May 2023 - openSUSE Factory - openSUSE Mailing Lists

New Tumbleweed snapshot 20230510 released!
by Dominique Leuenberger 11 May '23

11 May '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: at-spi2-core elfutils ethtool (6.2 -> 6.3) gupnp-av health-checker (1.7 -> 1.8) icewm (3.3.2 -> 3.3.4) libcap-ng libdmapsharing (3.9.11 -> 3.9.12) libxslt (1.1.37 -> 1.1.38) mozjs102 (102.10.0 -> 102.11.0) mutter (44.1 -> 44.1+2) ncurses (6.4.20230429 -> 6.4.20230506) patterns-base policycoreutils python-python-slugify shotwell (0.32.0 -> 0.32.1) transactional-update (4.1.5 -> 4.2.1) transmission vte wireless-regdb (20230213 -> 20230503) yast2-storage-ng (4.6.5 -> 4.6.8) yast2-vpn (4.6.0 -> 4.6.1) === Details === ==== at-spi2-core ==== Subpackages: at-spi2-core-lang libatk-1_0-0 libatk-bridge-2_0-0 libatspi0 typelib-1_0-Atk-1_0 typelib-1_0-Atspi-2_0 - Add or dbus-broker to existing dbus-1 Requires: we already pass dbus_broker=/usr/bin/dbus-broker-launch and default_bus=dbus-broker to meson during build. ==== elfutils ==== Subpackages: elfutils-lang libasm1 libdw1 libelf1 - Add _multibuild to define 2nd spec file as additional flavor. Eliminates the need for source package links in OBS. ==== ethtool ==== Version update (6.2 -> 6.3) Subpackages: ethtool-bash-completion - update to upstream release 6.3 * Feature: PLCA support (--[gs]et-plca-cfg, --get-plca-status) * Feature: MAC Merge layer support (--show-mm, --set-mm) * Feature: pass source of statistics for port stats * Feature: get/set rx push in ringparams (-g and -G) * Feature: coalesce tx aggregation parameters (-c and -C) * Feature: PSE and PD devices (--show-pse, --set-pse) * Fix: minor fixes of help text (--help) * Fix: fix build on systems with older system headers * Fix: fix netlink support when PLCA is not present (no option) * Fix: fixes for issues found with gcc13 -fanalyzer * Fix: fix return code in rxclass_rule_ins (-N) * Fix: more robust argc/argv handling ==== gupnp-av ==== Subpackages: libgupnp-av-1_0-3 - Add upstream patch fix: 767388bc.patch: build: Fix Requires: line of pkg-config file. ==== health-checker ==== Version update (1.7 -> 1.8) Subpackages: health-checker-plugins-MicroOS - Update to version 1.8 * Don't rely on t-u's good states in GRUB With the introduction of the "apply" command in transactional-update the snapshots don't require a reboot any more to be registered as a "good" snapshot. Due to [boo#1048088] the GRUB part of health-checker was using the t-u file as a workaround which cannot be done any more now, so store the last good snapshot path from a health-checker perspective independently now. ==== icewm ==== Version update (3.3.2 -> 3.3.4) Subpackages: icewm-config-upstream icewm-default icewm-lang icewm-lite - Update to 3.3.4: * Fix compile error for yximage.cc. * Deprecate XRRDisable. * Fix corrupted text if built without i18n for issue ice-wm/icewm#131. * When internationalization is disabled, unset LIBICONV. * Improve the quality of drawing gradients for the Imlib2 renderer. * Improve arrow navigation in the system dialog. * Let icesh also pick icewm internal and override redirect windows. * Improve the quality of drawing gradients for the GdkPixbuf renderer. * Cache workspace button backgrounds for faster redrawing. * Guard against workspace button gradient being undefined. * Cache toolbar button gradients to speedup drawing. Eliminate half of the button drawings on startup. * Let icesh report up to 1024 bytes of a property in "prop". * Support icesh "focusmodel" for client windows without a WM_HINTS property. * When managing a new client, postpone sending a Configure event until the final position is known, for issue #720. ==== libcap-ng ==== - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. ==== libdmapsharing ==== Version update (3.9.11 -> 3.9.12) - Update to version 3.9.12: + Initialize a value that might not be initialized by g_object_get + libdmapsharing/Makefile.am: - rename check target to check-local - remove dmap-enums.h from maintained_headers - avoid cyclic dependencies when building enums - simplify use of glib-mkenums after experimenting with FreeBSD - drop use of patsubst, which is not POSIX + Update GTK-Doc markup to include summaries + dmap-structure.c: replace g_memdup, which glib2 replaced with g_memdup2 + Replace deprecated portions of autotools files ==== libxslt ==== Version update (1.1.37 -> 1.1.38) Subpackages: libexslt0 libxslt-tools libxslt1 - Removed patch 0009-Make-generate-id-deterministic.patch as it's already fixed upstream. - Update to version 1.1.38: * Major changes: - About 40 memory errors in code paths handling malloc failures have been fixed. - While these issues shouldn't impact security, this improves robustness under memory pressure. - The result of generate-id() is now deterministic across multiple transformations fixing many issues with reproducible builds. - Most of the test suite has been ported to C. * Bug fixes: - Fix memory errors in code handling malloc failures - imports: Fix import/include cycle check - xsltlocale: Fix xsltNewLocale on macOS - Make xsl:sort thread-safe - Make generate-id() deterministic * Improvements - Stop using xmlStringCurrentChar - attributes.h needs to include xsltInternals.h (David Kilzer) - transform: Avoid null deref on documents without root node - numbers: Fix floating point overflows - date: Fix integer overflow in exsltDateFormatDuration - numbers: Fix harmless integer sign change - date: Add more overflow checks to formatting code (David Kilzer) - date: Fix rounding to make Windows tests pass - date: Rewrite duration and seconds formatting - xsltlocale: Make API platform-independent - Also accept application/xslt+xml media type in stylesheet PIs - warnings: Fix strict prototypes warning - xsltEvalUserParams() and xsltQuoteUserParams() are susceptible to integer overflow when iterating through const char** array (David Kilzer) - xslt: Return NULL stylesheet on attribute set errors - xsltproc: Fix unused variable warning - xslt: Remove declaration for old libxml2 - Fix various compiler warnings - Fix compiler warnings in xsltGenerateIdFunction - Disable Python bindings for debugger - Don't declare disabled functions - Migrate from PyEval_ to PyObject_ ==== mozjs102 ==== Version update (102.10.0 -> 102.11.0) - Update to version 102.11.0: + Various security fixes. + CVE-2023-32205: Browser prompts could have been obscured by popups + CVE-2023-32206: Crash in RLBox Expat driver + CVE-2023-32207: Potential permissions request bypass via clickjacking + CVE-2023-32211: Content process crash due to invalid wasm code + CVE-2023-32212: Potential spoof due to obscured address bar + CVE-2023-32213: Potential memory corruption in FileReader::DoReadData() + CVE-2023-32214: Potential DoS via exposed protocol handlers + CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11 ==== mutter ==== Version update (44.1 -> 44.1+2) Subpackages: mutter-lang - Update to version 44.1+2: + screen-cast/src: Never dequeue pw_buffer's we refuse to record to. + frames: Disable XDND support on the frame window. ==== ncurses ==== Version update (6.4.20230429 -> 6.4.20230506) Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen - Add ncurses patch 20230506 > build-fixes related to configure-options and/or platform: + fix for --enable-fvisibility + fix for unusual values of --with-rel-version + fix for unusual values of --with-abi-version + fix for --disable-tcap-names + fix for termcap in nc_access.h (report by Werner Fink). - Delete patch ncurses-6.4-makeuseof_secure_open.dif as now upstream ==== patterns-base ==== Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-transactional_base patterns-base-x11 patterns-base-x11_enhanced - base: Add wtmpdb as Y2038 safe wtmp replacement ==== policycoreutils ==== Subpackages: policycoreutils-lang policycoreutils-python-utils python3-policycoreutils - Add python-wheel build dependency to build correctly with latest python-pip version. ==== python-python-slugify ==== - add sle15_python_module_pythons ==== shotwell ==== Version update (0.32.0 -> 0.32.1) Subpackages: shotwell-lang - Update to version 0.32.1: + Fix version display in about dialog when not building from git. + Fix settings schema migration when source is using obsolete keys. + Fix setting slideshow duration settings. + Make facedetect helper somewhat more robust if opencv calls fail. + Explicitly handle BigTIFF. - Add desktop-file-utils BuildRequires: New dependency. - Add check section: Run meson_test and manual validate of desktop files and appdata. ==== transactional-update ==== Version update (4.1.5 -> 4.2.1) Subpackages: dracut-transactional-update libtukit4 transactional-update-zypp-config tukit tukitd - Version 4.2.1 - Implement "apply" command to switch into new snapshot directly [jsc#PED-3912] - Use new snapper functionality to set default snapshot - this makes it possible to execute hooks as requested in [poo#127160], [gh#openSUSE/transactional-update#85] and [gh#openSUSE/transactional-update#105]. - Don't hardcode GRUB2 [gh#openSUSE/transactional-update#100] / [poo#127154] - Fix cleanup handler - Fix unmounting temporary mounts - Prevent loosing track of snapshots in certain rollback scenarios - these would not be marked for deletion otherwise - Document "notify" reboot method - Minimal required snapper version is 0.8.10 now, for the new snapper functionality there is a backwards compatibility layer. - Conflict with health-checker < 1.8 - the "good" snapshot detection of GRUB cannot rely on transactional-update any more due to the new apply command - Depend on usrmerge for apply command ==== transmission ==== Subpackages: transmission-common transmission-gtk transmission-gtk-lang - Fix transmission-daemon missing /var/lib/transmission ==== vte ==== Subpackages: libvte-2_91-0 typelib-1_0-Vte-2_91 vte-lang - Add 24547fb3.patch: widget: Don't consume right clicks on gtk4. ==== wireless-regdb ==== Version update (20230213 -> 20230503) - Update to version 20230503: * wireless-regdb: update regulatory database based on preceding changes * wireless-regdb: Update regulatory rules for Hong Kong (HK) * wireless-regdb: update regulatory rules for India (IN) * wireless-regdb: Update regulatory rules for Russia (RU). Remove DFS requirement. * Update regulatory info for Russia (RU) on 6GHz ==== yast2-storage-ng ==== Version update (4.6.5 -> 4.6.8) - Allow to pass commit callbacks to inst_prepdisk client. - Needed for Agama (gh#openSUSE/agama/558). - 4.6.8 - GuidedProposal adapted to support assigning volumes to specific devices when volumes_allocate_mode is :auto (useful for Agama). - Guided Setup: display a hint for disks with sensible data transports like FCoE or NVMe/oF (bsc#1209588). - 4.6.7 - AutoYaST: correctly import legacy values for parity_algorithm. - Partitioner: when creating an MD RAID, do not ask for the chunk side when it makes no sense. Eg. RAID1 (bsc#1205172). - 4.6.6 ==== yast2-vpn ==== Version update (4.6.0 -> 4.6.1) - Fixed an issue where yast2-vpn module breaks when strongswan is updated to version >= 5.8.0 (boo#1176735) - 4.6.1

1 0

New Tumbleweed snapshot 20230509 released!
by Dominique Leuenberger 10 May '23

10 May '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaFirefox alsa (1.2.8 -> 1.2.9) alsa-ucm-conf (1.2.8 -> 1.2.9) alsa-utils (1.2.8 -> 1.2.9) harfbuzz (7.1.0 -> 7.2.0) libavif libgexiv2 (0.14.0 -> 0.14.1) liblc3 (1.0.2 -> 1.0.3) libsndfile libvorbis open-vm-tools openconnect (9.01 -> 9.10) python-Babel (2.11.0 -> 2.12.1) python-argcomplete (2.0.0 -> 3.0.8) python-certifi (2022.12.7 -> 2023.5.7) python-charset-normalizer python-click python-configobj (5.0.6 -> 5.0.8) python-distro python-httpx (0.23.3 -> 0.24.0) python-importlib-metadata (6.3.0 -> 6.6.0) python-importlib-resources (5.10.2 -> 5.12.0) python-lxml python-msgpack python-pyasn1 (0.4.8 -> 0.5.0) python-pyasn1-modules (0.2.8 -> 0.3.0) python-requests-toolbelt (0.9.1 -> 1.0.0) python-rich (12.6.0 -> 13.3.5) python-simplejson (3.18.1 -> 3.19.1) python-six python-zope.interface (5.5.2 -> 6.0) strace (6.2 -> 6.3) virtualbox virtualbox-kmp xen (4.17.0_06 -> 4.17.1_02) yast2-network (4.6.1 -> 4.6.2) yast2-trans (84.87.20230428.0cbac11ad7 -> 84.87.20230507.125aa699e6) === Details === ==== MozillaFirefox ==== Subpackages: MozillaFirefox-translations-common - Fix i586 build by reducing debug info to -g1. (boo#1210168) ==== alsa ==== Version update (1.2.8 -> 1.2.9) Subpackages: libasound2 libatopology2 - Update to version 1.2.9: * Versioned symbol updates * Various fixes for building on *BSD and Android * Fixes and enhancements of auto silencing and playback drain * Add SND_CTL_EINTR open mode at PCM * Avoid endless loop in snd_pcm_sw_params_default() * Fixes in PCM rate, route/softvol plugins * Fixes in topology API parser, cleanups * Enhancements in latency test program * Minor code cleanup and memory leak fixes in UCM API * emu10k1 config cleanup For details, see: https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-lib ==== alsa-ucm-conf ==== Version update (1.2.8 -> 1.2.9) - Update to version 1.2.9: various profile updates for USB-audio, SOF and others. For details, see: https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-ucm-conf ==== alsa-utils ==== Version update (1.2.8 -> 1.2.9) - Update to alsa-utils 1.2.9: BSD build fix, and various updates for alsactl, amidi, axfer, alsa-info.sh, alsaloop, alsatplg, alsaucm, aplay, abat. For details, see: https://www.alsa-project.org/wiki/Changes_v1.2.8_v1.2.9#alsa-utils ==== harfbuzz ==== Version update (7.1.0 -> 7.2.0) Subpackages: libharfbuzz-gobject0 libharfbuzz-icu0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - update to version 7.2.0: + Improve Tifinagh glyph positioning + Fix 4.2.0 regression in applying across syllables in syllabic scripts. + Add flag to avoid glyph substitution closure during subsetting, and the corresponding â--no-layout-closureâ option to âhb-subsetâ command line tool. + Support instancing COLRv1 table + Optimize handling of âgvarâ table + Various subsetter bug fixes and improvements, documentation ==== libavif ==== - Add BuildRequires pkgconfig(libwebp) to enable libsharpyuv ==== libgexiv2 ==== Version update (0.14.0 -> 0.14.1) - Update to version 0.14.1: + Clean-up python support + Drop python2 support + Add option for building tests + Only run python tests when python is enabled + Fix get_gps_info() return data with unset altitude + Fix generate_xmp_packet() ignoring its parameters + Fix gexiv2-tool to call initialize() - Use ldconfig_scriptlets macro. ==== liblc3 ==== Version update (1.0.2 -> 1.0.3) - Update to version 1.0.3: + Enhancements: - C++ interface - Remove 1 multiply by samples (when not using upsampling/downsampling feature) - Declare liblc3 as dependency in meson (helps using as meson subproject) - Make encoder/decoder states relocatable + Improve portability: - Enable -pedantic compilation flag - Remove VLA to support compilation with MSVC - Remove use of deprecated int numpy attribute + Fixes: Fix undefined behaviors on integer shifting ==== libsndfile ==== - Add _multibuild to define 2nd spec file as additional flavor. Eliminates the need for source package links in OBS. ==== libvorbis ==== Subpackages: libvorbis0 libvorbisenc2 libvorbisfile3 - Add _multibuild to define 2nd spec file as additional flavor. Eliminates the need for source package links in OBS. ==== open-vm-tools ==== Subpackages: libvmtools0 open-vm-tools-desktop - Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch, 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch [boo#1210695] - Reduce generated script size by coalescing multiple %service_* ==== openconnect ==== Version update (9.01 -> 9.10) Subpackages: libopenconnect5 openconnect-bash-completion openconnect-lang - Update to release 9.10: * Fix external browser authentication with KDE plasma-nm < 5.26. * Always redirect stdout to stderr when spawning external browser. * Increase default queue length to 32 packets. * Fix receiving multiple packets in one TLS frame, and single packets split across multiple TLS frames, for Array. * Handle idiosyncratic variation in search domain separators for all protocols * Support region selection field for Pulse authentication * Support modified configuration packet from Pulse 9.1R16 servers * Allow hidden form fields to be populated or converted to text fields on the command line * Support yet another strange way of encoding challenge-based 2FA for GlobalProtect * Add --sni option (and corresponding C and Java API functions) to allow domain-fronting connections in censored/filtered network environments * Parrot a GlobalProtect server's software version, if present, as the client version (!333) * Fix NULL pointer dereference that has left Android builds broken since v8.20 (!389). * Fix Fortinet authentication bug where repeated SVPNCOOKIE causes segfaults (#514, !418). * Support F5 VPNs which encode authentication forms only in JSON, not in HTML. * Support simultaneous IPv6 and Legacy IP ("dual-stack") for Fortinet . * Support "FTM-push" token mode for Fortinet VPNs . * Send IPv6-compatible version string in Pulse IF/T session establishment * Add --no-external-auth option to not advertise external-browser authentication * Many small improvements in server response parsing, and better logging messages and documentation. ==== python-Babel ==== Version update (2.11.0 -> 2.12.1) - Add fix-tests.patch to make tests work with EST/EDT swap, gh#python-babel/babel#988 - Update to 2.12.1: * Include py.typed file in wheels by @AlexWaygood in #975 * Become 2.12.1 by @akx in #976 - 2.12.0: * docs(changes): Fix broken issue links by @DenverCoder1 in #922 * Update docs build configuration by @akx in #924 * feat: Adds Format.compact_decimal utility by @DenverCoder1 in #921 * Remove vestigial Python 2 long check by @akx in #925 * feat: Support for short compact currency formats by @DenverCoder1 in #926 * Drop support for EOL Python 3.6 by @akx in #919 * Cast number to Decimal in _get_compact_format by @DenverCoder1 in #930 * Replace %/.format/concatenation with f-strings where feasible by @akx in #927 * ci: Fix testing dependencies by @DenverCoder1 in #936 * javascript extract improvements by @johanneswilm in #939 * Fix compact singular formats and patterns with no numbers by @DenverCoder1 in #932 * fix typo by @uniontech-lilinjie in #941 * Enable pre-commit by @akx in #943 * Added inline type annotations to Babel by @DenverCoder1 in #934 * Implement zoneinfo support and make pytz optional by @ds-cbo in #940 * Unify datetime imports by @akx in #945 * Minor cleanups by @akx in #948 * Renovate formatting in test_checkers and test_frontend by @akx in #950 * Add ruff for linting by @akx in #949 * Upgrade to CLDR 42 by @akx in #951 * Update test dependencies (tox v4) by @DenverCoder1 in #953 * Remove redundant tests for babel.support by @akx in #954 * Support for formatting NaN, Infinity by @DenverCoder1 in #955 * Clean up babel.localtime by @akx in #952 * Use standard library UTC by @akx in #957 * Fix unbound exc in babel.dates by @akx in #959 * Finally remove get_next_timezone_transition by @akx in #958 * More fixes and modernization by @akx in #960 * Keep @modifiers when parsing locales by @madduck in #947 * Add two new options in cmdline.rst docs by @m-aciek in #963 * Numbers and core type fixes by @DenverCoder1 in #966 * Use lru_cache where suitable by @akx in #967 * Fix two issues with fuzzy matching by @jeanas in #970 * Renovate CI tools a bit by @akx in #972 * Tox: also test with pytz installed by @akx in #974 * Become 2.12.0 by @akx in #973 ==== python-argcomplete ==== Version update (2.0.0 -> 3.0.8) - Add without_zsh.patch - Delete skip_tcsh_tests.patch - Delete without_fish.patch - Update to 3.0.8: * Test suite shell wrapper: Accept OSError on exit - 3.0.7: * Test suite: Use general regex to cut zsh reset ANSI sequences (#425) - 3.0.6: * Allow importlib-metadata 6.x; skip test failures on Python 3.7 (#420, #424) * Note completers can return iterables of strings, not just lists (#422) * Documentation and test improvements - 3.0.5: * Call _default as fallback in zsh global completion hook * Begin support for mapping-emitting completers - 3.0.4: * activate-global-python-argcomplete: do not overwrite existing dotfile in user directory * Add NOTICE file * Establish long term name for split_line as argcomplete.lexers.split_line - 3.0.3: * Re-add split_line to API (#419) - 3.0.2: * Fix zsh default completion issues - 3.0.1: * Fix zsh autoload issues - 3.0.0: * Fully support zsh. Argcomplete now supports completion descriptions and global completion in zsh. * Clean up top level namespace. * Documentation and test improvements. - 2.1.2: * Test infrastructure improvements * Indicate that there is no support commitment for fish and tcsh shells - 2.1.1: * Documentation and test improvements - 2.1.0: * Remove scripts for contrib-supported shells from global namespace - 2.0.6: * setup.py: exclude test.* subpackages from find_packages (#406) * Support PowerShell (#405) * CI updates - 2.0.5: * Revert "Support powershell (#392)" ==== python-certifi ==== Version update (2022.12.7 -> 2023.5.7) - update to 2023.5.7: Added certs: * CN=BJCA Global Root CA1 O=BEIJING CERTIFICATE AUTHORITY ==== python-charset-normalizer ==== - add sle15_python_module_pythons (jsc#PED-68) ==== python-click ==== - add fix-tests.patch to fix tests with new versions of python packages ==== python-configobj ==== Version update (5.0.6 -> 5.0.8) - update to 5.0.8: * 5.0.7 originally did this work, but 5.0.8 fixes a regression * update testing to validate against python version 2.7 and 3.5-3.11 * update broken links / non-existent services and references ==== python-distro ==== - add sle15_python_module_pythons ==== python-httpx ==== Version update (0.23.3 -> 0.24.0) - update to 0.24.0: * The logging behaviour has been changed to be more in-line with other standard Python logging usages. We no longer have a custom `TRACE` log level, and we no longer use the `HTTPX_LOG_LEVEL` environment variable to auto-configure logging. We now have a significant amount of `DEBUG` logging available at the network level. Full documentation is available at https://www.python-httpx.org/logging/ (#2547, encode/httpcore#648) * The `Response.iter_lines()` method now matches the stdlib behaviour and does not include the newline characters. It also resolves a performance issue. (#2423) * Query parameter encoding switches from using + for spaces and %2F for forward slash, to instead using %20 for spaces and treating forward slash as a safe, unescaped character. This differs from `requests`, but is in line with browser behavior in Chrome, Safari, and Firefox. Both options are RFC valid. (#2543) * NetRC authentication is no longer automatically handled, but is instead supported by an explicit `httpx.NetRCAuth()` authentication class. See the documentation at https://www.python-httpx.org/advanced/#netrc-support (#2525) * The `rfc3986` dependancy has been removed. (#2252) ==== python-importlib-metadata ==== Version update (6.3.0 -> 6.6.0) - update to 6.6.0: * Expanded type annotations. * python/cpython#103661: Removed excess error suppression in ``_read_files_egginfo_installed`` and fixed path handling on Windows. * #422: Removed ABC metaclass from ``Distribution`` and instead deprecated construction of ``Distribution`` objects without concrete methods. * Updated docs with tweaks from upstream CPython. * Consolidated some behaviors in tests around ``_path``. * Added type annotation for ``Distribution.read_text``. ==== python-importlib-resources ==== Version update (5.10.2 -> 5.12.0) - add sle15_python_module_pythons - update to 5.12.0: * importlib_resources (backport) now gives precedence to built-in readers (file system, zip, namespace packages), providing forward-compatibility of behaviors like ``MultiplexedPath``. * #280: Fixed one more ``EncodingWarning`` in test suite. * #265: ``MultiplexedPath`` now honors multiple subdirectories in ``iterdir`` and ``joinpath``. * Packaging refresh, including fixing EncodingWarnings and some tests cleanup. ==== python-lxml ==== - Add patch skip-test-under-libxml2-2.11.1.patch: * Skip a test if using libxml2 >= 2.11.1 ==== python-msgpack ==== - add sle15_python_module_pythons ==== python-pyasn1 ==== Version update (0.4.8 -> 0.5.0) - update to 0.5.0: * Change `RealEncoder.supportIndefLenMode` type to a boolean * Fix CI for py39 test environment * Replace all snmplabs.com links * Use correct SPDX identifier for the license * Re-add ``tagMap`` and ``typeMap`` module level attributes to all encoder and decoder modules. They are aliases for ``TAG_MAP`` and ``TYPE_MAP`` * Restore API for passing for ``tagMap`` and ``typeMap`` arguments to ``Encoder`` and ``Decoder`` classes by name and position, * Re-add ``tagMap`` and ``typeMap`` module level attributes to all encoder and decoder modules. They are aliases for ``TAG_MAP`` and ``TYPE_MAP`` * Restore API for passing for ``tagMap`` and ``typeMap`` arguments to ``Encoder`` and ``Decoder`` classes by name and position, * Make BER/CER/DER decoders streaming and suspendible ==== python-pyasn1-modules ==== Version update (0.2.8 -> 0.3.0) - update to 0.3.0: * Added support for Python 3.8, 3.9, 3.10, 3.11 * Removed support for EOL Pythons 2.4, 2.5, 2.6, 3.2, 3.3, 3.4, 3.5 * Added support for PyPy 3.7, 3.8, 3.9 * Modernized packaging and testing. pyasn1-modules now uses ``setup.cfg``, ``pyproject.toml``, * PyPI package ownership for `pyasn1` and `pyasn1-module` has been transfered to *Christian Heimes* and *Simon Pichugin* in * The upstream repositories for `pyasn1` and `pyasn1-modules` are now in the GitHub organization https://github.com/pyasn1/. * Added tox runner with a handful of basic jobs * Add RFC3125 providing Electronic Signature Policies * Add RFC5126 providing CMS Advanced Electronic Signatures * Improve test routines for RFC5126 * Add RFC4387 providing Certificate Store Access via HTTP * Changed assertion in unit tests from Python built-in to `unittest` provided * Add RFC8692 providing Algorithm Identifiers for RSASSA-PSS and ECDSA Using SHAKEs * Add RFC5753 providing CMS Elliptic Curve Cryptography Algorithms * Add RFC3820 providing Proxy Certificates * Add RFC3370 providing Cryptographic Message Syntax (CMS) Algorithms * Add RFC3537 providing HMAC Key Wrapping * Add RFC3739 providing Qualified Certificates * Add RFC2876 providing KEA and SKIPJACK for CMS * Add RFC3058 providing IDEA Encryption Algorithm for CMS * Add RFC3657 providing Camellia Encryption Algorithm for CMS * Add RFC4010 providing SEED Encryption Algorithm for CMS * Add RFC4357 providing Additional Cryptographic Algorithms for * Add RFC4490 providing GOST 28147-89, GOST R 34.11-94, GOST R 34.10-94, and GOST R 34.10-2001 Algorithms for CMS * Add RFC4491 providing GOST R 34.10-94, GOST R 34.10-2001, and GOST R 34.11-94 Algorithms for certificates and CRLs * Add RFC8696 providing using Pre-Shared Key (PSK) in the CMS * Add RFC5639 providing identifiers for the Brainpool curves in Elliptic Curve Cryptography * Add RFC5697 providing Other Certificates Extension * Add RFC4683 providing Subject Identification Method (SIM) * Add RFC4476 providing Attribute Certificate Policies Extension * Add RFC5636 providing Traceable Anonymous Certificate * Add RFC5752 providing Multiple Signatures attribute for CMS * Add RFC5275 providing CMS Symmetric Key Management and Distribution * Add RFC8702 providing SHAKE One-way Hash Functions in the CMS * Add RFC8708 providing HSS/LMS Hash-based Signature Algorithm for CMS * Advance copyright statement to year 2020 * Add RFC8769 providing CBOR and CBOR Sequence content types for CMS ==== python-requests-toolbelt ==== Version update (0.9.1 -> 1.0.0) - Upgrade to 1.0.0: - Breaking Changes - Removed Google App Engine support to allow using urllib3 2.0 - New Features - Add support for preparing requests in BaseUrlSession - Fixed Bugs - Ensured the test suite no longer reaches the Internet - Fix urllib3 warning to only emit on X509Adapter usage - Fixing missing newline in dump utility - Miscellaneous - Added explicit support for Python 3.11 - Remove upstreamed patches: - fix-tests.patch - remove_mock.patch - requests-toolbelt-pr246-collections.abc.patch - Add 356-add-missing-casette-files.patch which adds missing casette test files (gh#requests/toolbelt!356). ==== python-rich ==== Version update (12.6.0 -> 13.3.5) - update to 13.3.5: * Fixed italic indent guides in SVG output * Fixed for `is_terminal` ignoring FORCE_COLOR https://github.com/Textualize/rich/pull/2923 * Added Style.clear_meta_and_links * Reversed `pre` and `code` tags in base HTML format * Fix syntax error when building with nuitka * Fixed pretty printing of empty dataclass * Use `Console(stderr=True)` in `rich.traceback.install` to support io redirection. * Fixes superfluous spaces in html output * Fixed duplicate output in Jupyter * Filter ANSI character-encoding-change codes in `Text.from_ansi` parser * Fixes traceback failing when a frame filename is unreadable * Fix for live update rendering console markup * `rich.progress.track()` will now show the elapsed time after finishing the task * Fixed truecolor to eight bit color conversion * Fixed failing tests due to Pygments dependency * Relaxed ipywidgets * v13.2.0 replaces the unmaintained `commonmark` library with `markdown-it-py`. This new parser has a lot more capabilities and will allow us to implement a number of additional Markdown features in the future. * Switch Markdown parsing from commonmark to markdown-it-py * Fixed wrong filenames in Jupyter tracebacks * Added locals_hide_dunder and locals_hide_sunder to Tracebacks, to hide double underscore and single underscore * Tracebacks will now hide double underscore names from locals by default. Set `locals_hide_dunder=False` to restore previous behaviour. * Fixed issue with Segment.split_cells for mixed single and double cell widths * Some relatively minor fixes and improvements. The most significant update (and the reason for the major version bump) is that Rich has dropped Python3.6 support. * Reversed `pre` and `code` tags in base HTML format * Improved detection of `attrs` library, that isn't confused by the presence of the `attr` library. * Fixed issue with `locals_max_length` parameter not being respected in Traceback * Handling of broken `fileno` made more robust. Fixes * Fixed missing `fileno` on FileProxy * Bumped minimum Python version to 3.7 * Pretty-printing of "tagged" `__repr__` results is now greedy when matching tags * `progress.track` now supports deriving total from `__length_hint__` * Add type annotation for key_separator of pretty.Node ==== python-simplejson ==== Version update (3.18.1 -> 3.19.1) - update to 3.19.1: * This release contains security hardening measures based on recommendations by a security audit sponsored by OSTIF and conducted by X41 D-Sec GmbH. Several of these measures include changing defaults to be more strict, by default simplejson will now only consume and produce compliant JSON, but the flags still exist for any backwards compatibility needs. No high priority issues were discovered, the reference count leak is thought to be unreachable since the digits of the float are checked before PyOS_string_to_double is called. * Fix invalid handling of unicode escape sequences in the pure Python implementation of the decoder (SJ-PT-23-01) * Fix missing reference count decrease if PyOS_string_to_double raises an exception in Python 2.x; was probably unreachable (SJ- PT-23-02) * Backport the integer string length limitation from Python 3.11 to limit quadratic number parsing (SJ-PT-23-03) * Fix inconsistencies with error messages between the C and Python implementations (SJ-PT-23-100) * Remove unused unichr import from encoder (SJ-PT-23-101) * Remove unused namedtuple_as_object and tuple_as_array arguments from simplejson.load (SJ-PT-23-102) * Remove vestigial _one_shot code from iterencode (SJ- PT-23-103) * Change default of allow_nan from True to False and add allow_nan to decoder (SJ-PT-23-107) * Test the sdist to prevent future regressions * Fix regression in sdist archive ==== python-six ==== - Switch documentation to be within the main package. - add sle15_python_module_pythons (jsc#PED-68) ==== python-zope.interface ==== Version update (5.5.2 -> 6.0) - update to 6.0: * Build Linux binary wheels for Python 3.11. * Drop support for Python 2.7, 3.5, 3.6. * Fix test deprecation warning on Python 3.11. * Add preliminary support for Python 3.12 as of 3.12a5. * Drop: * + `zope.interface.implements` * + `zope.interface.implementsOnly` * + `zope.interface.classProvides` ==== strace ==== Version update (6.2 -> 6.3) - Update to strace 6.3 * Implemented --trace-fds=set option for filtering only the syscalls that operate on the specified set of file descriptors. * Implemented --decode-fds=signalfd option for decoding of signal masks associated with signalfd file descriptors. * Implemented --syscall-limit option to automatically detach tracees after capturing the specified number of syscalls. * Implemented --argv0 option to set argv[0] of the command being executed. * Implemented decoding of PR_GET_MDWE and PR_SET_MDWE operations of prctl syscall. * Implemented decoding of IP_LOCAL_PORT_RANGE socket option. * Implemented decoding of IFLA_BRPORT_MCAST_N_GROUPS, IFLA_BRPORT_MCAST_MAX_GROUPS, IFLA_GSO_IPV4_MAX_SIZE, IFLA_GRO_IPV4_MAX_SIZE, and TCA_EXT_WARN_MSG netlink attributes. * Updated lists of F_SEAL_*, IFLA_*, IORING_*, MFD_*, NFT_*, TCA_*, and V4L2_PIX_FMT_* constants. * Updated lists of ioctl commands from Linux 6.3. * Fixed --status filtering when -c option is in use. ==== virtualbox ==== - Update fix_7.0.6_locking_problems.patch for Vagrent/virtualbox startup problems boo#1209727 ==== virtualbox-kmp ==== - Update fix_7.0.6_locking_problems.patch for Vagrent/virtualbox startup problems boo#1209727 ==== xen ==== Version update (4.17.0_06 -> 4.17.1_02) Subpackages: xen-libs xen-tools xen-tools-domU - bsc#1210570 - gcc-13 realloc use-after-free analysis error 64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch - bsc#1209237 - xen-syms doesn't contain debug-info 643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch 643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch 6447a8fd-x86-EFI-permit-crash-dump-analysis.patch - Update to Xen 4.17.1 bug fix release (bsc#1027519) xen-4.17.1-testing-src.tar.bz2 * No upstream changelog found in sources or webpage - Dropped patches contained in new tarball 63a03b73-VMX-VMExit-based-BusLock-detection.patch 63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch 63a03bce-VMX-Notify-VMExit.patch 63a03e28-x86-high-freq-TSC-overflow.patch 63c05478-VMX-calculate-model-specific-LBRs-once.patch 63c05478-VMX-support-CPUs-without-model-specific-LBR.patch 63d24e91-tools-xenstore-revert-simplify-loop-handling.patch 63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch 63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch 63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch 63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch 63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch 640f3035-x86-altp2m-help-gcc13.patch 641041e8-VT-d-constrain-IGD-check.patch 64104238-bunzip-gcc13.patch 6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch 64199e0c-x86-shadow-account-for-log-dirty-mode.patch 64199e0d-x86-HVM-bound-number-of-pca-regions.patch 64199e0e-x86-HVM-serialize-pca-list-manipulation.patch 64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch libxl.fix-guest-kexec-skip-cpuid-policy.patch xsa430.patch - bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging arbitrary pointer dereference (XSA-430) xsa430.patch - Not building the shim is correctly handled by --disable-pvshim Drop disable-building-pv-shim.patch ==== yast2-network ==== Version update (4.6.1 -> 4.6.2) - Fix summary crash when there is no interface available (bsc#1209589, bsc#1211161). - 4.6.2 ==== yast2-trans ==== Version update (84.87.20230428.0cbac11ad7 -> 84.87.20230507.125aa699e6) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sr yast2-trans-sv yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20230507.125aa699e6: * Translated using Weblate (Czech) * Translated using Weblate (Czech) * Translated using Weblate (Czech) * Translated using Weblate (Czech) * Translated using Weblate (Czech) * Translated using Weblate (Japanese) * Translated using Weblate (Slovak) * Translated using Weblate (Dutch) * New POT for text domain 'storage'. * New POT for text domain 'network'. * Translated using Weblate (Macedonian) * Translated using Weblate (Macedonian) * Translated using Weblate (Macedonian) * Translated using Weblate (Spanish)

1 0

openSUSE Release Engineering meeting 10.05.2023 (next meeting will be on 31st May)
by Lubos Kocman 10 May '23

10 May '23

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting The meeting is hosted here https://meet.opensuse.org/ReleaseEngineeringMeeting MEETINGS ON MAY 17th and 24th WILL BE CANCELLED DUE TO SUSE LABS and OSC2023, SEE YOU IN PERSON AND THEN AGAIN ONLINE ON 31st MAY. ## Attendees Guillaume, bittin, DimStar, lkocman, wengel, rbrown, dirk ## Leap Leap 15.5 IPRQ submitted Leap 15.5 Security audit requested for GM (will be handled by same person as SLES review). docs/i18n Need to revisit https://github.com/openSUSE/desktop-file-translations release-notes publishing setup (onging discussion with Lukasz, and Frank S.) We're done on the release-notes side, next step is to "locally" rebuild the doc-o-o and sync it to community-o-o. Funny enough the actual release notes are hosted on pinot-o-o. We do have a plan with it in https://progress.opensuse.org/issues/128699 (marked as private and I can't change it). The current RN is hosted here (will not be listed on doc-o-o until GA) https://doc.opensuse.org/release-notes/x86_64/openSUSE/Leap/15.5 openh264-repo 4k key setup 15.4 image respin based on QU2 - TBD ## openSUSE Tumbleweed openSUSE:Factory build fail stats: 79 failed 11 unresolvable (one week ago: 65 / 18) https://tinyurl.com/ysy4nnnz * KDE Plasma 5.27.5 incoming * Linux kernel 6.3 has been shipped. Some lockdown (secureboot enabled only loading signed modules) was enabled premature (even though it is correct); revert of this config is staged and should reach TW by end of the week. (loading unsigned kernel modules contradicts the concept of secureboot) * Staging:C: openssl 3.1 incoming , Progress tracked on https://bugzilla.opensuse.org/show_bug.cgi?id=1209430 * systemd maintainer submitted preset handling macros with file triggers; no direct need to change spec files (the old macros are defined to %nil, so don't break) * 2k key formally being revoked from TW setup - the openh264 repo needs to be republished first ## Richard (MicroOS) No news besides the MicroOS Desktop Plasma/KDE is still in desperate need of help else could be at risk of being dropped (again) https://microos.opensuse.org/blog/2023-04-02-state-of-microOS-Desktop-Plasm… User reports suggest MicroOS Desktop KDE has broken, and with no one to maintain it I'm not expecting it to be fixed any time soon https://www.reddit.com/r/openSUSE/comments/135hm38/unable_to_perform_upgrad… https://www.reddit.com/r/openSUSE/comments/135na8x/managed_to_brick_my_micr… Update: 10 May: Folk on the factory list rightly point out the above examples may not be actual KDE problems, but the core issue is that with no maintainer we have no one even triaging/investigating such reports, which is not a sustainable way to offer software. No new maintainer has stepped up, so we continue closer to dropping the KDE Flavour of MicroOS Desktop. ## Richard (ALP Architecture) The general direction seems to be towards building a Leap-like product (Desktops, not immutable, etc) based on ALP (and Tumbleweed?) Sources The biggest challenges facing this plan all revolve around having sufficient contributions, as (compared to Leap) this concept will need a lot more work as will have less already done by SUSE Has been some very good discussions around key problem areas, such as the Installer where either Agama will need a lot of work/rethinking of how we offer different flavours, or with YaST where volunteers will be needed to take care of things the former YaST team don't have capacity for (they're busy enough with Agama+YaSTinSLE+YaSTinTW) Have made a general call for volunteers, currently under a dozen, whereas Lubos would point out previous Leap releases had a 'core team' of about 19, so still some room to go. It's bit more, if we count artwork && i18n. Max would definitely handle the most "community software updates" from a number perspective. I did some numbers in the past based on changelog && sr (to answer MgE's "who is the community?" question. I think I had 50 various people across all Leap releases until 15.3 Next steps will be reaching out to the volunteers so far and finding ways of getting them to all talk together and work towards answering the burning issues regarding openSUSE's ALP scope, architecture, design, before we start actually bootstrapping stuff. https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… ## Max Leap 15.5 * https://doc.opensuse.org/release-notes/x86_64/openSUSE/Leap/15.5/release-no… has presented, updated release-notes path in the Leap product file * Per PSP implementation notes, besides python3.6 that we should have only one python3 to be released, for Leap 15.5 it should be python3.11, removed python39 and python310 from the ftp-tree * Fixed kitty and yt-dlp for BuildRequires/Requires python39 or python310, they use python311 now * Started from Build481.1 a weird bug has appeared on Leap < 15.1 migration to 15.5, tty6 console fails to selected after upgrade to 15.5 - https://bugzilla.suse.com/show_bug.cgi?id=1211219 , Leap <15.1 version are EOL though, couldn't say whether this worth to be a ship- stopper * Update 15.5 server list to d.o.o on github https://github.com/openSUSE/download.o.o/pull/43, but it needs https://opensuse-community.org/openSUSE_Leap_155_Community_Additional.xml as https://progress.opensuse.org/issues/113959 described, I'm not sure who is maintain that file. Note that, with/without this change should not affect product since we use $relesever in the these files I'll reach out to commnity additional folks, we might want to add openh264 there too (would help existing installations). ## Guillaume - Arm Tumbleweed: * Rolling * Boot problem on RPi4 with u-boot 2023.04 is gone. Not sure what fixed it, though - https://bugzilla.opensuse.org/show_bug.cgi?id=1210949 Leap: * 15.5 aarch64: no blocker * 15.5 armv7: AdrianS: clock issue in VMs on armv7, host clock seems to be set correctly, kvm issue? ALP: * shim not signed by MS (at least for aarch64, not sure for x86_64) - jsc#ARM-100 WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Team is ok to publish it on Microsoft store anyway, but this would require some testing in openQA which is currently not possible (due to technical issues and MS licensing issues) https://progress.opensuse.org/issues/126083. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Team is ok to publish it on Microsoft store anyway, but this would require some testing in openQA which is currently not possible (due to technical issues and MS licensing issues) https://progress.opensuse.org/issues/126083. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server ## Sarah - s390x Not available Tumbleweed * release is rolling Leap: * working * waitingSubmissisions with fixes for gtkd and gnu-cobol: https://build.opensuse.org/request/show/1072852 https://build.opensuse.org/request/show/1078385 Nothing really new ## Doug Not available * Google Summer of Code * Bonding/onboaring period * oSC23 * 150 registered * openSUSE.Asia Summit * Two proposals sent * India: https://groups.google.com/g/opensuseasia-summit/c/t5SVxRVwJHI/m/HTA5YL1kAQA… & China: https://groups.google.com/g/opensuseasia-summit/c/qQY33UxwBTk * Leap 15.5 release annoucement being translated * Could use more langagues to translate * https://en.opensuse.org/Release_announcement_15.5 * Still need future storage * AlmaLinux, openQA, OMP article * Waiting on merge https://github.com/os-autoinst/os-autoinst/issues/2312 * AI topics (static) ## Dirk Further poking on the CDN / Fastly contract Submitted a few dozen python package updates * also todo announce tumbleweed maintainer policy draft currently working on testing those in a private staging test project * Started ALP:RISCV:* builds in the new build setup Biggest speedup can be observed by switching zlib to zlib-ng, so looked into fixing the build failures caused by switching to zlibo-ng- compat ## Wolfgang (Package Hub), Scott Bahling Installation of KDE Plasma 5 currently broken, missing dependency libswscale5_9, plan is to release it on FCS to subpackages for x86_64 (is already there for the other archs) lkocman: will try to talk to Rado, otherwise this will cause quite some extra work. ## Maintenance team (Marcus or Maurizio (m4u)) Leap Micro 5.4 maint-setup is active. Leap 15.5 setup is done, SLE export channel is still being refreshed occasionaly. Key rotation: openSUSE:Leap:15.5 is done, Backports are bit more challenging because of SLES. Wolfgang: we're injecting the key. Marcus we probably want to do only Backports 15 SP5 for now. Backports 15SP5 key change, we have labs next week, so nobody would even notice a full rebuild :-) Wolfgang: do we add or replace key completely? The key will be kept on users Marcus was aiming for replacing the key, it would appear as added on existing systems. Marcus is working also on the SLES side, the update of package with the new key was released last week, it's just not activated yet, but it will be already trusted by Leap 15.5 systems. Leap 15.4 is working Leap Micro 5.3 is working Leap Micro 5.4 testing is now passing as well Leap 16.0 - we should revisit the update/sle repo as the current setup not exactly mirror friendly. Solutions could be dropping not so popular architectures or split repositories per architecture. securebootkey for SLES was rotated, it should be autotrusted and not noticeable. This will be in QU3, QU2 is already done. lkocman: 15.3 EOL could lead to stopping our physical Source DVD effort, as it seems we will not produce. As this was the last release which you could still get on a physical media. Lkocman: anything against decomissioning it? Not a single valid request since I've joined SUSE. We did receive only requests for binary install media which are not subject to ^. We do not plan to offer this for any new releases. ## Adrian - OBS No update ## Open Floor https://bugzilla.suse.com/show_bug.cgi?id=1211022 Fedora enforcing stricter RPM GPG signatures mls is following upstream, this entry will be removed on next meeting

1 0

Build 20230505 Kernel LockDown
by Joe Salmeri 10 May '23

10 May '23

I just updated from 20230413 to 20230505 and after rebooting vmware kernel modules ( after recompiling for kernel 6.3.1-1 ) would not load. modprobe: ERROR: could not insert 'vmmon': Key was rejected by service modprobe: ERROR: could not insert 'vmnet': Key was rejected by service I have not see an announcement regarding kernel lockdown being enabled again, but those messages seem to indicate it was. Where should I be looking for that kind of announcement ? From my notes when kernel lockdown was previously enabled I had: cat /sys/kernel/security/lockdown but from the return value it does not appear to be locked down ??? [none] integrity confidentiality How to check if secondary mok keys are allowed zcat /proc/config.gz | grep CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY but from that return value it also appears that the kernel does not have support for user signed keys # CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY is not set Since the mobprobe error seems to indicate that the modules could not be loaded because they were not signed, I went ahead Verified secure boot is enabled via mokutil --sb-state which confirms "SecureBoot enabled" Compiled the vmware modules ( just to double check that there were not compile issues ) Generated a signing key Signed both modules modutil --import *.der file reboot Perform MOK Management / Enroll MOK / Enroll the key I added reboot mokutil --list-enrolled now shows my key is enrolled systemctl start vmware now starts the vmware service and vmware is working. So it definitely appears that kernel lockdown was enabled ( how did I miss that announcement ??? ) but why do both of these seem to indicate that it is not ??? cat /sys/kernel/security/lockdown zcat /proc/config.gz | grep CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY What's different this time when it was enabled ??? -- Regards, Joe

4 9

New Tumbleweed snapshot 20230508 released!
by Dominique Leuenberger 09 May '23

09 May '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: chromaprint freerdp gdm (44.0 -> 44.1) gtk4 gupnp gupnp-av libbytesize (2.7 -> 2.8) libssh (0.10.4 -> 0.10.5) ruby-common systemd (253.3 -> 253.4) xf86-video-dummy (0.4.0 -> 0.4.1) xf86-video-i128 (1.4.0 -> 1.4.1) === Details === ==== chromaprint ==== - Drop 8ccad69.patch and 82781d02.patch, and add back pkgconfig(libavresample) BuildRequires. Also limit package to build against ffmpeg-4 and older. ==== freerdp ==== Subpackages: libfreerdp2-2 libwinpr2-2 - Add Update_h264_to_use_new_FFMPEG_API.patch: Update h264 to use new FFMPEG API. ==== gdm ==== Version update (44.0 -> 44.1) Subpackages: gdm-lang gdm-schema gdmflexiserver libgdm1 typelib-1_0-Gdm-1_0 - Update to version 44.1: + Fix blown assertion log spew. + Updated translations. ==== gtk4 ==== Subpackages: gtk4-lang gtk4-schema gtk4-tools libgtk-4-1 typelib-1_0-Gtk-4_0 - Add 966a2350.patch: css: Don't transition to currentColor. Transition to the color that is in use instead. Fixes crashes because currentColor is not an RGBA color and therefor could not be queried later (glgo#GNOME/gtk#5798). ==== gupnp ==== - Add upstream patch: 80e68995.patch: all: Drop xmlRecoverMemory. Use xmlReadMemory, also use NONET flat. ==== gupnp-av ==== Subpackages: libgupnp-av-1_0-3 - Add patch "gupnp-av-libxml2.11-support.patch": Use xmlReadMemory instead of xmlRecoverMemory, as it's been deprecated in libxml2 2.11.0. - Use autosetup and ldconfig_scriptlets macros. ==== libbytesize ==== Version update (2.7 -> 2.8) Subpackages: libbytesize-lang libbytesize1 - Drop lang sub-package recommendation. It's not needed anymore now that lang packages provide package supplementation instead. - Make bscalc sub-package 'noarch', since it doesn't contain any binaries, only a Python script and its manpage. - update to 2.8: * Added translation using Weblate * configure.ac: Remove invalid email address for bug reports * spec: Bump release to 21 for Packit daily builds * spec: Fix source archive URL * Make use of error optional * Replace C++ style comments with C style * Various docstring fixes * docs: Remove information about Python 2 support * Remove unused test dependencies variables from Makefile * Do not hardcode pylint executable name in Makefile ==== libssh ==== Version update (0.10.4 -> 0.10.5) Subpackages: libssh-config libssh4 - update to 0.10.5: * Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm guessing * Fix CVE-2023-2283: a possible authorization bypass in pki_verify_data_signature under low-memory conditions. * Fix several memory leaks in GSSAPI handling code * Escape braces in ProxyCommand created from ProxyJump options for zsh compatibility. * Fix pkg-config path relocation for MinGW * Improve doxygen documentation * Fix build with cygwin due to the glob support * Do not enqueue outgoing packets after sending SSH2_MSG_NEWKEYS * Add support for SSH_SUPPRESS_DEPRECATED * Avoid functions declarations without prototype to build with clang 15 * Fix spelling issues * Avoid expanding KnownHosts, ProxyCommands and IdentityFiles repetitively * Add support sk-* keys through configuration * Improve checking for Argp library * Log information about received extensions * Correctly handle rekey with delayed compression * Move the EC keys handling to OpenSSL 3.0 API * Record peer disconnect message * Avoid deadlock when write buffering occurs and we call poll recursively to flush the output buffer * Disable preauthentication compression by default * Add accidentally removed default compile flags * Solve incorrect parsing of ProxyCommand option ==== ruby-common ==== - cleanup irp code - unify error handling using the exit_with_error function - ensure we add generated files - checkin the newly created package - move new tools into a subpackage ruby-packaging-helpers to avoid dependency to /usr/bin/ruby - Add 2 new utilities - irp aka initialize ruby package does exactly what the name says. does all the work to initialize a new ruby package - bundler-dumpdeps: script to generate BR/Requires based on a Gemfile. ==== systemd ==== Version update (253.3 -> 253.4) Subpackages: libsystemd0 libsystemd0-32bit libudev1 systemd-32bit systemd-container systemd-coredump systemd-lang udev - Rather than having one script per fix, use a single script (or "fixlet") per (sub) package that contains all the fixups relative to a (sub) package. This has the advantage to limit the number of scripts but more importantly it will ease the sharing of the spec file between TW and SLE. We should also be able to compare the fixlets of two distros even if the spec files have diverged. Note that all the fixups are run just once now. - Make use of %_systemd_util_dir in the spec file. - Rename the SUSE specific scripts used to fix up the system where systemd is installed on. Also rename the directory where these scripts are stored. - kbd-model-map.legacy: drop entry for 'ruwin_alt-UTF-8' as yast doesn't rely on it anymore, see https://github.com/yast/yast-country/pull/307 - Import commit 25aec157888f7aa9a36726962fcbbf2c74ead440 (merge of v253.4) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/3ce9610975b5239a21c0c886cb893bb… - Import commit 3ce9610975b5239a21c0c886cb893bb172966de7 3ce9610975 test: dont use anchor char '$' to match a part of a string 03ede3eaa2 locale: when no xvariant match select the entry with an empty xvariant f08017efd5 locale: convert generated vconsole keymap to x11 layout automatically e8cf56459b localed-util: make use of strdupcspn() 821c684440 test: use kbd-mode-map we ship in TEST-73-LOCALE ==== xf86-video-dummy ==== Version update (0.4.0 -> 0.4.1) - Update to version 0.4.1 * Avoid leaking pixel memory if DUMMYScreenInit fails * gitlab CI: stop requiring Signed-off-by in commits * List argument types in dummyRec->CreateWindow() function declaration ==== xf86-video-i128 ==== Version update (1.4.0 -> 1.4.1) - Update to version 1.4.1 * Fix spelling/wording issues * gitlab CI: add a basic build test * gitlab CI: stop requiring Signed-off-by in commits * Handle -Wunused-const-variable warnings * Handle -Wdiscarded-qualifiers warnings * Handle -Wempty-body warnings

1 0

/boot/grub2/x86_64-efi subvolume
by Joe Salmeri 08 May '23

08 May '23

On a default TW installation, /boot/grub2/x86_64-efi is a subvolume. This documentation talks about the default subvolumes. https://en.opensuse.org/SDB:BTRFS I also found this link which describes how to replicate the subvolume layout that TW uses https://rootco.de/2018-01-19-opensuse-btrfs-subvolumes/ I am trying to replicate that subvolume layout with several other linux distros which I need to use but after installation and on first boot it errors because it cannot find 'normal.mod' because for some reason the /boot/grub2/x86-64 subvolume is not mounted. It's not a configuration issue because if I boot a live DVD and mount snapshot 1 and chroot into it and do mount -a then /boot/grub2/x86-64 is mounted properly. If I switch /boot/grub2/x86_64-efi from a subvolume to a folder in snapshot 1, then the distros boot fine. Apparently others have tried to replicate the TW subvolume layout with other distros and ran into the same issue. Here's one such discussion where someone was trying to use the TW subvolume layout with Endeavour OS and ran into the issue with /boot/grub2/x86_64-efi being a subvolume. https://forum.endeavouros.com/t/cannot-boot-the-system-after-installation-c… If you scroll down to the FREEDOM user post you will see where they describe how they are trying to use the subvolume layout like TW uses. Does TW have some special patch or hook with grub that allows it to mount the /boot/grub2/x86_64-efi subvolume or is there something configuration wise that TW is doing which allows this that seems to be missing from other distros? How does TW get that subvolume mounted during boot ? Thanks! -- Regards, Joe

3 10

openSUSE ALP: Use the forums to Call for Volunteers?
by Fritz Hudnut 08 May '23

08 May '23

>> Hence my view that the only way forward is really finding a core group > willing to architect and get building this new distro from the ground > up, rather than just assuming we can continue as we used to in the past. > -- > Richard Brown > Distributions Architect et al: Not sure how many folks are both on this list and on the forums, I personally haven't checked this out to see; but there are a lot of very smart folks who are posting assistance on the forums that might be a valuable pool of help. Like in all things in life, if you ask people, "Will you volunteer for a lot of work for no compensation," very few respond. But, if a problem is posted on the forums, people are apparently willing to help out with "solving the puzzle" of it. Or, has a post been made with the proposal for the new ALPine distro and asking for experienced insight into it??? Possibly a slightly larger group could be found?? F AKA "Team Towel Guy" . . . go team, have a clean towel . . . .

3 2

Source service mode restrictions
by Jim Fehlig 08 May '23

08 May '23

Hello, I recently moved maintenance of one of my packages to a more git-centric workflow. In doing so I changed the source service mode from manual to trylocal (or another mode that allows server-side runs). All was good until I tried to submit the package to Factory https://build.opensuse.org/request/show/1077094 The request was declined because "Services are only allowed if their mode is one of localonly, disabled, buildtime, manual". Is it possible to remove this restriction, or include modes that support server-side runs? Are server-side modes not permitted because the sources could change after filing the request? I suppose there's another reason since the same could happen even with the permitted modes. Thanks! Jim

3 5

New Tumbleweed snapshot 20230507 released!
by Dominique Leuenberger 08 May '23

08 May '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: lapack libselinux libselinux-bindings xz (5.4.2 -> 5.4.3) yast2-bootloader (4.6.0 -> 4.6.1) zlib === Details === ==== lapack ==== Subpackages: libblas3 libcblas3 liblapack3 - Add _multibuild to define 2nd spec file as additional flavor. Eliminates the need for source package links in OBS. ==== libselinux ==== Subpackages: libselinux1 libselinux1-32bit selinux-tools - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Add -ffat-lto-objects to CFLAGS to prevent rpmlint errors because of LTO - Enable LTO as it works fine now. ==== libselinux-bindings ==== - Add python-wheel build dependency to build correctly with latest python-pip version. - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Enable LTO as it works fine now. ==== xz ==== Version update (5.4.2 -> 5.4.3) Subpackages: liblzma5 liblzma5-32bit xz-lang - Update to version 5.4.3: * Build system fixes * Translation updates: Croatian - update signing key ==== yast2-bootloader ==== Version update (4.6.0 -> 4.6.1) - Do not overwrite user selection during migration (bsc#1210811) - 4.6.1 ==== zlib ==== Subpackages: libminizip1 libz1 libz1-32bit - Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005 bsc1210593.patch

1 0

New Tumbleweed snapshot 20230506 released!
by Dominique Leuenberger 07 May '23

07 May '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apache2-mod_php8 (8.1.18 -> 8.2.5) apparmor dav1d file libapparmor libdb-4_8 librsvg php8 (8.1.18 -> 8.2.5) salt (3005.1 -> 3006.0) sysvinit texlive yast2-network (4.6.0 -> 4.6.1) === Details === ==== apache2-mod_php8 ==== Version update (8.1.18 -> 8.2.5) - version update to 8.2.5 * Readonly classes * Disjunctive Normal Form (DNF) Types * Allow null, false, and true as stand-alone types * New "Random" extension * Constants in traits * Deprecate dynamic properties * for details, see https://www.php.net/releases/8.2/en.php https://www.php.net/manual/en/migration82.php - modified patches % php-ar-flags.patch (refreshed) % php-build-reproducible-phar.patch (refreshed) % php-ini.patch (refreshed) - deleted patches - php-crypt-tests.patch (not needed) - modified sources % php8.keyring ==== apparmor ==== Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. ==== dav1d ==== - Use ldconfig_scriptlets macro, minor spec clean-up. ==== file ==== Subpackages: file-magic libmagic1 - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. ==== libapparmor ==== - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. ==== libdb-4_8 ==== Subpackages: db48-utils - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. ==== librsvg ==== Subpackages: gdk-pixbuf-loader-rsvg librsvg-2-2 rsvg-thumbnailer typelib-1_0-Rsvg-2_0 - Tune _constraints for the various architectures. ==== php8 ==== Version update (8.1.18 -> 8.2.5) Subpackages: php8-cli php8-ctype php8-dom php8-gd php8-gettext php8-iconv php8-mbstring php8-mysql php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - version update to 8.2.5 * Readonly classes * Disjunctive Normal Form (DNF) Types * Allow null, false, and true as stand-alone types * New "Random" extension * Constants in traits * Deprecate dynamic properties * for details, see https://www.php.net/releases/8.2/en.php https://www.php.net/manual/en/migration82.php - modified patches % php-ar-flags.patch (refreshed) % php-build-reproducible-phar.patch (refreshed) % php-ini.patch (refreshed) - deleted patches - php-crypt-tests.patch (not needed) - modified sources % php8.keyring ==== salt ==== Version update (3005.1 -> 3006.0) Subpackages: python3-salt salt-master salt-minion salt-transactional-update - Update to Salt release version 3006.0 (jsc#PED-3139) * See release notes: https://docs.saltproject.io/en/latest/topics/releases/3006.0.html - Add python3-looseversion as new dependency for salt - Add python3-packaging as new dependency for salt - Drop conflictive patch dicarded from upstream - Fix SLS rendering error when Jinja macros are used - Fix version detection and avoid building and testing failures - Added: * fix-version-detection-and-avoid-building-and-testing.patch * make-sure-the-file-client-is-destroyed-upon-used.patch - Modified: * 3005.1-implement-zypper-removeptf-573.patch * activate-all-beacons-sources-config-pillar-grains.patch * add-custom-suse-capabilities-as-grains.patch * add-environment-variable-to-know-if-yum-is-invoked-f.patch * add-migrated-state-and-gpg-key-management-functions-.patch * add-publish_batch-to-clearfuncs-exposed-methods.patch * add-salt-ssh-support-with-venv-salt-minion-3004-493.patch * add-sleep-on-exception-handling-on-minion-connection.patch * add-standalone-configuration-file-for-enabling-packa.patch * add-support-for-gpgautoimport-539.patch * allow-vendor-change-option-with-zypper.patch * async-batch-implementation.patch * avoid-excessive-syslogging-by-watchdog-cronjob-58.patch * bsc-1176024-fix-file-directory-user-and-group-owners.patch * change-the-delimeters-to-prevent-possible-tracebacks.patch * control-the-collection-of-lvm-grains-via-config.patch * debian-info_installed-compatibility-50453.patch * dnfnotify-pkgset-plugin-implementation-3002.2-450.patch * do-not-load-pip-state-if-there-is-no-3rd-party-depen.patch * don-t-use-shell-sbin-nologin-in-requisites.patch * drop-serial-from-event.unpack-in-cli.batch_async.patch * early-feature-support-config.patch * enable-passing-a-unix_socket-for-mysql-returners-bsc.patch * enhance-openscap-module-add-xccdf_eval-call-386.patch * fix-bsc-1065792.patch * fix-for-suse-expanded-support-detection.patch * fix-issue-2068-test.patch * fix-missing-minion-returns-in-batch-mode-360.patch * fix-ownership-of-salt-thin-directory-when-using-the-.patch * fix-regression-with-depending-client.ssh-on-psutil-b.patch * fix-salt-ssh-opts-poisoning-bsc-1197637-3004-501.patch * fix-salt.utils.stringutils.to_str-calls-to-make-it-w.patch * fix-the-regression-for-yumnotify-plugin-456.patch * fix-traceback.print_exc-calls-for-test_pip_state-432.patch * fixes-for-python-3.10-502.patch * include-aliases-in-the-fqdns-grains.patch * info_installed-works-without-status-attr-now.patch * let-salt-ssh-use-platform-python-binary-in-rhel8-191.patch * make-aptpkg.list_repos-compatible-on-enabled-disable.patch * make-setup.py-script-to-not-require-setuptools-9.1.patch * pass-the-context-to-pillar-ext-modules.patch * prevent-affection-of-ssh.opts-with-lazyloader-bsc-11.patch * prevent-pkg-plugins-errors-on-missing-cookie-path-bs.patch * prevent-shell-injection-via-pre_flight_script_args-4.patch * read-repo-info-without-using-interpolation-bsc-11356.patch * restore-default-behaviour-of-pkg-list-return.patch * return-the-expected-powerpc-os-arch-bsc-1117995.patch * revert-fixing-a-use-case-when-multiple-inotify-beaco.patch * run-salt-api-as-user-salt-bsc-1064520.patch * run-salt-master-as-dedicated-salt-user.patch * save-log-to-logfile-with-docker.build.patch * skip-package-names-without-colon-bsc-1208691-578.patch * switch-firewalld-state-to-use-change_interface.patch * temporary-fix-extend-the-whitelist-of-allowed-comman.patch * update-target-fix-for-salt-ssh-to-process-targets-li.patch * use-adler32-algorithm-to-compute-string-checksums.patch * use-rlock-to-avoid-deadlocks-in-salt-ssh.patch * use-salt-bundle-in-dockermod.patch * x509-fixes-111.patch * zypperpkg-ignore-retcode-104-for-search-bsc-1176697-.patch - Removed: * add-amazon-ec2-detection-for-virtual-grains-bsc-1195.patch * add-support-for-name-pkgs-and-diff_attr-parameters-t.patch * align-amazon-ec2-nitro-grains-with-upstream-pr-bsc-1.patch * allow-entrypoint-compatibility-for-importlib-metadat.patch * clarify-pkg.installed-pkg_verify-documentation.patch * detect-module.run-syntax.patch * fix-salt.states.file.managed-for-follow_symlinks-tru.patch * fix-state.apply-in-test-mode-with-file-state-module-.patch * fix-test_ipc-unit-tests.patch * fixes-pkg.version_cmp-on-openeuler-systems-and-a-few.patch * fopen-workaround-bad-buffering-for-binary-mode-563.patch * ignore-erros-on-reading-license-files-with-dpkg_lowp.patch * ignore-extend-declarations-from-excluded-sls-files.patch * ignore-non-utf8-characters-while-reading-files-with-.patch * include-stdout-in-error-message-for-zypperpkg-559.patch * make-pass-renderer-configurable-other-fixes-532.patch * make-sure-saltcacheloader-use-correct-fileclient-519.patch * normalize-package-names-once-with-pkg.installed-remo.patch * retry-if-rpm-lock-is-temporarily-unavailable-547.patch * set-default-target-for-pip-from-venv_pip_target-envi.patch * state.apply-don-t-check-for-cached-pillar-errors.patch * state.orchestrate_single-does-not-pass-pillar-none-4.patch ==== sysvinit ==== - split package from powerd. powerd patches that were never part of sysvinit but need to be mentioned to pass the bot checks: * powerd-2.0.2-getaddrinfo.patch * powerd-2.0.2.dif ==== texlive ==== Subpackages: libkpathsea6 libsynctex2 - Link target of /usr/bin/rungs changed suffix from tlu to lua (boo#1211116) ==== yast2-network ==== Version update (4.6.0 -> 4.6.1) - Display information about firmware configured interfaces and forbid editing them (bsc#1209589) - 4.6.1

1 0