October 2023 - openSUSE Factory - openSUSE Mailing Lists

Disabling /dev/fb0 on TW
by Thomas Zimmermann 06 Jan '25

06 Jan '25

tl;dr: Disable fbdev userspace interfaces on TW Hi, the upcoming Linux kernel v6.6 will contain the option to disable fbdev userspace interfaces in the kernel configuration. [1] I intent to enable this and thereby switch off /dev/fb0 et al. The tracker bug is boo#1212947. [2] * Why? The old fbdev subsystem is an endless source of bugs. For example, we recently had an out-of-bounds access in the fbdev emulation, where userspace could write beyond the end of the framebuffer memory. [3] Fbdev is under-maintained. I've been doing improvements in recent kernel releases, but only where it benefits the DRM subsystem. Disabling fbdev userspace interfaces will also help weeding out any programs that still contain hard dependencies on them. * What changes? Enabling the new kernel option disables all fbdev userspace interfaces. These are * the device files, such as /dev/fb0 * the sys files under /sys/class/graphics/fb[0-9]+ * /proc/fb * What are the effects on userspace programs? Userspace applications run on the desktop via Wayland or X. There will be no change to them. Xorg and Wayland compositors run on DRM interfaces. A few programs run on SDL, which has no dependency on fbdev either. Any fbdev support in these mid-layer components should be disabled as well. There's one known affected program: TW's text-mode installer can use the tool fbiterm to display CJK symbols during installation. This comes from a time when some low-end systems where not able to boot graphics installation. fbiterm has been unmaintained for >15 years and is ready for retirement. But there's no good drop-in replacement. I propose to simply remove fbiterm and let the graphics installer handle CJK. * What about the framebuffer console? The kernel-provided framebuffer console does not change. The kernel will still show the regular console. Userspace interfaces in /sys/class/graphics/fbcon are still available. For questions and discussion, please comment here or in boo#1212947. Best regards Thomas [1] https://elixir.bootlin.com/linux/v6.6-rc1/source/drivers/video/fbdev/core/K… [2] https://bugzilla.opensuse.org/show_bug.cgi?id=1212947 [3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstrasse 146, 90461 Nuernberg, Germany GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman HRB 36809 (AG Nuernberg)

12 36

factory@ is now under moderation
by Neal Gompa 28 May '24

28 May '24

Hello all, Due to the recent continuous inappropriate behavior on the factory@ mailing list, we have taken the extraordinary action of moderating the entire mailing list. Each message being submitted will be actively reviewed for approval until the Board works through the necessary and appropriate behavior to resolve this incident. -- Neal Gompa (ID: Pharaoh_Atem)

3 2

[opensuse-factory] Leap 42.3 Build 0312 released!
by Ludwig Nussel 25 Apr '24

25 Apr '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&version=42.3&bui… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Distribution&q… When you reply to discuss some issues, make sure to change the subject. Please use the test plan at https://docs.google.com/spreadsheets/d/1AGKijKpKiJCB616-bHVoNQuhWHpQLHPWCb3… to record your testing efforts and use bugzilla to report bugs. Packages changed: biosdevname btrfsmaintenance conduit gconf2-branding-openSUSE (42.1 -> 42.3) ibus kactivitymanagerd kde-user-manager kernel-source (4.4.73 -> 4.4.74) libxml2 libzypp (16.12.0 -> 16.13.0) lightdm marble mc plasma5-integration plasma5-openSUSE postgresql (9.4 -> 9.6) python-coverage (3.7.1 -> 4.3.4) ucode-intel (20160714 -> 20170511) yast2-bootloader (3.2.22 -> 3.2.23) yast2-ntp-client (3.2.9 -> 3.2.12) === Details === ==== biosdevname ==== - Duplicate naming of SRIOV VFs by biosdevname when VPD_DCM Strings are present in VFs (bsc#1042185) * Add: biosdevname_avoid_duplicates.patch ==== btrfsmaintenance ==== - Require btrfsprogs (bsc#1047226) - update to 0.2 - updated documentation - no hardcoded paths to external utilities - fixed logger name typos for 'journal' target - defrag fixes (sysconfig, find arguments) - Removed patch: balance-typo.patch - Added patch: sysconfig-override-trim.diff - Add balance-typo.patch (bnc#986543) - version 0.1.1 - fix typo and make journal logging target work - cron refresh: remove bashism - Removed patches: * 0003-Add-COPYING-file.patch * 0011-cron-refresh-remove-debuggiong-output.patch - cron script symlinks are not created on first installation (bsc#907343) - add COPYING to package - refresh script: remove extra messages - add uninstall targets - fix refresh service - adjust sysconfig defaults - Add more package dependencies (cron, zypp-plugin) - minor bugfixes - Add supplements(btrfsprogs) - initial version 0.1 ==== conduit ==== Subpackages: conduit-lang - Use python-vobject instead of vobject per python-vobject change in 42.3. ==== gconf2-branding-openSUSE ==== Version update (42.1 -> 42.3) - do not build novell-sound-theme in the gconf2-branding-SLED build to prevent duplicated binaries in openSUSE Leap. The novell-sound-theme is taken from gconf2-branding-SLES sources on both the SLED product and the SLES WE module. bsc#1046099 - bump versions ==== ibus ==== Subpackages: ibus-branding-openSUSE-KDE ibus-gtk ibus-gtk-32bit ibus-gtk3 ibus-lang libibus-1_0-5 libibus-1_0-5-32bit python-ibus typelib-1_0-IBus-1_0 - Update ibus.spec: copy auto-start files to SOURCE directory to enable modifications before compile. - Add ibus-disable-engines-preload-in-GNOME.patch: Disable load preload-engines actions in SLE, which is unnecessary for mono IMF in SLE and may cause CJK user login failed (bsc#1036729). ==== kactivitymanagerd ==== - Recommend -lang package ==== kde-user-manager ==== - Recommend -lang package ==== kernel-source ==== Version update (4.4.73 -> 4.4.74) Subpackages: kernel-default kernel-default-devel kernel-devel kernel-docs kernel-macros kernel-syms - Delete patches.kabi/kabi-fix-for-kvm-x86-fix-singlestepping-over-syscall. No need for kABI fix yet for Leap 42.3. - commit f0a86d9 - Fix kABI breakage by KVM CVE fix (bsc#1045922). - commit c0308f6 - powerpc/perf: Fix branch event code for power9 (fate#321438, Pending SUSE Kernel Fixes). - commit e954af6 - powerpc: Fix /proc/cpuinfo revision for POWER9 DD2 (bsc#1046789). - commit 444247f - Refresh metadata patches.drivers/ibmvnic-a2-Fix-assignment-of-RX-TX-IRQ-s.patch. - commit be32be9 - drm/i915: Serialize GTT/Aperture accesses on BXT (bsc#1046821). - commit b263fef - Bluetooth: hidp: fix possible might sleep error in hidp_session_thread (bsc#1031784). - Refresh patches.suse/kgr-0008-mark-task_safe-in-some-kthreads.patch. - commit 18c6f3e - KVM: x86: fix singlestepping over syscall (CVE-2017-7518 bsc#1045922). - commit d989643 - nvme/pci: Fix stuck nvme reset (bsc#1043805). - commit 7afe4f0 - Refresh fadump patches to upstream and add metadata patches.arch/powerpc-fadump-add-reschedule-point-while-releasing-memory.patch. patches.arch/powerpc-fadump-avoid-duplicates-in-crash-memory-ranges.patch patches.arch/powerpc-fadump-avoid-holes-in-boot-memory-area-when-fadump-is-registered.patch patches.arch/powerpc-fadump-provide-a-helpful-error-message.patch - commit f0fb5c3 - blacklist.conf: Remove duplicated entries - commit cb960d2 - Remove duplicated blacklist entries and put git-commit tag to patches - commit 12a0cb2 - blacklist.conf: Remove duplicated entry. - commit 561ddb1 - ibmvnic: Fix assignment of RX/TX IRQ's (bsc#1046589). - commit 5fa38bf - blacklist.conf: blacklist 570d8e939801 we do not care about the code in Documentation all that much, do we? - commit 69d5811 - blacklist.conf: blaclist 5380e5644afb it is just not worth backporting without any explicit report where a silently truncated success would lead to a real bug. - commit fc28626 - blacklist.conf: unnecessary patch The bug triggers only upon a malformed descriptor and the comparison is so that our buffer would be too large not too small so no overflow. The device would not work, but it won't anyway. - commit 99f8a16 - Rearrange the previous patches for hpsa and smartpqi to the right position. - commit a1f1f27 - Update patches.fixes/xfs-split-default-quota-limits-by-quota-type.patch (bsc#1040941). Fix the bug nr used. - commit 115ba75 - printk: Correctly handle preemption in console_unlock() (bsc#1046434). - commit 0a3c2a4 - printk/xen: Force printk sync mode when migrating Xen guest (bsc#1043347). - commit e13596b - btrfs: disable possible cause of premature ENOSPC (bsc#1040182) - commit 8bf31da - rbd: make sure pages are freed by libceph (bsc#1045596). - rbd: drop extra rbd_img_request_get (bsc#1045596). - commit c8719f2 - dm-raid: Do not call BUG() in __rdev_sectors() (bsc#1046264). - commit 0b1aab0 - btrfs: Round down values which are written for total_bytes_size (bsc#1043912). - btrfs: Manually implement device_total_bytes getter/setter (bsc#1043912). - commit c4d2eb7 - pipe: cap initial pipe capacity according to pipe-max-size limit (bsc#1045330). - commit 4ee3ec2 - Blacklist drivers/net/ethernet/ibm/emac We do not build the driver. - commit d432b2b - blacklist.conf: this patch breaks the API It disallows some operations that are now allowed - commit 98325c2 - arm64: Update config files. (bsc#1036737) Disable XGENE_PMU. - commit 7bb0115 - Disable Xilinx network drivers (bsc#1046170). - commit 656fc83 - hwpoison, memcg: forcibly uncharge LRU pages (bnc#1046105). - commit 2b252e1 - blacklist.conf: blacklist 570d8e939801 the issue is visible only when 80df554275c2 is applied (4.7+ and not backported to our trees) - commit 47b83ce - config/x86_64: make CONFIG_SERIAL_8250_DW and *_MID built-in (bsc#1024449) - commit 2e3ca7e - Refresh patches.drivers/0477-nvme-add-hostid-token-to-fabric-options.patch. Update mainline references. - commit eee1109 - fs/exec.c: account for argv/envp pointers (bnc#1039354, CVE-2017-1000365). - commit 7418d0f - Refresh ibmvnic patch metadata patches.drivers/ibmvnic-98-ibmvnic-Correct-return-code-checking-for-ibmvnic_init-during-probe.patch. patches.drivers/ibmvnic-a0-ibmvnic-Fix-incorrectly-defined-ibmvnic_request_map_rsp-structure.patch. patches.drivers/ibmvnic-a1-ibmvnic-Fix-error-handling-when-registering-long-term-mapped-buffers.patch. - commit babc17a - Refresh metadata patches.fixes/powerpc-tm-Fix-stack-pointer-corruption-in-__tm_recheckpoint. - commit 0b5bdc6 - powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS (FATE#322421). - commit 936e653 - nvme: add hostid token to fabric options (bsc#1045293). - commit 52dffb9 - iw_cxgb4: Fix error return code in c4iw_rdev_open() (bsc#1026570). - RDMA/iw_cxgb4: Always wake up waiter in c4iw_peer_abort_intr() (bsc#1026570). - commit 2ce43b1 - clocksource/drivers/arm_arch_timer: Fix read and iounmap of incorrect variable (bsc#1045937). - commit 594f037 - Linux 4.4.74 (CVE-2017-1000364 bnc#1012382 bnc#1039348 bnc#1045340 bsc#1031717 bsc#1043231). - Delete patches.drivers/media-pvrusb2-reduce-stack-usage-pvr2_eeprom_analyze. - Delete patches.drivers/media-vb2-Fix-an-off-by-one-error-in-vb2_plane_vaddr. - Delete patches.drivers/staging-rtl8188eu-prevent-an-underflow-in-rtw_check_. - Delete patches.fixes/mm-fix-new-crash-in-unmapped_area_topdown.patch. - Delete patches.fixes/mm-larger-stack-guard-gap-between-vmas.patch. - commit 5e41880 - tty: Fix ldisc crash on reopened tty (bnc#1043488). - commit 04cca20 - tty: Destroy ldisc instance on hangup (bnc#1043488). - tty: Refactor tty_ldisc_reinit() for reuse (bnc#1043488). - tty: Use 'disc' for line discipline index name (bnc#1043488). - tty: Move tty_ldisc_kill() (bnc#1043488). - tty: Handle NULL tty->ldisc (bnc#1043488). - tty: Prepare for destroying line discipline on hangup (bnc#1043488). - tty: Reset c_line from driver's init_termios (bnc#1043488). - tty: Simplify tty_set_ldisc() exit handling (bnc#1043488). - commit c016cca - kabi: ignore fs_info parameter for tracepoints that didn't have it (bsc#1044912). - commit 24869ea ==== libxml2 ==== Subpackages: libxml2-2 libxml2-2-32bit libxml2-devel libxml2-tools - Security fix: * libxml2-CVE-2017-7376.patch [bsc#1044887, CVE-2017-7376] * Increase buffer space for port in HTTP redirect support - Security fix: * libxml2-CVE-2017-7375.patch [bsc#1044894, CVE-2017-7375] * Prevent unwanted external entity reference - Upstream patches updated and with tests: * libxml2-CVE-2017-9047.patch and libxml2-CVE-2017-9048.patch merged into libxml2-CVE-2017-9047.patch [bsc#1039066, bsc#1039661] * libxml2-CVE-2017-9049.patch and libxml2-CVE-2017-9050.patch merged into libxml2-CVE-2017-9049.patch [bsc#1039063, bsc#1039064] ==== libzypp ==== Version update (16.12.0 -> 16.13.0) - Adapt loop mounting of iso images (bsc#1038132, bsc#1033236) - Adjust zypp.conf for openSUSE Tumbleweed (bsc#1031756) - Change arch variable names conflicting with compiler macros (fixes #70) - Fix potential crash if repo has no baseurl (bnc#1043218) - version 16.13.0 (0) ==== lightdm ==== Subpackages: liblightdm-gobject-1-0 lightdm-lang - Augment patch to also resolve the target of symlink sessions for detemining the preselected option: * ignore-known-symlink-sessions.patch ==== marble ==== Subpackages: libastro1 libmarblewidget-qt5-27 marble-data marble-devel marble-doc marble-kde marble-lang - Add Fix-utm-enum-value.patch and reverse-apply it, this upstream commit causes a crash when adding bookmarks if switched to UTM view angles because the necessary handler functions for the dialog are not implemented yet (boo#1044747, kde#381872) - Add Fix-plain-map-and-political-map-showing-no-content.patch to fix the plain map and the political map being not displayed at all (kde#379297) ==== mc ==== Subpackages: mc-lang - sftp.patch: Backport upstream fixes for SFTP (boo#1004280, boo#1042797) ==== plasma5-integration ==== - Move the Recommends: %{name}-plugin-lang to the plasma5-integration-plugin sub package, otherwise the translations won't get installed as there is no main package (boo#1027925) - Actually apply the aforementioned patch (shouldn't the source validator have warned?) ==== plasma5-openSUSE ==== Subpackages: plasma5-defaults-openSUSE plasma5-theme-openSUSE plasma5-workspace-branding-openSUSE sddm-theme-openSUSE - Fix installation of the sddm theme files (boo#1047254) ==== postgresql ==== Version update (9.4 -> 9.6) Subpackages: postgresql-contrib postgresql-devel postgresql-docs postgresql-server - Bump version and defaultpackage to 9.6. - Move ~postgres/.bash_profile to postgresql-server to avoid a file conflict between the versioned server packages. - Bump version and defaultpackage to 9.4. - Bump version and defaultpackage to 9.3. - Change license string to PostgreSQL. - Make all dummy packages noarch. - Make PostgreSQL 9.2 the default. - Reduce the postgresql packages with unversioned names to dummy packages that require the respective versioned package names. ==== python-coverage ==== Version update (3.7.1 -> 4.3.4) - uninstall alternatives in %postun - update for singlespec - update to 4.3.4: - Using the --skip-covered option on an HTML report with 100% coverage would cause a ?No data to report? error, as reported in issue 549. This is now fixed; thanks, Lo�c Dachary. - If-statements can be optimized away during compilation, for example, if 0: or if __debug__:. Coverage.py had problems properly understanding these statements which existed in the source, but not in the compiled bytecode. This problem, reported in issue 522, is now fixed. - If you specified --source as a directory, then coverage.py would look for importable Python files in that directory, and could identify ones that had never been executed at all. But if you specified it as a package name, that detection wasn?t performed. Now it is, closing issue 426. Thanks to Lo�c Dachary for the fix. - If you started and stopped coverage measurement thousands of times in your process, you could crash Python with a ?Fatal Python error: deallocating None? error. This is now fixed. Thanks to Alex Groce for the bug report. - On PyPy, measuring coverage in subprocesses could produce a warning: ?Trace function changed, measurement is likely wrong: None?. This was spurious, and has been suppressed. - Previously, coverage.py couldn?t start on Jython, due to that implementation missing the multiprocessing module (issue 551). This problem has now been fixed. Also, issue 322 about not being able to invoke coverage conveniently, seems much better: jython -m coverage run myprog.py works properly. - Let?s say you ran the HTML report over and over again in the same output directory, with --skip-covered. And imagine due to your heroic test-writing efforts, a file just acheived the goal of 100% coverage. With coverage.py 4.3, the old HTML file with the less-than-100% coverage would be left behind. This file is now properly deleted. - update to Version 4.3.1 ? 2016-12-28: - Some environments couldn?t install 4.3, as described in issue 540. This is now fixed. - The check for conflicting --source and --include was too simple in a few different ways, breaking a few perfectly reasonable use cases, described in issue 541. The check has been reverted while we re-think the fix for issue 265. - update to Version 4.3 ? 2016-12-27: Special thanks to Lo�c Dachary, who took an extraordinary interest in coverage.py and contributed a number of improvements in this release. - The HTML report now supports a --skip-covered option like the other reporting commands. Thanks, Lo�c Dachary for the implementation, closing issue 433. - Subprocesses that are measured with automatic subprocess measurement used to read in any pre-existing data file. This meant data would be incorrectly carried forward from run to run. Now those files are not read, so each subprocess only writes its own data. Fixes issue 510. - Coverage.py wouldn?t execute sys.excepthook when an exception happened in your program. Now it does, thanks to Andrew Hoos. Closes issue 535. - The coverage combine command will now fail if there are no data files to combine. The combine changes in 4.2 meant that multiple combines could lose data, leaving you with an empty .coverage data file. Fixes issues issue 525, issue 412, issue 516, and probably issue 511. - The branch coverage issues described in issue 493, issue 496, and issue 502 are now fixed, thanks to Lo�c Dachary. - Options can now be read from a tox.ini file, if any. Like setup.cfg, sections are prefixed with ?coverage:?, so [run] options will be read from the [coverage:run] section of tox.ini. Implements part of issue 519. Thanks, Stephen Finucane. - Specifying both --source and --include no longer silently ignores the include setting, instead it fails with a message. Thanks, Nathan Land and Lo�c Dachary. Closes issue 265. - Coverage.py can now search .pex files for source, just as it can .zip and .egg. Thanks, Peter Ebden. - update to 4.2: - Since ``concurrency=multiprocessing`` uses subprocesses, options specified on the coverage.py command line will not be communicated down to them. Only options in the configuration file will apply to the subprocesses. Previously, the options didn't apply to the subprocesses, but there was no indication. Now it is an error to use ``--concurrency=multiprocessing`` and other run-affecting options on the command line. This prevents failures like those reported in `issue 495`_. - Filtering the HTML report is now faster, thanks to Ville Skytt�. - update to 4.0.3: - Fixed a mysterious problem that manifested in different ways: sometimes hanging the process (`issue 420`_), sometimes making database connections fail (`issue 445`_). - The XML report now has correct ``<source>`` elements when using a ``--source=`` option somewhere besides the current directory. This fixes `issue 439`_. Thanks, Arcady Ivanov. - Fixed an unusual edge case of detecting source encodings, described in `issue 443`_. - Help messages that mention the command to use now properly use the actual command name, which might be different than "coverage". Thanks to Ben Finney, this closes `issue 438`_. - add LICENSE.txt - Pre require coreutils. This package is needed for the rm call in the pre section. Subprocess failed. Error: RPM failed: /var/tmp/rpm-tmp.gONanE: line 3: rm: command not found - specfile: * updated license * updated update-alternatives * README.txt -> README.rst - update to version 4.0: (long list, see http://coverage.readthedocs.org/en/latest/changes.html) - fix rhel deps by depending on /usr/sbin/update-alternatives ==== ucode-intel ==== Version update (20160714 -> 20170511) - Update to version 20170511 - Update to version 20161104. ==== yast2-bootloader ==== Version update (3.2.22 -> 3.2.23) - AuotYaST configuration: Set StorageDevices flag disks_valid to true. So libstorage can scan valid disks and "/" partition can be found. (bnc#1043132) - 3.2.23 ==== yast2-ntp-client ==== Version update (3.2.9 -> 3.2.12) - Resrict records are written at the end but the default file and most profiles use them at the beginning, which mangles the file completely (bsc#983486). To fix it we have just changed the order of writing. - 3.2.12 - AutoYaST: Fix crash when trying to sanitize not string values, for example initial_sync. - AutoYaST: Sanitize comments by only removing blank spaces at the beginning and adding line break. This avoids augeas parse errors (bsc#1045777). - 3.2.11 - AutoYaST: Fix crash in CFA when creating a command record with some key value option is given (bsc#1045968) - 3.2.10 - AutoYaST: Comments from autoyast profile should not be sanitized to avoid entries without space between value and comment (e.g trustedkey 1# coment). This is caused by a bug in augeas adding new entries. -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-factory+owner(a)opensuse.org

2 1

[opensuse-factory] acpid requires systemd?
by Felix Miata 25 Apr '24

25 Apr '24

Can this be true? If so, why? Zypper won't let me upgrade acpid without breakage unless systemd is installed too. I have systemd locked out, as I'd rather test things I can understand in Factory, not major overhaul stuff. -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-factory+help(a)opensuse.org

4 3

enabling reproducible builds in Factory and ALP
by Jan Zerebecki 15 Mar '24

15 Mar '24

Hi *, to support https://en.opensuse.org/openSUSE:Reproducible_Builds I plan to get the following project configuration for Factory and ALP enabled: Macros: %source_date_epoch_from_changelog Y %clamp_mtime_to_source_date_epoch Y %use_source_date_epoch_as_buildtime Y %_buildhost reproducible :Macros I'm still waiting to get https://github.com/openSUSE/product-builder/pull/26 merged to prevent a bug with mirrors that will otherwise happen. Afterwards a time of the build is still in the HTTP header Last-Modified when requesting the rpm file. HTTP mtime is a few seconds earlier than end time of the build (seen in OBS web UI only as start + duration). I didn't double check, but it should also be recorded in the Tumbleweed archive Bernhard keeps, which can with a bit of work be looked up by content hash or name including version of the rpm file if its not on the normal mirrors anymore. Both the build time and host can also still be seen in the build log. Comments welcome. -- Best regards, Jan Zerebecki

4 6

Proposal: amend the packaging guidelines for %fillup_only
by Dan Čermák 02 Mar '24

02 Mar '24

Hi list, our packaging guidelines for %fillup_only [1] currently do not suggest anything for the %files section for the files generated in `/etc/sysconfig/`. I would like to suggest that we start adding the newly generated file `/etc/sysconfig/$pkgname` as follows to the %files section: --8<---------------cut here---------------start------------->8--- %files %ghost %config(noreplace) %attr(0600,root,root) /etc/sysconfig/%{name} %dir /etc/sysconfig --8<---------------cut here---------------end--------------->8--- This ensures that rpm is aware of the files as configuration files. Thoughts, opinions? Cheers, Dan Footnotes: [1] https://en.opensuse.org/openSUSE:Packaging_Conventions_RPM_Macros#%fillup_o… -- Dan Čermák <dcermak(a)suse.com> Software Engineer Development tools SUSE Software Solutions Germany GmbH Frankenstr. 146 90461 Nürnberg Germany www.suse.com Geschäftsführer: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

3 3

wine and zlib
by Joe Salmeri 22 Feb '24

22 Feb '24

I did a fresh install of TW 20230222 on a new PC. My main desktop which was installed back in 2021 has also been updated ( zypper dup ) to 20230222. I found something odd when comparing packages between the 2 machines. Both PC's have wine installed, however... On my main desktop when the original install in 2021 of wine was done it installed libz1-32bit ( as per the zypper history logs ) and it still has that installed after it was updated to 20230222. On the new PC fresh install of 20230222 when wine was installed it installed libz-ng-compat1-32bit. The libz-ng-compat1-32bit version looks like it was forked in 2021, just after my main machine was originally built so that would explain why it has libz1-32bit but shouldn't it have been updated by zypper dup ??? Is this a bug that I should report? If so, which system is wrong / which version should be used? Thanks!

5 6

Recent e2fsprogs update flag changes
by Patrick Schaaf 22 Feb '24

22 Feb '24

Hi, as I haven't found discussion by searching, I thought I bring up a gotcha I ran into today, on a host recently updated to tumbleweed 20230801 level. With a somewhat recent update to e2fsprogs, now at 1.47.0 compared to May '23 at 1.46.5, the set of mkfs flags has changed: --- /root/mke2fs.conf.20230512 2023-08-09 12:00:14.379476597 +0200 +++ /etc/mke2fs.conf 2023-06-14 19:20:22.000000000 +0200 @@ -14 +14 @@ - features = has_journal,extent,huge_file,flex_bg,metadata_csum,64bit,dir_nlink,extra_isize + features = has_journal,extent,huge_file,flex_bg,metadata_csum,metadata_csum_seed,64bit,dir_nlink,extra_isize,orphan_file For me, this resulted in an otherwise fine virtual machine with 20230512 userlevel, not booting after an "rsync copy migration" into a fresh root filesystem mkfs'ed with these new flags. Reason being that 3 months older fsck - the sytemd boot time rootfs service actually - goes "failed". I guess I'll need just use flag override options going forward, to cope with that, but thought I'd bring it to attention here at least. best regards Patrick

3 4

snapd applications not working on Tumbleweed (20230613)
by Jim Henderson 19 Jan '24

19 Jan '24

Wondering if anyone else is seeing this. I attempted to launch two apps (slack and spotify) installed with snapd, and the launch failed. Troubleshooting it, I removed all of the snaps from the system, uninstalled and reinstalled snapd, and I get the following output: --- $ snap install spotify error: cannot perform the following tasks: - Run configure hook of "spotify" snap if present (run hook "configure": ----- go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Matcha-dark-sea /snap/spotify/67/data-dir/themes/Matcha-dark-sea none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Matcha-sea /snap/spotify/67/data-dir/themes/Matcha-sea none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-compact /snap/spotify/67/data-dir/themes/Materia-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-dark-compact /snap/spotify/67/data-dir/themes/Materia-dark-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-dark /snap/spotify/67/data-dir/themes/Materia-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-light-compact /snap/spotify/67/data-dir/themes/Materia-light-compact none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia-light /snap/spotify/67/data-dir/themes/Materia-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Materia /snap/spotify/67/data-dir/themes/Materia none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Radiance /snap/spotify/67/data-dir/themes/Radiance none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Radiant-MATE /snap/spotify/67/data-dir/themes/Radiant-MATE none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-dark /snap/spotify/67/data-dir/themes/Yaru-MATE-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-MATE-light /snap/spotify/67/data-dir/themes/Yaru-MATE-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-bark-dark /snap/spotify/67/data-dir/themes/Yaru-bark-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-bark /snap/spotify/67/data-dir/themes/Yaru-bark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-blue-dark /snap/spotify/67/data-dir/themes/Yaru-blue-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-blue /snap/spotify/67/data-dir/themes/Yaru-blue none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-dark /snap/spotify/67/data-dir/themes/Yaru-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-light /snap/spotify/67/data-dir/themes/Yaru-light none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-magenta-dark /snap/spotify/67/data-dir/themes/Yaru-magenta-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-magenta /snap/spotify/67/data-dir/themes/Yaru-magenta none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-mate-dark /snap/spotify/67/data-dir/themes/Yaru-mate-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-mate /snap/spotify/67/data-dir/themes/Yaru-mate none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-olive-dark /snap/spotify/67/data-dir/themes/Yaru-olive-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-olive /snap/spotify/67/data-dir/themes/Yaru-olive none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen-dark /snap/spotify/67/data-dir/themes/Yaru-prussiangreen-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-prussiangreen /snap/spotify/67/data-dir/themes/Yaru-prussiangreen none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-purple-dark /snap/spotify/67/data-dir/themes/Yaru-purple-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-purple /snap/spotify/67/data-dir/themes/Yaru-purple none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-red-dark /snap/spotify/67/data-dir/themes/Yaru-red-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-red /snap/spotify/67/data-dir/themes/Yaru-red none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-sage-dark /snap/spotify/67/data-dir/themes/Yaru-sage-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-sage /snap/spotify/67/data-dir/themes/Yaru-sage none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-viridian-dark /snap/spotify/67/data-dir/themes/Yaru-viridian-dark none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru-viridian /snap/spotify/67/data-dir/themes/Yaru-viridian none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/Yaru /snap/spotify/67/data-dir/themes/Yaru none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied update.go:85: cannot change mount namespace according to change mount (/snap/gtk-common-themes/1535/share/themes/elementary /snap/spotify/67/data-dir/themes/elementary none bind,ro 0 0): cannot create writable mimic over "/snap/spotify/67/data-dir/themes": permission denied cannot update snap namespace: cannot create writable mimic over "/usr/lib/x86_64-linux-gnu": permission denied snap-update-ns failed with code 1 -----) --- The execution of both programs prior to the reinstallation did the same thing. I did note that /usr/lib/x86_64-linux-gnu does not exist on my system. Happy to report a bug on bugzilla, but wanted to see if anyone else had noticed this. -- Jim Henderson Please keep on-topic replies on the list so everyone benefits

5 10

Is it possible for Slowroll to officially support the integrity of NVidia and VMWare modules?
by Xu Zhao 19 Dec '23

19 Dec '23

Hello all, I am a 5-years Tumbleweed user. I am also the maintainer of many Tumbeweed packages such as telegram-desktop, chezscheme, amdvlk, and yacreader. I have both AMD and NVIDIA desktops with openSUSE Tumbleweed installed. NVidia closed-source GPU driver integration has always been a pain for rolling release like Tumbleweed because: 1) kernel's API keeps changing and it often takes NVidia 1~2 weeks to follow-up the latest kernel release in their new driver version (see http://rglinuxtech.com/ ); 2) people who don't care about NVidia do not want to slow down the rolling of kernel versions For example, even today the version of nvidia-open-driver-G06-signed-kmp-default(https://build.opensuse.org/packag…, 535.113.01) is not compatible with nvidia-video-G06 (https://download.nvidia.com/opensuse/tumbleweed/x86_64/, 535.104) on Tumbleweed. I am wondering if we can attract some users to Slowroll if it only releases snapshots whose kernel version is compatible with the NVidia GPU driver? At least I will be very interested to try it out on my Nvidia desktop. Similar case should apply for VMWare kernel modules, but if it takes too much additional efforts, I think we should priortize NVidia module integrity. Best, Xu -- Xu Zhao i(a)xuzhao.net

10 16

[TESTERS WANTED] Using git to maintain packages on OBS - test run
by Dan Čermák 08 Dec '23

08 Dec '23

Dear packagers for openSUSE Tumbleweed, we have been working on a prototype that allows you to maintain your packages in git (similarly to Fedora's dist git) on src.opensuse.org instead of on OBS. Contributions to the package are then handled via pull requests on src.opensuse.org which get automatically forwarded as submitrequests on OBS. This is currently just a prototype and we are looking for testers and general feedback. So if you want to participate as a maintainer, please check the full guide here: https://opensuse.github.io/scm-staging/user_guide.html tl;dr; you'll have to convert the develpackage to use `<scmsync>` from src.opensuse.org/pool and everything else should "just work". FAQ: - Where can I report issues or provide feedback? https://github.com/openSUSE/scm-staging/issues (for bugs) or https://github.com/openSUSE/scm-staging/discussions (for general feedback) - Is this how the future of packaging in openSUSE is going to look like? Maybe, maybe not. This is currently just a test drive and its outcome will influence the way forward. - Will submitrequests to my develpackage still work? Sadly no, branching a git maintained package on OBS does not work. Please indicate in the description of your package that users should contribute on src.opensuse.org instead. - Which tools do I need? Just git, git-lfs and osc (at least version 1.2.0 is recommended for service runs to work) Looking forward to your feedback! Dan -- Dan Čermák <dcermak(a)suse.com> Software Engineer Development tools SUSE Software Solutions Germany GmbH Frankenstrasse 146 90461 Nürnberg Germany (HRB 36809, AG Nürnberg) Managing Director/Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman

23 66

Migrate from update-alternatives to libalternatives
by Martin Schreiner 05 Dec '23

05 Dec '23

Hello folks, As some of you may know, there are some limitations regarding update-alternatives that prevent it from working perfectly when using transactional updates. Basically, /var isn't part of the snapshot's data. This means that all files created/manipulated during package installation in /var/lib/alternatives won't be taken into consideration when snapshots are rolled back. More information is available here: https://kubic.opensuse.org/documentation/transactional-update-guide/tu-setu… This fact could lead to broken symlinks: Suppose I install "go1.20"(snapshot A) and "go1.21" (snapshot B). I then boot from snapshot A, but "/var/lib/alternatives/go" still tells "update-alternatives" that "go1.21" would be a valid choice, since this information lives outside of the snapshot's directories, in "/var". If "update-alternatives" were to accept that choice, then "/etc/alternatives/go" would become a broken link, our last line of defence here being how carefully maintained "update-alternatives" is. So that's not a system-level design solution, but rather very application-specific. What we're planning: Replace update-alternatives with libalternatives: https://github.com/openSUSE/libalternatives This change should be done gradually on Factory, and ideally it would require no manual intervention from the users. We plan on releasing this change in batches: i.e.: all Go versions we provide on Factory would be migrated to libalternatives in a single-pass. Then another set of closely-related packages, such as the OpenJDK. Then another, so on and so forth. What we need: The goal of this thread is to establish a line of discussion around this change, which should be a gradual one on Factory. All opinions, comments, ideas and criticism are valid, and will be taken into consideration. Status: There are currently 14909 spec files on openSUSE:Factory. 964 (6.46%) of these depend on update-alternatives. Currently 52 packages use libalternatives, such as vim and nodejs-common. Basically, the cores of both MicroOS and SLE Micro are already using libalternatives. Things that seem to be clear in this particular context: 1 - libalternatives should work really well with transactional updates: As the state of alternatives kept by libalternatives is maintained in /usr/share/libalternatives/<binary>/<pref>.conf, this means that packages only need to provide a single file to provide their alternative. This file will be part of the package's regular files (declared in %files), and no state is modified by any hooks (preun, postun, prerm, postrm) during the updates. Rolling back a snapshot will revert back to a state where that alternative didn't exist (as it wasn't installed). 2 - libalternatives does not manipulate symlinks: /usr/bin/alts (the main binary for libalternatives) executes binaries directly (by calling exec()). The actually binary (for example, /usr/bin/vi) is a symlink to /usr/bin/alts, which then reads its configuration files and determines which binary to execute, based on the highest priority. 3 - libalternatives supports user overrides: non-root users can override the alternatives by creating their own local preference file in $HOME/.config/libalternatives.conf. This may be done by invoking "alts" directly, as it serves both purposes. 4 - Even if it doesn't manipulate symlinks, groups and manpages are still supported: libalternatives has a "group" directive for manipulating groups of binaries together, and it has some verifications to ensure the binaries in these groups are indeed declared in tandem with one another, essentially managing them as a collection. It also has a "man" directive for man pages, so even if it's not doing symlink manipulation, look up man pages still works. In fact, our "man" package was patched to work with libalternatives support: https://build.opensuse.org/package/view_file/Base:System/man/man-db-2.9.4-a… 5 - No RPM macros are required: This is really cool. We're basically just adding a file to %files, to use libalternatives. So no RPM macros are even required here. But we could create an RPM macro that automatically writes the preference file, so we could easily manipulate its contents inside the RPM spec. 6 - How libalternatives can actually be used So there are actually at least TWO ways to use libalternatives: we either create a symlink to /usr/bin/alts, or use libalternatives as a shared object and write a tiny wrapper program, such as this one: https://build.opensuse.org/package/view_file/devel:languages:nodejs/nodejs-… The advantage of the first method is that we don't need a special – albeit short – C program to act as a dispatcher for libalternatives's magic sauce. The advantage of the second method is that we don't need packages to depend on the "alts" package (which contains /usr/bin/alts), but only on "libalternatives1" instead (which provides /usr/lib64/libalternatives.so.1). I appreciate if you can provide any insights here, they're more than welcome. Thank you.

16 45

Sudo announcement - upcoming changes
by Otto Hollmann 27 Nov '23

27 Nov '23

Hi all, I'm happy to inform you about upcoming changes in our openSUSE implementation of sudo. The first change is splitting configuration files between /etc and /usr/etc. More information about why we are introducing this change can be found here [1]. Sudo will read configuration files in the following order: /etc/sudoers, /usr/etc/sudoers. Our distribution file will be installed in /usr/etc/sudoers. If there is no /etc/sudoers file, the command visudo will open /usr/etc/sudoers and save the result as /etc/sudoers. If /etc/sudoers file already exists, there is no change in visudo behavior - it will open and edit /etc/sudoers. Big thanks to sudo upstream and Jason Sikes for this change. The second change relates to the configuration "Defaults targetpw" SUSE traditionally ships sudo with "Defaults targetpw". That allows any user in the system to use sudo without configuration by authenticating as the target user (usually root). An alternative authentication scheme used by some Linux distributions allows users who are members of a specific group to authenticate as root by typing their own password. So far, this model required manual configuration. To make this approach easier, we are now introducing the following optional packages: * sudo-policy-wheel-auth-self * sudo-policy-sudo-auth-self * system-group-sudo If installed, users in the wheel group (first package) or sudo group (second package) will be asked for their password instead of the password of the target account when executing the sudo command. There is no change for users who are not in those special groups. sudo will continue to prompt for the target password for those users. So updating sudo is safe in any case. The third package (which will be installed as a dependency for the package sudo-policy- sudo-auth-self) creates a configuration file for systemd-sysusers, ensuring that the system group "sudo" will be created. *Please note the meaning of the wheel group is not well defined, so adding users to that group may have effects outside the scope of sudo.* In addition, those packages also install polkit policies so applications using polkit will be also allowed to authenticate in the same way. [1] https://en.opensuse.org/openSUSE:Packaging_UsrEtc Regards, Otto Hollmann

9 23

Remove dependency on /usr/bin/python3
by Daniel Garcia 22 Nov '23

22 Nov '23

Hello, As part of a Python team maintenance task we are trying to remove the dependency on /usr/bin/python3 from as many packages as possible to reduce the problems of changing the system python in the future [1]. Right now /usr/bin/python3 is a link provided by the current system python package that today is python311, in Factory. Any package that provides a python script with the shebang #!/usr/bin/python3 will have the requirement on /usr/bin/python3. There's a macro in the python-rpm-macros to fix the shebang on python scripts automatically, that can be used in the install phase, just before the fdupes call, and point to the real binary and not the link: %python3_fix_shebang This macro expands to: for f in /home/abuild/rpmbuild/BUILDROOT/%{NAME}-%{VERSION}- %{RELEASE}.x86_64/usr/bin/*; do [ -f $f ] && sed -i "1s@#!.*python.*@#!$(realpath /usr/bin/python3)@" $f done And indeed will replace the shebang to point to #!/usr/bin/python3.11. This will make the script to work correctly, even if the system python changes in the distribution, avoiding the problem of running with a different python and not finding the deps that are in /usr/lib/python3.11/site- packages. In some cases it could be okay to have the shebang #!/usr/bin/python3, if there are no external dependencies and it's something that will work with different python versions, but when possible, and as a general rule, it'll be better to fix the shebangs. If you maintain a package that provides some python script, please, consider to add this macro call. [1] https://bugzilla.opensuse.org/show_bug.cgi?id=1212476 -- Daniel García Moreno Python Packager

8 13

Announcing Agama 5
by Imobach Gonzalez Sosa 22 Nov '23

22 Nov '23

Hi all, We have just released Agama 5 which, among other things, includes: * A translated web user interface. By now, it is available in Dutch, English, Japanese, Spanish, Swedish. * A prototype of a software patterns selection. However, the important part is the discussion in the openSUSE Factory mailing list[1]. * Agama does not reuse pre-existing swap partitions. * Support to boot via PXE. As usual, you can find the full announcement in our blog[2]. Regards, Imo [1] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… [2] https://yast.opensuse.org/blog/2023-10-25/agama5 -- Imobach González Sosa SUSE Linux LLC

2 1

What Tumbleweed patterns do we want to offer during Agama installation
by Ancor Gonzalez Sosa 21 Nov '23

21 Nov '23

We need to talk. ;-) As you may know, the YaST Team is developing an alternative installer called Agama (formerly D-Installer). https://github.com/openSUSE/agama We want the workflow in Agama to be simpler than with YaST. Even without any selection of packages to install. But quite some people expressed their desire of being able to customize the software selection while installing the operating system itself. Since we don't want to bring back complex and specific concepts like the installation roles, we decided to expose the current list of patterns so the users can decide which ones to install... knowing that would expose some organizational problems we have with patterns. Take a look at https://yast.opensuse.org/assets/images/patterns-demo.gif That's a first implementation that shows we have WAY too many patterns that are WAY too arbitrarily organized. If we want to use patterns as the main concept to allow software customization... What can we do? Organize the patterns better? Introduce some kind of flag to distinguish the patterns that make sense to offer during installation? Fix something in the way we categorize the patterns? We feel this is not an UI problem, but an structural one. We are looking forward for realistic suggestions. Meanwhile, you can play with the current list by downloading the staging version of Agama. Ie. any image called agama-live-xxx-openSUSE-yyy.iso from https://download.opensuse.org/repositories/systemsmanagement:/Agama:/Stagin… Cheers. -- Ancor González Sosa YaST Team at SUSE Software Solutions

12 23

SCSI device identification and SCSI symlink generation in sg3_utils 1.48
by Martin Wilck 09 Nov '23

09 Nov '23

With the forthcoming update of sg3_utils to v1.48 (currently in Base:System, to be submitted to Factory soon), SCSI device identification and SCSI symlink generation by udev will change. TL;DR: unreliable device identifiers will not be used by default any more, and /dev/disk/by-id symlinks for such identifiers will not be created by default, either. The policy can be changed by editing the udev rules in 00-scsi-sg3_config.rules. Please file bugs and / or notify me if you have trouble with this new identification scheme. Of course, while this is still in Base:System, we can also discuss the general approach for Factory, and the defaults to be applied. Long version: It is well known that referring to disk devices by their device node (like /dev/sda) is unreliable. In most situations, it is recommended to refer to devices by their content, i.e. using file system UUIDs or labels. Sometimes, however, the devices must be referred to by hardware properties. For this purpose, udev maintains various symlinks under /dev/disk/by-id. This post is specifically about SCSI symlinks, which have the format /dev/disk/by-id/scsi-XYZ. If you don't use dm-multipath, and don't use hardware IDs to refer to any disks or partitions anywhere, you can stop reading here. SCSI devices can be identified in different ways by the contents of SCSI VPD (Vital Product Data) pages. In PVD 83 (device identification), the following identifiers may occur (see SCSI spec SPC-6 §7.7.6 for details): a) NAA registered extended: 36... (+ 31 hex digits) b) NAA registered: 35... (+ 15 hex digits) c) NAA extended: 32... (+ 15 hex digits) d) EUI-64: 2... (+ 16 hex digits) e) SCSI name string: 8... (+ utf-8 string) f) NAA local ("L"): 33... (+ 15 hex digits) g) T10 vendor-ID ("T): 1... (+ string) h) vendor-specific ("V") 0... (+ string) Furthermore, we have i) serial number ("S"): S... (+ vendor/product/serial string) The list above is sorted roughly top-down by the reliability (uniqueness) of these identifiers. The udev rules select the most reliable available identifier from the above list to set the ID_SERIAL udev property, which is used e.g. by dm-multipath to identify SCSI devices which represent different paths to the same physical volume. Furthermore, the udev rules create /dev/disk/by-id/scsi-$ID symlinks for all identifiers from the above list that are defined for a given device. This makes sure that whatever identifier a user has chosen for referring to her disks will be available as symlink under /dev/disk/by-id. However, this has also severe disadvantages. The identifiers f)-i) are not reliable; IOW there can be multiple devices in the same system that use the same identifier, although they don't represent the same physical disk. This applies to i) in particular: Some large storage arrays use the same serial number for all LUNs they expose. Using such identifiers for multipath can cause fatal data corruption. Moreover, the creation of these symlinks during boot can slow down booting a lot, because thousands of devices may be contending for the same symlink. Lastly, not creating useless symlinks will tidy up /dev/disk/by-id and make it easier to read. Therefore sg3_utils 1.48 changes the policy for SCSI device identification. The policy can be customized in the udev rule "00-scsi- sg3_config.rules" (to change the policy, copy this file from /usr/lib/udev/rules.d to /etc/udev/rules.d first). For determining ID_SERIAL, only a)-e) above are tried. If users need to use additional identifiers from the list above, they can set the udev property .SCSI_ID_SERIAL_SRC (leading "." is intentional) to any combination of the capital letters in quotes in the list above. E.g. "ST" would mean to take g) and i) into account. To restore the previous behavior, set ENV{.SCSI_ID_SERIAL_SRC}="LTVS". The current upstream default is "T", so that g) above is still enabled. To disable all "unreliable" IDs, set it to the empty string. If udev encounters a device for which ID_SERIAL can't be assigned, it prints a warning to the journal. Symlink generation is controlled by the variable .SCSI_SYMLINK_SRC. It can also be set to any combination of "LTVS", with the same meaning of the letters as above, and controls which scsi-... symlinks udev will create under /dev/disk/by-id/, *in addition* to the symlink /dev/disk/by-id/scsi-$ID_SERIAL, which will always be created if ID_SERIAL could be determined. Again, to restore the previous behavior of the udev rules, set ENV{.SCSI_SYMLINK_SRC}="LTVS". The default is the empty string. Note 1: The symlink generation applies to both disks and partitions. Partition symlinks have a "-part$P" string appended to the name of the symlink of their parent disk. Note 2: Modern SCSI devices usually support one or more of the "reliable" identifiers a)-e) above. I expect that only very few old devices really need one of f)-i). Inform me if you find counter- examples. Note 3: ATA and USB devices have additional identifiers generated by the transport (/dev/disk/by-id/ata-* and /dev/disk/by-id/usb-*) which are unaffected by this change. These devices often don't expose proper SCSI IDs, but they actually don't need them because the ATA or USB identifiers are unique. Regards, Martin

7 27

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 31 Oct '23

31 Oct '23

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - sonic-pi: Fails to build Unless somebody is stepping up and submitting fixes, the listed package(s) are going to be removed from openSUSE:Factory. Kind regards, DimStar / Dominique Leuenberger <dimstar(a)opensuse.org>

1 0

[Announcement] support for systemd soft-reboot
by Thorsten Kukuk 31 Oct '23

31 Oct '23

Hi, systemd v254 introduced "soft-reboot" (https://manpages.opensuse.org/systemctl),which reboots the userland, but not the kernel or hardware. This allows a quick reboot after updates of e.g. dbus, glibc or openssl. With the latest snapshot, rebootmgr and os-update support this now, too. Means, if you use os-update for automatic updating your server and an update requires a reboot, but there is no new kernel or bootloader, the reboot will be done much quicker now. transactional-upate will get support for this next. The "zypp-boot-plugin" (https://manpages.opensuse.org/zypp-boot-plugin) looks at the packages which got installed or updated and decides according a config file, if: - a hard reboot is required (e.g. after update of the bootloader - kexec is enough (if only the kernel is updated) - a soft-reboot is sufficient - no reboot is necessary at all It's in the responsibility of the application triggering the reboot which of the method it used, zypp-boot-plugin only gives a hint. Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect, Future Technologies SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nuernberg, Germany Managing Director: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

1 0

openSUSE:Factory - Build fail notification
by DimStar / Dominique Leuenberger 30 Oct '23

30 Oct '23

Dear Package maintainers and hackers. Below package(s) in openSUSE:Factory have had problems for at least 4 weeks. We tried to send out notifications to the configured bugowner/maintainers of the package(s), but so far no fix has been submitted. This probably means that the maintainer/bugowner did not yet find the time to look into the matter and he/she would certainly appreciate help to get this sorted. - weblate: Fails to build - yuzu: Fails to build Unless somebody is stepping up and submitting fixes, the listed package(s) are going to be removed from openSUSE:Factory. Kind regards, DimStar / Dominique Leuenberger <dimstar(a)opensuse.org>

1 0

New Tumbleweed snapshot 20231029 released!
by Dominique Leuenberger 30 Oct '23

30 Oct '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: GraphicsMagick apache2-mod_php8 (8.2.11 -> 8.2.12) avahi avahi-glib2 glib2 (2.78.0 -> 2.78.1) gnome-settings-daemon gnome-software gvfs libsoup (3.4.3 -> 3.4.4) libstorage-ng (4.5.154 -> 4.5.155) mozilla-nss (3.93 -> 3.94) open-vm-tools p11-kit (0.25.0 -> 0.25.1) php8 (8.2.11 -> 8.2.12) vim (9.0.2043 -> 9.0.2078) virtualbox virtualbox-kmp xdg-desktop-portal (1.18.0 -> 1.18.1) xfconf (4.18.2 -> 4.18.1) === Details === ==== GraphicsMagick ==== Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config - Have libGraphicsMagick3-config require ghostscript-fonts-std (boo#1216604). ==== apache2-mod_php8 ==== Version update (8.2.11 -> 8.2.12) - version update to 8.2.12 * This is a bug fix release. https://www.php.net/ChangeLog-8.php#8.2.12 ==== avahi ==== Subpackages: avahi-lang libavahi-client3 libavahi-client3-32bit libavahi-common3 libavahi-common3-32bit libavahi-core7 - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). ==== avahi-glib2 ==== Subpackages: libavahi-glib1 libavahi-gobject0 libavahi-ui-gtk3-0 - Add avahi-CVE-2023-38473.patch: derive alternative host name from its unescaped version (bsc#1216419 CVE-2023-38473). ==== glib2 ==== Version update (2.78.0 -> 2.78.1) Subpackages: glib2-lang glib2-tools libgio-2_0-0 libglib-2_0-0 libgmodule-2_0-0 libgobject-2_0-0 libgthread-2_0-0 - Update to version 2.78.1: + Fix truncating files when `g_file_set_contents_full()` is called without `G_FILE_SET_CONTENTS_CONSISTENT` + Fix `-Dlibelf=disabled` on Linux + Bugs fixed: - NetworkManager 1.44.0 crashes repeatedly with glib 2.78.0 - gsubprocess-testprog.c: build error with cygwin (sys/ptrace.h: No such file or directory) - gio clears modification time in microseconds when setting with `set_modification_date_time` - Build of glib 2.78.0 ignores -Dlibelf=disabled - glib-2.78.0 fails at gio/tests/gsubprocess.p/gsubprocess.c.o - Segfault when creating GIO GPropertyAction without properties - `g_file_set_contents_full()` doesn't truncate the file (without `G_FILE_SET_CONTENTS_CONSISTENT`) - guniprop.c: Avoid creating (temporarily) out-of-bounds pointers - Fixes for integer cast warnings when targeting CHERI - Fix test_find_program on FreeBSD - gconstructor.h: Ensure [c|d]tor prototypes are present for MSVC - Fix gutils-user-database test on macOS - Add value annotation to G_TYPE_FUNDAMENTAL_MAX - meson: Fix Windows build with PCRE2 as sibling subproject - gconstructor.h: Ensure [c|d]tor prototypes are present for MSVC - glocalfileinfo: Preserve microseconds for access/modify times - Make sure the `GTask` is freed on a graceful disconnect - Buffer needs to be aligned correctly to receive linux_dirent64. - gtestutils.h: Fix warning with -Wsign-conversion caused by g_assert_cmpint - tests: Drop unnecessary include from gsubprocess-testprog.c - wakeup: do single read when using eventfd() - wakeup: Fix g_wakeup_acknowledge if signal comes inâ - Use g_task_return in task threads - build: Fix -Dlibelf=disabled on Linux - gfileutils: Add a missing ftruncate() call when writing files + Updated translations. - Drop 0005-gthreadedresolver-Fix-race.patch: Fixed upstream. ==== gnome-settings-daemon ==== Subpackages: gnome-settings-daemon-lang - Add 538816ff42f682fc4b541810ca107486abab9976.patch: smartcard: Steal error when propagating through GTask. ==== gnome-software ==== Subpackages: gnome-software-lang gnome-software-plugin-packagekit - Rebase gnome-software-disable-offline-update.patch(bsc#1216603). - Add gnome-software-plugin-opensuse-distro-upgrade.patch: plugins: add opensuse-distro-upgrade plugin(glgo#GNOME/gnome-software!1557). ==== gvfs ==== Subpackages: gvfs-backend-afc gvfs-backend-goa gvfs-backend-samba gvfs-backends gvfs-fuse gvfs-lang - Use older way than autopatch on SLE/Leap, which is not ready for the macro. - Rebase gvfs-nvvfs.patch. ==== libsoup ==== Version update (3.4.3 -> 3.4.4) Subpackages: libsoup-3_0-0 libsoup-lang typelib-1_0-Soup-3_0 - Update to version 3.4.4: + Improve HTTP/2 performance when a lot of buffering happens + Support building libnghttp2 as a subproject ==== libstorage-ng ==== Version update (4.5.154 -> 4.5.155) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#963 - extended testsuite - 4.5.155 ==== mozilla-nss ==== Version update (3.93 -> 3.94) Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools - update to NSS 3.94 * bmo#1853737 - Updated code and commit ID for HACL* * bmo#1840510 - update ACVP fuzzed test vector: refuzzed with current NSS * bmo#1827303 - Softoken C_ calls should use system FIPS setting to select NSC_ or FC_ variants * bmo#1774659 - NSS needs a database tool that can dump the low level representation of the database * bmo#1852179 - declare string literals using char in pkixnames_tests.cpp * bmo#1852179 - avoid implicit conversion for ByteString * bmo#1818766 - update rust version for acvp docker * bmo#1852011 - Moving the init function of the mpi_ints before clean-up in ec.c * bmo#1615555 - P-256 ECDH and ECDSA from HACL* * bmo#1840510 - Add ACVP test vectors to the repository * bmo#1849077 - Stop relying on std::basic_string<uint8_t> * bmo#1847845 - Transpose the PPC_ABI check from Makefile to gyp - rebased patches - added nss-fips-test.patch to fix broken test ==== open-vm-tools ==== Subpackages: libvmtools0 open-vm-tools-desktop - Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token signature bypass vulnerability. - Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file descriptor hijack vulnerability + Add patch: - CVE-2023-34058.patch - CVE-2023-34059.patch ==== p11-kit ==== Version update (0.25.0 -> 0.25.1) Subpackages: libp11-kit0 libp11-kit0-32bit p11-kit-tools - Update to 0.25.1: * fix probing of C_GetInterface [#535] * p11-kit: add command to list tokens [#581] * p11-kit: add command to list mechanisms supported by a token [#576] * p11-kit: add command to generate private-public keypair on a token [#551, #582] * p11-kit: add commands to import/export certificates and public keys into/from a token [#543, #549, #568, #588] * p11-kit: add commands to list and delete objects of a token [#533, #544, #571] * p11-kit: add --login option to login into a token with object and profile management commands [#587] * p11-kit: adjust behavior of PKCS#11 profile management commands [#558, #560, #583, #591] * p11-kit: print PKCS#11 URIs in list-modules [#532] * bug and build fixes [#528 #529, #534, #537, #540, #541, #545, [#547], #550, #557, #572, #575, #579, #585, #586, #590] * test fixes [#553, #580] * Remove patch fixed upstream: - d1d4b0ac316a27c739ff91e6c4153f1154e96e5a.patch ==== php8 ==== Version update (8.2.11 -> 8.2.12) Subpackages: php8-cli php8-ctype php8-dom php8-gd php8-gettext php8-iconv php8-mbstring php8-mysql php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - version update to 8.2.12 * This is a bug fix release. https://www.php.net/ChangeLog-8.php#8.2.12 ==== vim ==== Version update (9.0.2043 -> 9.0.2078) Subpackages: vim-data vim-data-common xxd - Update to version 9.0.2078 * several problems with type aliases * Vim9: No support for type aliases * TextChangedI may not always trigger * Completion menu may be wrong * don't echo empty lines (#13431) * typo in quickfix.c comments * update debian related runtime files (#13423) * Vim9: no nr2str conversion in list-unpack * objdump files not recognized * [security] disallow setting env in restricted mode * possible to escape bracketed paste mode with Ctrl-C * [security] overflow in :history * clarify bracketed paste mode * missing code formatting in if_pyth.txt * xxd: coloring was disabled on Cygwin * xxd: corrupting files when reversing bit dumps * EXPAND flag set for filetype option * cannot use buffer-number for errorformat * Fix typos in several documents (#13420) * pacman hooks are detected as conf filetype * Janet files are not recognised * not able to detect xkb filetypes * *.{gn,gni} files are not recognized * small updates to the documentation for varargs * Update ftplugin - comment motions (#13412) * outstanding exceptions may be skipped * tests: avoid error when no swap files exist * Vim9: no strict type checks for funcrefs varargs * do not use hard-coded match id (#13393) * no digraph for quadruple prime * Vim9: non-consistent error messages * win32: iscygpty needs update * Add new ftplugin (#13385) * zig filetype detection test wrong * win32: using deprecated wsock32 api * Vim9: wrong error for non-existing object var * Update Zig runtime files (#13388) * Vim9: crash with deferred function call and exception * Vim9: not recognizing qualified class vars for infix ops * python: uninitialized warning * perl: warning about inconsistent dll linkage * tests: checking for swap files takes time * Vim9: exceptions confuse defered functions * allow for overriding systemd ftplugin settings (#13373) ==== virtualbox ==== - Update file "fixes_for_leap.patch" to cover API change in Leap 15.6 kernel. ==== virtualbox-kmp ==== - Update file "fixes_for_leap.patch" to cover API change in Leap 15.6 kernel. ==== xdg-desktop-portal ==== Version update (1.18.0 -> 1.18.1) Subpackages: xdg-desktop-portal-lang - Update to version 1.18.1: + Communicate better when the Background portal kills an app. + Properly quote Flatpak command in the Background portal. + Improve documentation of the "cursor_mode" propery of the ScreenCast backend D-Bus interface. + Fix ScreenCast portal removing transient restore permissions too early. This fixes screen sharing dialogs on Chromium asking for the screen multiple times. + Only send the Closed session signal to the sender. + Add Meson options to disable building with Bubblewrap, and without the Flatpak portal documentation. Disabling Bubblewrap is highly discouraged, and only meant to be used on platforms that do not currently support it. By disabling Bubblewrap, bitmap validation happens without a sandbox, which is highly insecure since image parsing is a common source of exploits. Really, just do not disable Bubblewrap please. + Improve the manpage of portals.conf. + Various spelling fixes to the Document portal. + Add a new website! We don't have a fancy domain yet, but the website can be accessed at https://flatpak.github.io/xdg-desktop-portal/ + Improve pid mapping for host system apps. This should get rid of some rare, unnecessary warnings. + Adjust documentation of Global Shortcuts portal's timestamps to millisecond granularity. + Bump minimum Meson version to 0.58. ==== xfconf ==== Version update (4.18.2 -> 4.18.1) Subpackages: libxfconf-0-3 typelib-1_0-Xfconf-0 xfconf-lang

1 0

Re-stabilizing the order of /dev/sd* devices
by Martin Wilck 30 Oct '23

30 Oct '23

The discussion on the previous thread "SCSI device identification and SCSI symlink generation in sg3_utils 1.48" [1], the openSUSE Forum [2], bugzilla [3] has revealed that with one exception, the problems that users encountered had not been caused by the sg3_utils update, but by the almost simultaneous update of the TW kernel to 6.5.4, which changed scsi_mod and sd_mod from built-in to loadable modules. In the course of this discussion, the idea came up to stabilize the ordering of sd devices by loading sd_mod before any SCSI low level drivers, using a softdep. I have implemented this now in [4]. I would be grateful for testing this package on a variety of systems. I already tried a few, and saw no issues. Currently TW only. The expected effect is that the ordering of sd devices stabilizes again (if you test this, please undo manual workarounds that you may have applied so far). On systems with only NVMe hardware (e.g. laptops with M.2 SSDs) where multipath-tools is not installed (if you aren’t using dm-multipath, you can just uninstall it with “zypper rm multipath- tools”), an additional expected effect is that the system would come up without any SCSI drivers loaded (check /proc/modules). If an USB stick or some other SCSI device is added to such a system, SCSI modules should be loaded on demand, and the stick should be mounted as usual. Feedback very welcome. I plan to submit this to factory next week. Regards, Martin [1] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… [2] https://forums.opensuse.org/t/problem-with-disks-order-after-snapshot-20230… [3] https://bugzilla.suse.com/show_bug.cgi?id=1216070 [4] https://download.opensuse.org/repositories/home:/mwilck:/suse-module-tools/…

7 16

[opensuse-factory] reproducible builds status 2023-10
by Bernhard M. Wiedemann 30 Oct '23

30 Oct '23

Hi, This month I made some more nice patches after I went to review all remaining packages with major issues. I'm off to the rb-summit in Hamburg this week. The ghc-rpm-macros patch is still pending in the pipeline. Once that goes through, the number of packages with issues remaining could be as low as 126. https://github.com/rpm-software-management/rpm/issues/2343 still breaks bit-identical results for many packages. https://github.com/openSUSE/post-build-checks/pull/58 by Jan Zerebecki could finally allow to enable normalization of mtimes in Factory, but OTOH breaks build-compare / build-tree-pruning on OBS rebuilds of certain packages. Since my main test-build machine is on the move to Prague atm, I only ran builds over a limited set of packages with known past problems. https://rb.zq1.de/spec/glossar.txt explains the meaning of below values: total-packages: 14895 build-tried: 753 build-failed: 26 build-n-a: 1 build-succeeded: 727 build-official-failed+na: 76 build-compare-failed: 119 build-compare-succeeded: 608 bit-by-bit-identical: 280 not-bit-by-bit-identical: 446 recent SRs and patches: https://github.com/elastic/elasticsearch-py/issues/2320 FTBFS # https://github.com/kovidgoyal/kitty/pull/6685 sort, tar mtime https://github.com/libpinyin/libpinyin/issues/162 ASLR https://github.com/djcb/mu/pull/2569 date in copyright https://github.com/djcb/mu/issues/2570 unknown https://sourceforge.net/p/sbcl/mailman/sbcl-devel/thread/3ebdd95c-c498-462f… report timestamp+other # https://github.com/hyprwm/Hyprland/pull/3550 filesys (find/meson) https://git.enlightenment.org/enlightenment/efl/issues/41 edje_cc nondeterministic order # https://github.com/maros/MooseX-App/pull/71 kanku toolchain, date from perl-MooseX-App # https://github.com/apache/qpid-proton/pull/411 sort https://github.com/FFTW/fftw3/issues/337 random order https://bugzilla.opensuse.org/show_bug.cgi?id=1216293 fdo-client private keys # https://github.com/rakudo/rakudo/pull/5426 sort readdir https://github.com/rakudo/rakudo/issues/5427 unknown, toolchain # https://sourceforge.net/p/gimp-print/source/merge-requests/9/ gutenprint date # https://gitlab.com/CalcProgrammer1/OpenRGB/-/issues/3675 filesys+parallelism # https://gitlab.com/CalcProgrammer1/OpenRGB/-/merge_requests/2101 FTBFS # https://gitlab.com/CalcProgrammer1/OpenRGB/-/merge_requests/2103 corruption https://bugzilla.opensuse.org/show_bug.cgi?id=1216458 python-numpy random file names https://gitlab.com/qemu-project/SLOF/-/merge_requests/1 date https://github.com/mamedev/mame/pull/11651 order https://sourceforge.net/p/gsoap2/patches/185/ date, toolchain https://bugreports.qt.io/browse/PYSIDE-2508 python3-pyside2 order 1116036 mingw32-binutils date, toolchain 1116040 mingw64-binutils date, toolchain 1116208 erlang-retest embedded zip timestamp 1117743 python-pandas FTBFS 1117898 python-quantities date 1118130 spack cpu count 1118201 openblas cpu count => SR 1120798 1119260 xemacs-packages drop date 1119524 occt sort (not upstream) 1119553 mame order 1121011 qemu slof date+workaround parallelism-issue from sphinx

1 0

New Tumbleweed snapshot 20231028 released!
by Dominique Leuenberger 30 Oct '23

30 Oct '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: efivar grub2 gzip kernel-source (6.5.8 -> 6.5.9) libksba libstorage-ng (4.5.151 -> 4.5.154) libzypp (17.31.22 -> 17.31.23) nodejs20 open-iscsi openssl-3 (3.1.3 -> 3.1.4) openssl (3.1.3 -> 3.1.4) patterns-base suse-module-tools (16.0.36 -> 16.0.37) wtmpdb (0.9.2 -> 0.9.3) xfconf (4.18.1 -> 4.18.2) === Details === ==== efivar ==== - We donât mandoc at all after all (gh#rhboot/efivar#229 and gh#rhboot/efivar#253). ==== grub2 ==== Subpackages: grub2-i386-pc grub2-snapper-plugin grub2-systemd-sleep-plugin grub2-x86_64-efi grub2-x86_64-xen - Fix a potential error when appending multiple keys into the synthesized initrd * Fix-the-size-calculation-for-the-synthesized-initrd.patch - Fix Xen chainloding error of no matching file path found (bsc#1216081) * grub2-efi-chainload-harder.patch - Use grub-tpm2 token to unlock keyslots to make the unsealing process more efficient and secure. * 0001-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch ==== gzip ==== - Fix s390x build with 'gcc -Dalignas=_Alignas' bug#66709 ==== kernel-source ==== Version update (6.5.8 -> 6.5.9) - Linux 6.5.9 (bsc#1012628). - Bluetooth: hci_event: Ignore NULL link key (bsc#1012628). - Bluetooth: Reject connection with the device which has same BD_ADDR (bsc#1012628). - Bluetooth: Fix a refcnt underflow problem for hci_conn (bsc#1012628). - Bluetooth: vhci: Fix race when opening vhci device (bsc#1012628). - Bluetooth: hci_event: Fix coding style (bsc#1012628). - Bluetooth: avoid memcmp() out of bounds warning (bsc#1012628). - Bluetooth: hci_conn: Fix modifying handle while aborting (bsc#1012628). - ice: fix over-shifted variable (bsc#1012628). - ice: Fix safe mode when DDP is missing (bsc#1012628). - ice: reset first in crash dump kernels (bsc#1012628). - net/smc: return the right falback reason when prefix checks fail (bsc#1012628). - btrfs: fix stripe length calculation for non-zoned data chunk allocation (bsc#1012628). - nfc: nci: fix possible NULL pointer dereference in send_acknowledge() (bsc#1012628). - regmap: fix NULL deref on lookup (bsc#1012628). - KVM: x86: Mask LVTPC when handling a PMI (bsc#1012628). - x86/sev: Disable MMIO emulation from user mode (bsc#1012628). - x86/sev: Check IOBM for IOIO exceptions from user-space (bsc#1012628). - x86/sev: Check for user-space IOIO pointing to kernel space (bsc#1012628). - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (bsc#1012628). - KVM: x86/pmu: Truncate counter value to allowed width on write (bsc#1012628). - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (bsc#1012628). - x86: KVM: SVM: always update the x2avic msr interception (bsc#1012628). - x86: KVM: SVM: add support for Invalid IPI Vector interception (bsc#1012628). - x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested() (bsc#1012628). - audit,io_uring: io_uring openat triggers audit reference count underflow (bsc#1012628). - tcp: check mptcp-level constraints for backlog coalescing (bsc#1012628). - mptcp: more conservative check for zero probes (bsc#1012628). - selftests: mptcp: join: no RST when rm subflow/addr (bsc#1012628). - mm: slab: Do not create kmalloc caches smaller than arch_slab_minalign() (bsc#1012628). - fs/ntfs3: Fix OOB read in ntfs_init_from_boot (bsc#1012628). - fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() (bsc#1012628). - fs/ntfs3: fix panic about slab-out-of-bounds caused by ntfs_list_ea() (bsc#1012628). - fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super (bsc#1012628). - fs/ntfs3: fix deadlock in mark_as_free_ex (bsc#1012628). - Revert "net: wwan: iosm: enable runtime pm support for 7560" (bsc#1012628). - netfilter: nft_payload: fix wrong mac header matching (bsc#1012628). - io_uring: fix crash with IORING_SETUP_NO_MMAP and invalid SQ ring address (bsc#1012628). - nvmet-tcp: Fix a possible UAF in queue intialization setup (bsc#1012628). - drm/i915: Retry gtt fault when out of fence registers (bsc#1012628). - drm/mediatek: Correctly free sg_table in gem prime vmap (bsc#1012628). - drm/nouveau/disp: fix DP capable DSM connectors (bsc#1012628). - drm/edid: add 8 bpc quirk to the BenQ GW2765 (bsc#1012628). - ALSA: hda/realtek - Fixed ASUS platform headset Mic issue (bsc#1012628). - ALSA: hda/realtek: Add quirk for ASUS ROG GU603ZV (bsc#1012628). - ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq5xxx (bsc#1012628). - ASoC: codecs: wcd938x-sdw: fix use after free on driver unbind (bsc#1012628). - ASoC: codecs: wcd938x-sdw: fix runtime PM imbalance on probe errors (bsc#1012628). - ASoC: codecs: wcd938x: drop bogus bind error handling (bsc#1012628). - ASoC: codecs: wcd938x: fix unbind tear down order (bsc#1012628). - ASoC: codecs: wcd938x: fix resource leaks on bind errors (bsc#1012628). - ASoC: codecs: wcd938x: fix regulator leaks on probe errors (bsc#1012628). - ASoC: codecs: wcd938x: fix runtime PM imbalance on remove (bsc#1012628). - qed: fix LL2 RX buffer allocation (bsc#1012628). - xfrm: fix a data-race in xfrm_lookup_with_ifid() (bsc#1012628). - xfrm6: fix inet6_dev refcount underflow problem (bsc#1012628). - xfrm: fix a data-race in xfrm_gen_index() (bsc#1012628). - xfrm: interface: use DEV_STATS_INC() (bsc#1012628). - net: xfrm: skip policies marked as dead while reinserting policies (bsc#1012628). - fprobe: Fix to ensure the number of active retprobes is not zero (bsc#1012628). - wifi: cfg80211: use system_unbound_wq for wiphy work ... changelog too long, skipping 321 lines ... - commit 06d7c82 ==== libksba ==== - Do not pull revision info from GIT when autoconf is run. This removes the -unknown suffix after the version number. * Run autoreconf for the added patch and add the build dependecies on autoconf, automake and libtool. * Add libksba-nobetasuffix.patch [bsc#1216334] ==== libstorage-ng ==== Version update (4.5.151 -> 4.5.154) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#962 - improved error reporting in SystemCmd - 4.5.154 - merge gh#openSUSE/libstorage-ng#961 - added testcase - 4.5.153 - merge gh#openSUSE/libstorage-ng#960 - make more use of new SystemCmd interface - added const - 4.5.152 - merge gh#openSUSE/libstorage-ng#959 - removed unused function - merge gh#openSUSE/libstorage-ng#958 - make more use of new SystemCmd interface - prefer make_unique over new - fixed compound action generation for removing btrfs qgroup relations ==== libzypp ==== Version update (17.31.22 -> 17.31.23) - Stop using boost version 1 timer library (fixes #489, bsc#1215294) - version 17.31.23 (22) ==== nodejs20 ==== Subpackages: npm20 - fix_ci_tests.patch: adapt for openssl 3.1.4 ==== open-iscsi ==== Subpackages: libopeniscsiusr0 - Updated to latest upstream, which includes (bsc#1210514): * several fixes to harden iscsiuio, which updates its version number to 0.7.8.8, including: - logging now uses syslog - shutdown now waits for helper threads to complete - netlink socket cleanup * some minor bug fixes, some helping builds on musl This updates open-iscsi-SUSE-latest.diff.bz2 ==== openssl-3 ==== Version update (3.1.3 -> 3.1.4) Subpackages: libopenssl3 libopenssl3-32bit - Update to 3.1.4: * Fix incorrect key and IV resizing issues when calling EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() with OSSL_PARAM parameters that alter the key or IV length [bsc#1216163, CVE-2023-5363]. - Performance enhancements for cryptography from OpenSSL 3.2 [jsc#PED-5086, jsc#PED-3514] * Add patches: - openssl-ec-Use-static-linkage-on-nistp521-felem_-square-mul-.patch - openssl-ec-56-bit-Limb-Solinas-Strategy-for-secp384r1.patch - openssl-ec-powerpc64le-Add-asm-implementation-of-felem_-squa.patch - openssl-ecc-Remove-extraneous-parentheses-in-secp384r1.patch - openssl-powerpc-ecc-Fix-stack-allocation-secp384r1-asm.patch - openssl-Improve-performance-for-6x-unrolling-with-vpermxor-i.patch - FIPS: Add the FIPS_mode() compatibility macro and flag support. * Add patches: - openssl-Add-FIPS_mode-compatibility-macro.patch - openssl-Add-Kernel-FIPS-mode-flag-support.patch ==== openssl ==== Version update (3.1.3 -> 3.1.4) - Update to 3.1.4 ==== patterns-base ==== Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-transactional_base patterns-base-x11 patterns-base-x11_enhanced - Do not recommend yast stuff in x11 pattern. That's what the yast patterns are for ==== suse-module-tools ==== Version update (16.0.36 -> 16.0.37) Subpackages: suse-module-tools-scriptlets * weak-modules2: ignore INITRD_MODULES (jsc#PED-1915), obtain list of modules from dracut.conf.d instead ==== wtmpdb ==== Version update (0.9.2 -> 0.9.3) Subpackages: libwtmpdb0 - Update to version 0.9.3 - wtmpdb last: don't print date in the future if there is no db entry ==== xfconf ==== Version update (4.18.1 -> 4.18.2) Subpackages: libxfconf-0-3 typelib-1_0-Xfconf-0 xfconf-lang - Update to version 4.18.2 * Cache property-not-found responses in XfconfCache * Don't reset scheduled save timer on every write * xfconf-query: Sort channel list (-l or -m alone) * docs: Fix transfer type of xfconf_list_channels() * docs: Add clarification about bindings - Use lang_package as bnc#513786 has been closed as fixed almost 8 years ago.

1 0

Removal of /run/utmp and /var/log/wtmp
by Thorsten Kukuk 28 Oct '23

28 Oct '23

Hi, I wrote already about Y2038 and the problems with utmp and wtmp. Since we have already solutions active for some weeks, we will now do the next steps: We replaced /var/log/wtmp with wtmpdb some months ago. /usr/bin/last does not use /var/log/wtmp anymore since quite some time, too. So the next logical step will be, that we don't create /var/log/wtmp anymore. Existing files will not be deleted and many tools will still write into it, but new installations will not create it anymore. After this, we have to find the applications, which don't use the glibc interface and try to manage this file at their own. They could still create that file. The majority of known applications are using logind meanwhile instead of /run/utmp. The bug reports are all fixed meanwhile, so we will go the next step: disabling /run/utmp. A systemd with disabled utmp support will be submitted most likely next week, and then we will see how long it takes to get it through the stagings. There are still some open SRs which the package maintainers ignores since several weeks. This should not affect anybody, but if yes, please complain to the responsible package maintainers. If you know about an important application still reading (not writing) /run/utmp, please speak up now. Thanks, Thorsten -- Thorsten Kukuk, Distinguished Engineer, Senior Architect, Future Technologies SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nuernberg, Germany Managing Director: Ivo Totev, Andrew McDonald, Werner Knoblich (HRB 36809, AG Nürnberg)

8 17