overall server. The connection continued to work, the error log was in error. Fixed PR66190. [Stefan Eissing] * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing] * ) mod_md: a new directive `MDStoreLocks` can be used on cluster setups with a shared file system for `MDStoreDir` to order activation of renewed certificates when several cluster nodes are ... changelog too long, skipping 12 lines ... PR 66313. [Emmanuel Dreyfus] ==== apache2-manual ==== Version update (2.4.54 -> 2.4.55) - Update to 2.4.55: * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (cve.mitre.org) Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer) * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling (cve.mitre.org) Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group * ) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write of zero byte (cve.mitre.org) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. * ) mod_dav: Open the lock database read-only when possible. PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu] * ) mod_proxy_http2: apply the standard httpd content type handling to responses from the backend, as other proxy modules do. Fixes PR 66391. Thanks to JÃ©rÃ´me Billiras for providing the patch. [Stefan Eissing] * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981 [Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez <alejandro.alvarez.ayllon cern.ch>] * ) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic] * ) mod_http2: version 2.0.10 of the module, synchronizing changes with the gitgub version. This is a partial rewrite of how connections and streams are handled. - an APR pollset and pipes (where supported) are used to monitor the main connection and react to IO for request/response handling. This replaces the stuttered timed waits of earlier versions. - H2SerializeHeaders directive still exists, but has no longer an effect. - Clients that seemingly misbehave still get less resources allocated, but ongoing requests are no longer disrupted. - Fixed an issue since 1.15.24 that "Server" headers in proxied requests were overwritten instead of preserved. [PR by @daum3ns] - A regression in v1.15.24 was fixed that could lead to httpd child processes not being terminated on a graceful reload or when reaching MaxConnectionsPerChild. When unprocessed h2 requests were queued at the time, these could stall. See #212. - Improved information displayed in 'server-status' for H2 connections when Extended Status is enabled. Now one can see the last request that IO operations happened on and transferred IO stats are updated as well. - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection send a GOAWAY frame much too early on new connections, leading to invalid protocol state and a client failing the request. See PR65731 at <https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>. The module now initializes the HTTP/2 protocol correctly and allows the client to submit one request before the shutdown via a GOAWAY frame is being announced. - :scheme pseudo-header values, not matching the connection scheme, are forwarded via absolute uris to the http protocol processing to preserve semantics of the request. Checks on combinations of pseudo-headers values/absence have been added as described in RFC 7540. Fixes #230. - A bug that prevented trailers (e.g. HEADER frame at the end) to be generated in certain cases was fixed. See #233 where it prevented gRPC responses to be properly generated. - Request and response header values are automatically stripped of leading and trialing space/tab characters. This is equivalent behaviour to what Apache httpd's http/1.1 parser does. The checks for this in nghttp2 v1.50.0+ are disabled. - Extensive testing in production done by Alessandro Bianchi (@alexskynet) on the v2.0.x versions for stability. Many thanks! * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when request ':authority' is known. Improved test case that did not catch that the previous 'fix' was incorrect. * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski] * ) mod_proxy: The AH03408 warning for a forcibly closed backend connection is now logged at INFO level. [Yann Ylavic] * ) mod_ssl: When dumping the configuration, the existence of certificate/key files is no longer tested. [Joe Orton] * ) mod_authn_core: Add expression support to AuthName and AuthType. [Graham Leggett] * ) mod_ssl: when a proxy connection had handled a request using SSL, an error was logged when "SSLProxyEngine" was only configured in the location/proxy section and not the overall server. The connection continued to work, the error log was in error. Fixed PR66190. [Stefan Eissing] * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing] * ) mod_md: a new directive `MDStoreLocks` can be used on cluster setups with a shared file system for `MDStoreDir` to order activation of renewed certificates when several cluster nodes are ... changelog too long, skipping 12 lines ... PR 66313. [Emmanuel Dreyfus] ==== apache2-prefork ==== Version update (2.4.54 -> 2.4.55) - Update to 2.4.55: * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (cve.mitre.org) Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer) * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling (cve.mitre.org) Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group * ) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write of zero byte (cve.mitre.org) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. * ) mod_dav: Open the lock database read-only when possible. PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu] * ) mod_proxy_http2: apply the standard httpd content type handling to responses from the backend, as other proxy modules do. Fixes PR 66391. Thanks to JÃ©rÃ´me Billiras for providing the patch. [Stefan Eissing] * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981 [Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez <alejandro.alvarez.ayllon cern.ch>] * ) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic] * ) mod_http2: version 2.0.10 of the module, synchronizing changes with the gitgub version. This is a partial rewrite of how connections and streams are handled. - an APR pollset and pipes (where supported) are used to monitor the main connection and react to IO for request/response handling. This replaces the stuttered timed waits of earlier versions. - H2SerializeHeaders directive still exists, but has no longer an effect. - Clients that seemingly misbehave still get less resources allocated, but ongoing requests are no longer disrupted. - Fixed an issue since 1.15.24 that "Server" headers in proxied requests were overwritten instead of preserved. [PR by @daum3ns] - A regression in v1.15.24 was fixed that could lead to httpd child processes not being terminated on a graceful reload or when reaching MaxConnectionsPerChild. When unprocessed h2 requests were queued at the time, these could stall. See #212. - Improved information displayed in 'server-status' for H2 connections when Extended Status is enabled. Now one can see the last request that IO operations happened on and transferred IO stats are updated as well. - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection send a GOAWAY frame much too early on new connections, leading to invalid protocol state and a client failing the request. See PR65731 at <https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>. The module now initializes the HTTP/2 protocol correctly and allows the client to submit one request before the shutdown via a GOAWAY frame is being announced. - :scheme pseudo-header values, not matching the connection scheme, are forwarded via absolute uris to the http protocol processing to preserve semantics of the request. Checks on combinations of pseudo-headers values/absence have been added as described in RFC 7540. Fixes #230. - A bug that prevented trailers (e.g. HEADER frame at the end) to be generated in certain cases was fixed. See #233 where it prevented gRPC responses to be properly generated. - Request and response header values are automatically stripped of leading and trialing space/tab characters. This is equivalent behaviour to what Apache httpd's http/1.1 parser does. The checks for this in nghttp2 v1.50.0+ are disabled. - Extensive testing in production done by Alessandro Bianchi (@alexskynet) on the v2.0.x versions for stability. Many thanks! * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when request ':authority' is known. Improved test case that did not catch that the previous 'fix' was incorrect. * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski] * ) mod_proxy: The AH03408 warning for a forcibly closed backend connection is now logged at INFO level. [Yann Ylavic] * ) mod_ssl: When dumping the configuration, the existence of certificate/key files is no longer tested. [Joe Orton] * ) mod_authn_core: Add expression support to AuthName and AuthType. [Graham Leggett] * ) mod_ssl: when a proxy connection had handled a request using SSL, an error was logged when "SSLProxyEngine" was only configured in the location/proxy section and not the overall server. The connection continued to work, the error log was in error. Fixed PR66190. [Stefan Eissing] * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing] * ) mod_md: a new directive `MDStoreLocks` can be used on cluster setups with a shared file system for `MDStoreDir` to order activation of renewed certificates when several cluster nodes are ... changelog too long, skipping 12 lines ... PR 66313. [Emmanuel Dreyfus] ==== apache2-utils ==== Version update (2.4.54 -> 2.4.55) - Update to 2.4.55: * ) SECURITY: CVE-2022-37436: Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (cve.mitre.org) Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client. Credits: Dimas Fariski Setyawan Putra (@nyxsorcerer) * ) SECURITY: CVE-2022-36760: Apache HTTP Server: mod_proxy_ajp Possible request smuggling (cve.mitre.org) Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions. Credits: ZeddYu_Lu from Qi'anxin Research Institute of Legendsec at Qi'anxin Group * ) SECURITY: CVE-2006-20001: mod_dav out of bounds read, or write of zero byte (cve.mitre.org) A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier. * ) mod_dav: Open the lock database read-only when possible. PR 36636 [Wilson Felipe <wfelipe gmail.com>, manu] * ) mod_proxy_http2: apply the standard httpd content type handling to responses from the backend, as other proxy modules do. Fixes PR 66391. Thanks to JÃ©rÃ´me Billiras for providing the patch. [Stefan Eissing] * ) mod_dav: mod_dav overrides dav_fs response on PUT failure. PR 35981 [Basant Kumar Kukreja <basant.kukreja sun.com>, Alejandro Alvarez <alejandro.alvarez.ayllon cern.ch>] * ) mod_proxy_hcheck: Honor worker timeout settings. [Yann Ylavic] * ) mod_http2: version 2.0.10 of the module, synchronizing changes with the gitgub version. This is a partial rewrite of how connections and streams are handled. - an APR pollset and pipes (where supported) are used to monitor the main connection and react to IO for request/response handling. This replaces the stuttered timed waits of earlier versions. - H2SerializeHeaders directive still exists, but has no longer an effect. - Clients that seemingly misbehave still get less resources allocated, but ongoing requests are no longer disrupted. - Fixed an issue since 1.15.24 that "Server" headers in proxied requests were overwritten instead of preserved. [PR by @daum3ns] - A regression in v1.15.24 was fixed that could lead to httpd child processes not being terminated on a graceful reload or when reaching MaxConnectionsPerChild. When unprocessed h2 requests were queued at the time, these could stall. See #212. - Improved information displayed in 'server-status' for H2 connections when Extended Status is enabled. Now one can see the last request that IO operations happened on and transferred IO stats are updated as well. - When reaching server limits, such as MaxRequestsPerChild, the HTTP/2 connection send a GOAWAY frame much too early on new connections, leading to invalid protocol state and a client failing the request. See PR65731 at <https://bz.apache.org/bugzilla/show_bug.cgi?id=65731>. The module now initializes the HTTP/2 protocol correctly and allows the client to submit one request before the shutdown via a GOAWAY frame is being announced. - :scheme pseudo-header values, not matching the connection scheme, are forwarded via absolute uris to the http protocol processing to preserve semantics of the request. Checks on combinations of pseudo-headers values/absence have been added as described in RFC 7540. Fixes #230. - A bug that prevented trailers (e.g. HEADER frame at the end) to be generated in certain cases was fixed. See #233 where it prevented gRPC responses to be properly generated. - Request and response header values are automatically stripped of leading and trialing space/tab characters. This is equivalent behaviour to what Apache httpd's http/1.1 parser does. The checks for this in nghttp2 v1.50.0+ are disabled. - Extensive testing in production done by Alessandro Bianchi (@alexskynet) on the v2.0.x versions for stability. Many thanks! * ) mod_proxy_http2: fixed #235 by no longer forwarding 'Host:' header when request ':authority' is known. Improved test case that did not catch that the previous 'fix' was incorrect. * ) mod_proxy_hcheck: hcmethod now allows for HTTP/1.1 requests using GET11, HEAD11 and/or OPTIONS11. [Jim Jagielski] * ) mod_proxy: The AH03408 warning for a forcibly closed backend connection is now logged at INFO level. [Yann Ylavic] * ) mod_ssl: When dumping the configuration, the existence of certificate/key files is no longer tested. [Joe Orton] * ) mod_authn_core: Add expression support to AuthName and AuthType. [Graham Leggett] * ) mod_ssl: when a proxy connection had handled a request using SSL, an error was logged when "SSLProxyEngine" was only configured in the location/proxy section and not the overall server. The connection continued to work, the error log was in error. Fixed PR66190. [Stefan Eissing] * ) mod_proxy_hcheck: Re-enable workers in standard ERROR state. PR 66302. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_proxy_hcheck: Detect AJP/CPING support correctly. PR 66300. [Alessandro Cavaliere <alessandro.cavalier7 unibo.it>] * ) mod_http2: Export mod_http2.h as public header. [Stefan Eissing] * ) mod_md: a new directive `MDStoreLocks` can be used on cluster setups with a shared file system for `MDStoreDir` to order activation of renewed certificates when several cluster nodes are ... changelog too long, skipping 12 lines ... PR 66313. [Emmanuel Dreyfus] ==== dracut ==== Version update (057+suse.353.g6dab83eb -> 059+suse.358.g8ecd6e83) Subpackages: dracut-mkinitrd-deprecated - Update to version 059+suse.358.g8ecd6e83: See https://github.com/dracutdevs/dracut/releases/tag/058 for details (059 just adds missing entries in NEWS.md). Additional changes: * chore(suse): add execute permission to all scripts * chore(suse): update spec - Update to version 057+suse.355.g1b722fda: * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439) ==== ffmpeg-4 ==== Subpackages: libavcodec58_134 libavformat58_76 libavutil56_70 libpostproc55_9 libswresample3_9 libswscale5_9 - Add ffmpeg-CVE-2022-3341.patch: Backport from upstream to fix null pointer dereference in decode_main_header() in libavformat/nutdec.c (bsc#1206778). ==== ffmpeg-5 ==== Subpackages: libavcodec59 libavdevice59 libavfilter8 libavformat59 libavutil57 libpostproc56 libswresample4 libswscale6 - Provide a ffmpeg-5-mini-devel build recipe to help split anticipated build cycles. - Reenable SDL2 for ffmpeg-5.spec. ffplay and -vf sdl should be back. [boo#1206505] ==== gdm ==== Subpackages: gdm-lang gdm-schema gdmflexiserver libgdm1 typelib-1_0-Gdm-1_0 - Update gdm-disable-gnome-initial-setup.patch: Refactoring to disable it on SLE runtime, so with the same executable it is still possible to run on Leap (jsc#PED-1719). ==== gdm-branding-openSUSE ==== - Bring back gnome-initial-setup for Leap 15.5 while keep it disabled on SLE 15 SP5 (jsc#PED-1719). ==== gedit ==== Version update (44.1 -> 44.2) Subpackages: gedit-lang python3-gedit - Update to version 44.2: + File Browser plugin: bug fix. + Updated translations. ==== glib2 ==== Version update (2.74.4 -> 2.74.5) Subpackages: glib2-lang glib2-tools libgio-2_0-0 libgio-2_0-0-32bit libglib-2_0-0 libglib-2_0-0-32bit libgmodule-2_0-0 libgmodule-2_0-0-32bit libgobject-2_0-0 libgobject-2_0-0-32bit libgthread-2_0-0 libgthread-2_0-0-32bit - Update to version 2.74.5: + Bugs fixed: glgo#GNOME/GLib#2843, glgo#GNOME/GLib#2881, glgo#GNOME/GLib#2883, glgo#GNOME/GLib!3165, glgo#GNOME/GLib!3166, glgo#GNOME/GLib!3182, glgo#GNOME/GLib!3197, glgo#GNOME/GLib!3204, glgo#GNOME/GLib!3214. + Updated translations. - Drop 1539540.patch: Fixed upstream. ==== gnome-desktop ==== Version update (43 -> 43.1) Subpackages: gnome-desktop-lang libgnome-desktop-3-20 libgnome-desktop-3_0-common libgnome-desktop-4-2 typelib-1_0-GnomeDesktop-3_0 typelib-1_0-GnomeDesktop-4_0 - Update to version 43.1: + Fix gnome_parse_locale returning NULL for the C locale + Use more sensible default keyboard for es_US + Delete failed thumbnail if successfully savings thumbnail + Skip territory if no translation available + Updated translations. ==== gpgme ==== Subpackages: libgpgme11 libgpgmepp6 - Update upstream keyring: https://gnupg.org/signature_key.asc - add python311.patch to build language bindings for python 3.11 ==== gpgmeqt ==== - Update upstream keyring: https://gnupg.org/signature_key.asc - add python311.patch to build language bindings for python 3.11 ==== kpipewire ==== Subpackages: kpipewire-imports libKPipeWire5 libKPipeWire5-lang libKPipeWireRecord5 - Require pipewire-devel for the -devel package ==== libraw ==== Version update (0.21.0 -> 0.21.1) - update to 0.21.1: * fixed typo in panasonic metadata parser * Multiple fixes inspired by oss-fuzz project * Phase One/Leaf IIQ-S v2 support * Canon CR3 filmrolls * Canon CRM (movie) files * Tiled bit-packed (and 16-bit unpacked) DNGs * (non-standard) Deflate-compressed integer DNG files are allowed * Canon EOS R3, R7 and R10 * Fujifilm X-H2S, X-T30 II * OM System OM-1 * Leica M11 * Sony A7-IV (ILCE-7M4) * DJI Mavic 3 * Nikon Z9: standard compression formats only ==== live555 ==== Version update (2022.12.01 -> 2023.01.19) Subpackages: libUsageEnvironment3 libgroupsock30 libliveMedia107 - update to 2023.01.19: - By default, we no longer compile "groupsock/NetAddress.cpp" for Windows to use "gethostbyname()", because of a report that this breaks IPv6 name resolution. - update to 2023.01.11: * Updated the "BasicTaskScheduler"/"DelayQueue" implementation to make the 'token counter' a field of the task scheduler object, rather than having it be a static variable. This avoids potential problems if an application uses more than one thread (with each thread having its own task scheduler). ==== microos-tools ==== Version update (2.17 -> 2.18) - Update to version 2.18: - Add TMPDIR to tukit binddirs for Salt - 98selinux-microos: Add chroot as dependency - Fix spelling error in warning ==== nautilus ==== Version update (43.1 -> 43.2) Subpackages: gnome-shell-search-provider-nautilus libnautilus-extension4 nautilus-lang - Update to version 43.2: + Regressions addressed: - Launch search from shell correctly - Make nautilus-autorun-software work again - Restore 2-dimensional navigation from sushi - Resolve stuttering scrolling - Reintroduce 64px icon size for grid view - Show full filename again in grid, using tooltips + Other bugfixes: - Avoid a many crashes - Stop showing ï¿½ in the type on Properties - Show rename error dialogs again - Handle X11-only drag-and-drop quirks - Allow autorun.sh without executable bit - Improve selection-setting - Restrict DND actions over drag source - Focus replaces files - Improve keyboard focus navigation on the new views - Stop blocking on the tracker connection - Don't add missing emblems + Updated translations. ==== python-numpy ==== - Slightly reformat the specfile condition blocks: The %python_subpackages generator misses " %if" lines with a preceding whitespace. Relevant for d:l:p:backports not having libalternatives. ==== soundtouch ==== Version update (2.3.1 -> 2.3.2) - update to 2.3.2: * autotools improvements ==== sudo ==== Version update (1.9.12p1 -> 1.9.12p2) Subpackages: sudo-plugin-python - Update to 1.9.12p2: * Fixes bsc#1207082 * Changes in 1.9.12p2: Fixed a compilation error on Linux/aarch64. GitHub issue #197. Fixed a potential crash introduced in the fix GitHub issue #134. If a userâs sudoers entry did not have any RunAs userâs set, running sudo -U otheruser -l would dereference a NULL pointer. Fixed a bug introduced in sudo 1.9.12 that could prevent sudo from creating a I/O files when the iolog_file sudoers setting contains six or more Xs. Fixed a compilation issue on AIX with the native compiler. GitHub issue #231. Fixed CVE-2023-22809, a flaw in sudoâs -e option (aka sudoedit) that could allow a malicious user with sudoedit privileges to edit arbitrary files. For more information, see Sudoedit can edit arbitrary files. ==== transactional-update ==== Version update (4.1.0 -> 4.1.2) Subpackages: dracut-transactional-update libtukit4 transactional-update-zypp-config tukit tukitd - Version 4.1.2 - Don't try to mount user mounts if they don't exist [boo#1207366] - Version 4.1.1 - Mount user specific binddirs last: Prevously the internal mounts would potentially overwrite user bind mounts [boo#1205011] - selinux: Relabel shadowed /var files during update to make sure they don't interfere with the update [boo#1205937] - Clean up /var/lib/overlay more aggressively [boo#1206947] - tukit: Merge /etc overlay into parent if --discard is used together with --continue - previously the files were incorrectly always merged with the currently running system - status: do not execute the status command if experimental - Don't delete created mount point dirs any more - Small code optimizations ==== urlview ==== - Update to latest URL ==== vim ==== Version update (9.0.1188 -> 9.0.1234) Subpackages: gvim vim-data vim-data-common - Updated to version 9.0.1234, fixes the following problems * Return value of type() for class and object unclear. * Invalid memory access with folding and using "L". * Some Bazel files are not recognized. * No error when class function argument shadows a member. * Cannot map <Esc> when using the Kitty key protocol. * Compiler warning for comparing pointer with int. * Restoring KeyTyped when building statusline not tested. * Code is indented more than necessary. * Dump file missing from patch. * Abstract class not supported yet. * Crash when using kitty and using a mapping with <Esc>. * AppVeyor builds with an old Python version. * Assignment with operator doesn't work in object method. * Crash when iterating over list of objects. * Return type of values() is always list<any>. * Expression compiled the wrong way after using an object. * Crash when handling class that extends another class with more than one object members. * Testing with Python on AppVeyor does not work properly. * Error when object type is expected but getting "any". * Code is indented more than necessary. * Getting interface member does not always work. * Compiler complains about declaration after label. * Storing value in interface member does not always work. * Cannot read back what setcellwidths() has done. * Adding a line below the last one does not expand fold. * File left behind after running tests. * Using isalpha() adds dependency on current locale. * Coverity warns for ignoring return value. * Using an object member in a closure doesn't work. * Completion includes functions that don't work. * Handling of FORTIFY_SOURCE flags doesn't match Fedora usage. * Termcap/terminfo entries do not indicate where modifiers might appear. * Code is indented more than necessary. * Cannot use setcellwidths() below 0x100. * Cannot call a :def function with a number for a float argument. * Reading past the end of a line when formatting text. ==== vte ==== Subpackages: libvte-2_91-0 typelib-1_0-Vte-2_91 vte-lang - Add ddb2c8a.patch: widget: Use correct end row for getting the selected text. The range is end-exclusive, so use end_row() instead of last_row(). Fixes glgo#GNOME/vte#2584 ==== yast2-network ==== Version update (4.5.12 -> 4.5.14) - Fix the return of packages needed by the selected backend when running an autoinstallation (bsc#1207221) - 4.5.14 - Fixed dirname evaluation when creating the directory for the configuration files to be copied to the target system (bsc#1206723, bsc#1207382) - 4.5.13 ==== yast2-trans ==== Version update (84.87.20230116.80083546af -> 84.87.20230123.08c503a922) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20230123.08c503a922: * Translated using Weblate (Macedonian) * Translated using Weblate (Macedonian) * Translated using Weblate (Portuguese) * Translated using Weblate (Portuguese) * Translated using Weblate (Portuguese) * Translated using Weblate (Portuguese)

1 0

New Tumbleweed snapshot 20230123 released!
by Dominique Leuenberger 24 Jan '23

24 Jan '23

1 0

Update on adding additional x86_64-vX subarchitecture leves via glibc hwcaps
by Dirk Müller 24 Jan '23

24 Jan '23

Hi all, just as an update before the end of the year holidays. Michael Schroeder, Fabian Vogt and myself have been finishing off all missing pieces of implementation work to be able to transparently utilize the build service to provide glibc-hwcaps overlays of shared libraries optimized for higher architecture levels than baseline. While the original intention was to implement the proposal https://en.opensuse.org/openSUSE:X86-64-Architecture-Levels#Available_optio… which is addressing an x86_64 specific need, all of the implemented pieces are reusable to also utilize on other architectures that have similar needs (can think of s390x here for example). What needs to be done as a package? By default, nothing. The x86_64-vX (I suggest targeting -v3 as it has a good balance of performance improvement and hardware compatibility over -v4 or -v2) builds will be limited to those packages that are opting into the glibc-hwcaps feature. if they opt in (which probably needs some analysis as we have seen also seen no increase or slight performance decrease), the only thing needed to do is to add one extra line to the spec file: %{?suse_build_hwcaps_libs} It only works if the package is building a shared library following the shared library policy as a subpackage and provides a `baselibs.conf` file that identifies that package by name. see https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#%{?suse_b… for details Currently this macro is undefined as it relies on a number of not-yet-upstream-accepted changes: * https://github.com/rpm-software-management/rpm/pull/2315 * https://github.com/openSUSE/obs-build/pull/904 * https://github.com/openSUSE/obs-build/pull/907 * https://github.com/openSUSE/post-build-checks/pull/54 * https://build.opensuse.org/package/rdiff/Base:System/filesystem?opackage=fi… * optional: yet undetermined way of providing the user an ability to "opt into the optimized libraries" (current suggestion is via a specific provides in the system to be provided by the patterns package, but could be also done via some zypper specific feature). Once all those changes are in, we can start implementing this in Tumbleweed, if consensus is given on the approach. Unlikely to happen still in 2022. In my testing, it appears beneficial to enable that for most of the dependencies of ImageMagick, the webbrowser dependencies and also the toolkit libraries (gtk, glib, qt etc) for improved desktop experience. In total that would be around 50 packages to submit with the additional macro, but I don't have a very scientific way of determining whether it is worth it yet. Happy to hear your input or feedback. Greetings, Dirk

3 7

New Tumbleweed snapshot 20230122 released!
by Dominique Leuenberger 23 Jan '23

23 Jan '23

1 0

openSUSE Release Engineering meeting 18.01.2023
by Lubos Kocman 23 Jan '23

23 Jan '23

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting Meeting is hosted here https://meet.opensuse.org/ReleaseEngineeringMeeting ## Attendees DimStar,GuillaumeG, Sarah, Rbrown, lkocman, ddemaio, DocB, maxlin ## Leap Waiting for a new Leap build Leap Builds were stuck on https://bugzilla.suse.com/show_bug.cgi?id=1206718 kernel was accepted yesterday Cisco openh264 setup is finialized on our side - http://codecs.opensuse.org/ big thanks to openSUSE Heroes and Adrian for finalizing publishing Changes to https://en.opensuse.org/OpenH264 No response from cisco on my request Code submission deadline for any SLES 15 SP5 related features in a week fro now. I'm bit concerned that we'll have to shift schedule a bit given the fact that we were stack on SLES 15.5 Feature tracking at https://code.opensuse.org/leap/features/issues Legaldb issues https://github.com/openSUSE/cavil/issues/62 that seems to cause serious delays ## openSUSE Tumbleweed openSUSE:Factory build fail stats: 21 failed 24 unresolvable (last week: 22 / 4) https://tinyurl.com/ysy4nnnz * Most work for the x86-64-vN multiarch libs should be in place, RPM as one of the last missing bits should be merged this week (allowing us to co-install -vN builds based on hwcaps for specifically identified libs) * Ruby 3.2 made some progress, only 3 more yast build fails in Staging:H * Staging:L has a few failures collected: * boost: breaks libreoffice (incl. libetonyek) * gpg2: breaks gpgme * libpcap: breaks meson's test suite * Staging:N openssl-3-as-default testing * Various announcer emails are not going out: seems -Current iso files are no longer symlinks (or not followe symlinks?) DimStar noticed it on MicroOS x86_64 i586 carve-out from Factory * openSUSE:Factory:LegacyX86 is setup and builds are in a similar state as openSUSE:Factory * Bots are already up and running: ttm, pkglistgen, trigger-rebuild for rebuild=local * openQA is setup https://openqa.opensuse.org/group_overview/75 => Migration (manual so far) is possible for users. The first 'zypper dup' after changing the repo could include a bunch of 'package downgrades' as the rebuild counters are not synced across projects. Automatic migration of users (by means of openSUSE-release) will happen by end of January (giving the braves ones time to test and report issues before we mass-switch) * We plan to switch to 4096bit RSA key begin of 2023. Keys are added to the openSUSE-build-key for Leap 15.x. Marcus: the 15.3, 15.4 key was updated. 15.4 continues to rebuild. I'd like to do it for 15.5 during the development phase. Then I'd switch it for only for 15.5 and TW , but not 15.4. We need to handle transition effort for 15.4 as it will switch from 2k to 4k key. ## Richard (MicroOS) Desktop-GNOME: The Road to Release: transactional-update-notifier is in Factory! Finally! Working on a "mod-check" tool to report the following to users List of installed (1st party) packages, with comparisions to both an upstream pristine list and previous snapshots Automatically reset official packages to that upstream pristine list, or previous snapshots Any 3rd party packages and their origin Any known unsupported configurations/alterations and offer remedies if possible mod-check doesn't really 'check' as much as planned at the moment, instead going way further and effectively reinstalling MicroOS Desktop (GNOME) in place, making that new snapshot the new boot target. This will be awesome for any user who wants to 'freshen' up an otherwise heavily altered MicroOS Desktop, or when major Tumbleweed/MicroOS changes occur that otherwise cant be easily modeled in patterns. It also potentially could be a method of migrating non-transactional systems to a transactional one. Heavy testing/development underway..and possibly a rename if mod-check doesn't start actually -checking stuff soon. Bugs still WIP osinfo-db still doesn't recognise MicroOS as a seperate distribution - debates with upstream ongoing Working on YaST-less installation media with FDE by default ## Max Leap Micro 5.4 * The project has been bootstrapped * The missing bits ** Tweak Leap specific patches ** Enable pkglistgen lkocman: is on it Leap 15.5 * The fixed kernel for bsc#1206718 has got merged to SLE15-SP5(just yesterday) * Build stats in Backports(x86_64): 8 unresolvables, 59 fails(last week: 8 unresolvables, 54 fails) ## Guillaume - Arm Tumbleweed: * Rolling, but e-mail with changes for 20230116 has not been sent (See Tumbleweed section above). * WiFi is broken on RPi3/4 (and other systems) with kernel 6.1. A fix has been submitted upstream - https://bugzilla.suse.com/show_bug.cgi?id=1206697 * Pointer Authentication issue, seen in zypper. Fixed upstream, gcc13 should be updated soon in Factory - https://bugzilla.suse.com/show_bug.cgi?id=1206684 * NVIDIA: tester with aarch64 server and NVIDIA card wanted - Proprietary drivers are now available for aarch64 (only G06): https://download.nvidia.com/opensuse/tumbleweed/ - New opengpu driver also available in OBS: https://build.opensuse.org/project/monitor/X11:Drivers:Video lkocman to check on who is the aarch64 + nvidia effort blocked on. I recall that there was a chosen point of contact. Leap: * 15.5 aarch64: covered by Leap section above * 15.5 armv7 now in openQA: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=106 ALP: * No aarch64 specific issues WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server ## Sarah - s390x Tumbleweed * kdump is fixed (with calibrate.conf by SLE because of blocked builds for s390x) -> Tumbleweed is rolling again Leap: * tests are failing because of timeout (my next ToDo) * qore updated Question: What should we do with packages buildable only on s390x and not on x86? Example: https://build.opensuse.org/package/show/home:AdaLovelace:branches:server:da… lkocman: I'd start with a bug against the package, then let's agree on next steps with maintainer. Please use bug against openSUSE.org choose 3rd party package. Can be used for anything that is from OBS. ## Doug * Updating openSUSE wiki * Summarizing release manager info for those who can help maintain other architectures * GSoC * Closing out issues * Workshop to finalize projects & application scheduled for on Feb. 7 (deadline at 18:00 UTC) * oSC23 * PO made * Waiting on contract signature * 10 registered, 8 submissions * FOSDEM * Booth in Building/Hall H (we have traditionally be in Building/Hall K) * Bus has 29 sign ups * Article about booth location & activities published * Contact ddemaio if you're in Nuremberg and want to take the bus to FOSDEM. Space may be limited. * FLOSS Weekly podcast schedule for Feb. 8 ## Dirk Not available * Continued work on SUSE:ALP:RISCV bootstrap issues - looking into the java stack which can not be built within ALP * force published 15.4 and 15.5 for armv7 builds, openqa builds have been triggered it appears it is set to do post-release testing? * qemu/libseccomp 15.5 failure still in investigation * made a x86_64-baseline with x86_64-v3 hwcaps prototype for Tumbleweed. Seems successful, has open issue on debuginfo and auto- installation of the v3 optimized version. Performance benefit seems hard to measure. Biggest speedup can be observed by switching zlib to zlib-ng, so looked into fixing the build failures caused by switching to zlib-ng-compat ## Wolfgang (Package Hub), Scott Bahling Not available 15 SP5 Package HUB channel is set up. Stefan did initial testing and looks good. Some packages are still missing, this is on agenda for today and next week. The workshop regarding Package HUB equivalent for ALP Lubos will schedule a call with wolfgang and Scott to ensure that they're in loop for the High Level requirements document. https://en.opensuse.org/openSUSE:ALP/Workgroups/Community/Workshops/Consumi… Package Hub for SLE-15-SP5 product definition added and SCC is currently picking it up so it will be ready for testing with the beta of SLE-15-SP5 ## Maintenance team (Marcus or Maurizio (m4u)) Fixed a long standing issue with gnome-music that was blocking openqa for a long time. 15.4 is working 5.3 is working 15.5 setup TBD (Mid-to-End February would be preferred). Nothing worrysome, preannoucement for 15.3 EOL was sent to mainling list End of December 2022. There were three chromium updates in single week. Configuration setup problem for Maintenance of Leap 15.4 maintenance updates / openQA Marcus regarding Leap 15.4 Image respin - package set will change, we do need to refresh the packagelist * Lubos to talk to Jan Stehlik, we can't put all on Marcuses shoulder. https://etherpad.opensuse.org/p/ReleaseEngineering-20221110-maintenance-dis… Confirmation that QA/QA-maint team will oversee the setup (issues) Lubos: I was asked to provide requirements for the QA team. Mostly for the GA/current release but also for the update. Lubos will make wiki with requirements (something like maintenance plan perhaps). Marcus will review it. * Leap Micro 5.3 maint setup done ffmpeg - (still unsolved) possible file conflict on the next update, no idea how to avoid vendor switching at the moment. Removing the patch on the openSUSE side (that might contain security fixes) or releasing update on the packman side could fix the issue. Lubos to give Marcus some working contact for the team. ## Adrian - OBS DimStart pointed me to the fact that ftp-trees with factory ppc and s390x are not building. It seems to be caused by a smallest worked who is not large enough to handle the cache (caching of all rpms takes about a 1 TB) and it times out. New year cleanup requesting removal of repositories building against EOL distros. ## Project maintainer work flow Status * Base policy to be developed Background on topic found at https://etherpad.opensuse.org/p/ReleaseEngineering-20221221 For me it comes down to a matter of communication. A note like 'thx for your SR, I think we should adapt the following ' or ' we are reviewing your SR, and quite stuck with work...' could already change a lot. Silence for more then 4 week is clearly a perfect way to annoy contributors. And the question should be asked if those unresponsive maintainers are still willing to maintain their projects. Or they may even not be active anymore, another discussion we are having

6 5

Did VNC (x11vnc) get broken with todays tumbleweed kernel?
by Larry Len Rainey 23 Jan '23

23 Jan '23

4 3

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 23 Jan '23

23 Jan '23

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - rtl8812au: Uninstallable: nothing provides kernel-uname-r = 6.0.12-1-default needed by rtl8812au-kmp-default-5.13.6+git20220905.a8450b0_k6.0.12_1.x86_64 Unless somebody is stepping up and submitting fixes, the listed package(s) are going to be removed from openSUSE:Factory. Kind regards, DimStar / Dominique Leuenberger <dimstar(a)opensuse.org>

2 1

How to check for package inclusion in Leap 15.5 ?
by Olav Reinert 23 Jan '23

23 Jan '23

Hi, What is the best way to check if a package is slated for inclusion in the upcoming Leap 15.5? And if it is included, which version? Specifically, I'm interested in finding out if php8-APCu is going to be included in Leap 15.5, because it's missing in Leap 15.4. Thanks, and regards, Olav Reinert

3 2

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

openSUSE Factory January 2023