July 2023 - openSUSE Factory - openSUSE Mailing Lists

It is recommended to use fcitx5 to replace fcitx4
by Poplar.at.twilight 19 Jul '23

19 Jul '23

Hi, I am Poplar. I recommend replacing the fcitx package of the openSUSE ISO file with fcitx5. The development of fcitx(fcitx4) has been discontinued. Replacing the old fcitx version allows new openSUSE users to experience the latest generation of fcitx input method and various improvements immediately after installing the system. Poplar.at.twilight, 2023-07-19.

4 3

About libreoffice's openJDK dependency version
by Poplar.at.twilight 19 Jul '23

19 Jul '23

Hi, I found that libreoffice requires java-11-openjdk. When I was about to uninstall this version, zypper reminded me that the uninstalled package will contain libreoffice-base. I wonder is there any particular reason why libreoffice uses java-11-openjdk? According to https://endoflife.date/java , openJDK 11 ended active support. Is it time to switch dependencies to openJDK 17? Poplar.at.twilight, 2023-07-19

6 12

openSUSE Release Engineering meeting 19.07.2023
by Lubos Kocman 19 Jul '23

19 Jul '23

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting The meeting is hosted here https://meet.opensuse.org/ReleaseEngineeringMeeting ## Attendees bittin,wengel,guillaumeg,dirk, anag, lkocman, ddemaio,maxlin ## Leap Back from vacation. Excited about https://grommunio.com/blog/grommunio-packages-in-opensuse-factory/ First feature requests against 15.6 were processed. https://code.opensuse.org/leap/features For everyone: please request SLES 15 SP6 update/change features as soon as possible via the link above, to ensure your request is treated as an early feature. Details on https://en.opensuse.org/openSUSE:Roadmap#DRAFT_Schedule_for_openSUSE_Leap_1… The setup of openSUSE:Backports:SLE-15-SP6 and openSUSE:Leap:15.6 is done. Everybody is welcome to help me with creating action items, or even better take action items https://en.opensuse.org/Portal:15.5/Retrospective Leap Micro https://bugzilla.suse.com/show_bug.cgi?id=1213428 ## openSUSE Tumbleweed openSUSE:Factory build fail stats: 90 failed 1 unresolvable (last week: 121 failed, 3 unresolvable) https://tinyurl.com/ysy4nnnz * kernel 6.4.3 now available (with lockdown) * libxml2 2.11.x blocked, as it breaks things like perl-XML-LibXML, * fmt 10 blocked, as it breaks mariadb boo#1213219, ceph boo#1213217 * Maybe no snapshots next 2-3 days because openQA migration. ## Richard (Aeon) Richard N/A ## Richard (ALP Architecture) Richard N/A ALP-based-Leap-replacement kickoff meeting happened and was recorded https://youtu.be/hLWvC1c7Fms https://etherpad.opensuse.org/p/weeklymeeting20230627 (some Q&A were captured there) Key points - There will be a Leap 15.6 - There will be a SUSE ALP "Micro" (name to change) coming 2024 - There will be a SUSE ALP "SLES Successor" (name to be defined) coming 2025 - There will be 1:1 copies of the above contributed by SUSE into openSUSE - Therefore some community needs (especially for enterprise server OSs) will likely be well handled automatically, but Leap had much broader use cases. The door is wide open for the community to address that and there is no critical rush - LOTS of open questions as to HOW the community may wish to address that - Probably one of the biggest issues is needing a lot more direct-to- the-codebase contributors, particually packagers and maintainers Please join the Matrix channel and get involved discussing the possible solutions ## Max * The openSUSE:Backports:SLE-15-SP6 setup is complete, staging project is running. package build has been disabled for now due to the AC issue in server room, per Wolfgang package build will be re-enabled later today or tomorrow. * openSUSE:Leap:15.6 setup is now done including the sibling subprojects * Branched the source packages from previous version * I'm now preparing to enable various checkers for Leap 15.6 and SLE15- SP6 Backports * Thanks to Marco, Rudi, Wolfgang and Adrian for helping the setup process ## Guillaume - Arm Tumbleweed: * Rolling * Latest snapshot (including kernel 6.4) has been tested on Lenovo X13s but it seems we are missing some Kconfig enablement (To be investigated) * shim currently not signed by Microsoft for aarch64 (Tumbleweed only, Leap is fine). It has been sent upstream for review, so it is progressing - https://bugzilla.suse.com/show_bug.cgi?id=1211297 * armv6: python-setuptools-rust package fails to build for armv6 (hangs in %check) and prevents lots of armv6 packages/images to build as it prevents python-cryptography to build. https://bugzilla.opensuse.org/show_bug.cgi?id=1213005 Leap: * 15.5: port for armv7: containers are currently not building/created. Dirk mentioned that driver in 15.4 was the k3s team. ALP: * shim not signed by MS (at least for aarch64, not sure for x86_64) - jsc#ARM-100 WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Team is ok to publish it on Microsoft store anyway, but this would require some testing in openQA which is currently not possible (due to technical issues and MS licensing issues) https://progress.opensuse.org/issues/126083. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server ## Sarah - s390x Not available Tumbleweed * running * small test issue related to system profile in the installation Leap: * working * waitingSubmissisions with fixes for gtkd and gnu-cobol: https://build.opensuse.org/request/show/1072852 (waiting for a simple Submit Approval of a Requires since 4 months!) -> Alternative submitting directly to zSystems if Maintainers do not respond -> Resolving https://bugzilla.opensuse.org/show_bug.cgi?id=1209438 https://build.opensuse.org/request/show/1078385 * Sarah is organizing access to IBM Z Security Portal regarding security fixes (Spectre v2and other things) -> waiting * SUSE/openSUSE zSystems meeting has happened * The bi-weeky openSUSE zSystems meeting will switch from 18:00 to 19:00. ## Doug * Sponsorship of LinuxFest NorthWest from previous pre-covid sponsorship carries forward this year * Contact ddemaio if plan to attend or want to run a booth * https://linuxfestnorthwest.org/ * openSUSE Conference 2023 videos complete * Thank you c3voc & openSUSE Video Team * Scheduling video posts on social media * Project Clarity * Establishing a clear understanding of projects within the openSUSE Project umbrella and how new project will be identified, verified to be part of the openSUSE Project * Board will be taking this on (Rancher and Uyuni/SUSE Manager) was discussed in the board meeting earlier this week) * openSUSE.Asia Summit * Registrations 4, Submissions 5 * Talks can be onsite or virtual (recorded). * Deadline is August 20. * Submit your proposal at https://events.opensuse.org/ * openALT / Fall 2023 (invoice based) sponsorship approved by Anicka (10k CZK) - Dirk reminded us about OSCC still having some budget available * Trying to troubleshoot one TSP payments * Community meeting * Worked on project clarity & enhancing info on https://en.opensuse.org/openSUSE:How_to_contribute_to_Factory * EL Collaboration Meeting changed to once a month. Next is August 31 * GSoC * Mid-term evaluations complete with 100% Friday, July 14, by 18:00 UTC * openSUSE Boxes * Two companies are thinking about restarting with Start-Up Booklet * Stakeholders informed * Need to schedule followup meeting w/netitwork Static * Still need future storage location * AI topics (static) * Scraping of info & how it might affect costs is being dicussed by board * Dirk: There is a OSCC meetup today touching the topic * Board looking into using AI to help with possible moderation *** ddemaio will be unavailable for this meeting until the August 9 meeting starting next week ## Dirk CDN contract with Fastly is signed, Fastly is sponsoring openSUSE project with CDN bandwidth Currently added as fallback mirror for North America, South America and Europe lkocman: Will this affect our download metrics? Dirk: Since we don't track downloads from instances other than download-o-o, and we're not switching download-o-o currently. So pretty much same state as before. Step 15.6/SP6 enablement for armv7 Various package updates like usual Added openSUSE Tumbleweed BCI images (SLE BCI images built for opensuse, available on registry.o.org) Location changed from registry.opensuse.org/bci/* to registry.opensuse.org/opensuse/bci/* BCI non-devel images are now available in openSUSE Registry, images are TW based. ## Wolfgang (Package Hub), Scott Bahling Project openSUSE:Backpors:SLE-15-SP6 created in OBS (currently build disabled because of AC issues in SRV1, more build workers will be added latest tomorrow) Creating release package for SP6 (SUSE:Backports:SLE-15-SP6) today in IBS ## Maintenance team (Marcus or Maurizio (m4u)) No big news Firefox needs updates of dependencies before it can be updated to the current version (Security fixes) libzypp update in 15.5 was fixed by releasing missing dependency. libzypp issue that can be properly addressed only with respin of DVD. See section above for more details. openQA is OK currently. (snapper was fixed) Some 15.5 updates from between freeze and GA need to be released, WIP for Marcus Key rotation: Migration with changed 4k key. Current autoimport solution is not ideal. Marcus will work on update of the opensuse-build-key https://en.opensuse.org/SDB:System_upgrade#0._New_4096_bit_RSA_signing_key Marcus is working also on the SLES side, the update of package with the new key was released last week, it's just not activated yet, but it will be already trusted by Leap 15.5 systems. Leap 15.4 is working Leap Micro 5.3 is working Leap Micro 5.4 testing is now passing as well Leap 16.0 - we should revisit the update/sle repo as the current setup not exactly mirror friendly. Solutions could be dropping not so popular architectures or split repositories per architecture. lkocman: 15.3 EOL could lead to stopping our physical Source DVD effort, as it seems we will not produce. As this was the last release which you could still get on a physical media. Lkocman: anything against decomissioning it? Not a single valid request since I've joined SUSE. We did receive only requests for binary install media which are not subject to ^. We do not plan to offer this for any new releases. ## Adrian - OBS Reduced build power at the moment OBS build power is back to normal after fixing misconfiguration which kept workers busy. Servers for OBS is moving to new datacenters until the end of the month of July AC problems in Nüremberg with openQA servers ## Heroes Planning move of download-o-o to Prague along with OBS. Kristyna Streitova would like to setup a new "updated" weblate instance in Prague office. I told her to reach out to heroes, so there is no wasted effort on migrating the old instance. ## Open Floor

1 0

Signature verification failed for file 'repomd.xml' from repository 'Update repository from SUSE Linux Enterprise 15'. Continue? [yes/no] (no):
by Larry Len Rainey 19 Jul '23

19 Jul '23

2 1

OVMF be upgraded to edk2-stable202305 version
by joeyli 19 Jul '23

19 Jul '23

Hi Joerg, Dario, I just upgraded ovmf to edk2-stable202305 version on Virtualization/ovmf, and also submit to openSUSE:Factory/ovmf: https://build.opensuse.org/package/show/Virtualization/ovmf If you found any problem in your fields. Just file bug and add me to Cc, please! Thanks a lot! Joey Lee

1 0

Move of openqa.opensuse.org to new datacenter on 2023-07-19 - Expect unavailability and reduced test capacities
by Oliver Kurz 18 Jul '23

18 Jul '23

Heads up to all users of https://openqa.opensuse.org : The virtual machine serving the webUI and main controlling openQA instance behind that will be moved to a shiny new SUSE datacenter next Wednesday, 2023-07-19. Expect the system to be unavailable for the majority of the day and reduced test capacities for the days after that. Find more details on https://progress.opensuse.org/issues/132143

1 1

New Tumbleweed snapshot 20230717 released!
by Dominique Leuenberger 18 Jul '23

18 Jul '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: autofs colord freetype2 (2.13.0 -> 2.13.1) fuse3 (3.15.0 -> 3.15.1) harfbuzz (7.3.0 -> 8.0.1) krb5 (1.20.1 -> 1.21.1) libgudev (237 -> 238) poppler (23.06.0 -> 23.07.0) poppler-qt5 (23.06.0 -> 23.07.0) python-charset-normalizer (3.1.0 -> 3.2.0) python-importlib-metadata (6.6.0 -> 6.8.0) python-lxml rsyslog (8.2212.0 -> 8.2306.0) smartmontools util-linux xterm (382 -> 384) zimg (3.0.4 -> 3.0.5) === Details === ==== autofs ==== - Add autofs-suse-manpage-remove-initdir.patch Removes references of initdir from man pages (bsc#1207881) ==== colord ==== Subpackages: colord-color-profiles colord-lang libcolord2 libcolorhug2 - Tune _constraints for various architectures. ==== freetype2 ==== Version update (2.13.0 -> 2.13.1) - update to 2.13.1: * New function `FT_Get_Default_Named_Instance` to get the index of the default named instance of an OpenType Variation Font. A new load flag `FT_LOAD_NO_SVG` to make FreeType ignore glyphs in an 'SVG ' table. * New function `FT_GlyphSlot_AdjustWeight` to adjust the glyph weight either horizontally or vertically. This is part of the `ftsynth.h` header file * TrueType interpreter version 38 (also known as 'Infinality') has been deactivated; the value of `TT_INTERPRETER_VERSION_38` is now the same as `TT_INTERPRETER_VERSION_40`. * Switching named instances on and off in Variation Fonts was buggy if the design coordinates didn't change. - drop enable-infinality-subpixel-hinting.patch (obsolete, infinality is deactivated) ==== fuse3 ==== Version update (3.15.0 -> 3.15.1) Subpackages: libfuse3-3 - Update to release 3.15.1 * Reduce default write size by half ==== harfbuzz ==== Version update (7.3.0 -> 8.0.1) Subpackages: libharfbuzz-gobject0 libharfbuzz-icu0 libharfbuzz-subset0 libharfbuzz0 typelib-1_0-HarfBuzz-0_0 - Update to version 8.0.1: + Build fix on 32-bit arm. + More speed optimizations: - 60% speedup in retaingids subsetting SourceHanSans-VF. - 38% speed up in subsetting (beyond-64k) mega-merged Noto. - 16% speed up in retain-gid (used for IFT) subsetting of NotoSansCJKkr. - Changes from version 8.0.0: + New, experimental, WebAssembly (WASM) shaper, that provides greater flexibility over OpenType/AAT/Graphite shaping, using WebAssembly embedded inside the font file. Currently WASM shaper is disabled by default and needs to be enabled at build time. + Improvements to Experimental features introduced in earlier releases: - Support for subsetting beyond-64k and VarComposites fonts. - Support for instancing variable fonts with cubic âglyfâ table. - Many big speed optimizations. ==== krb5 ==== Version update (1.20.1 -> 1.21.1) Subpackages: krb5-32bit krb5-client - update to 1.121.1 (CVE-2023-36054): * Fix potential uninitialized pointer free in kadm5 XDR parsing [CVE-2023-36054]. * Added a credential cache type providing compatibility with the macOS 11 native credential cache. * libkadm5 will use the provided krb5_context object to read configuration values, instead of creating its own. * Added an interface to retrieve the ticket session key from a GSS context. * The KDC will no longer issue tickets with RC4 or triple-DES session keys unless explicitly configured with the new allow_rc4 or allow_des3 variables respectively. * The KDC will assume that all services can handle aes256-sha1 session keys unless the service principal has a session_enctypes string attribute. * Support for PAC full KDC checksums has been added to mitigate an S4U2Proxy privilege escalation attack. * The PKINIT client will advertise a more modern set of supported CMS algorithms. * Removed unused code in libkrb5, libkrb5support, and the PKINIT module. * Modernized the KDC code for processing TGS requests, the code for encrypting and decrypting key data, the PAC handling code, and the GSS library packet parsing and composition code. * Improved the test framework's detection of memory errors in daemon processes when used with asan. ==== libgudev ==== Version update (237 -> 238) - Update to version 238: * Fix newline stripping * Add g_udev_device_get_current_tags() * Add a number of tests, and devel docs * Fix devhelp not being able to find the docs * Skip locale test with locale isn't available - Drop patches fixed upstream: * 71b2fda04dd71c637361e8ead103980ad6f27ed5.patch * 4216ecd4513bd4c8af73543817a51d6f72f166cc.patch ==== poppler ==== Version update (23.06.0 -> 23.07.0) Subpackages: libpoppler-cpp0 libpoppler-glib8 poppler-tools - update to 23.07.0: core: * Fix reading of utf8-with-bom files * Fix crash if CERT_ExtractPublicKey doesn't return a public key * Fix rendering of some malformed documents. Issue #1395 * Allow for stream compression and compress font streams in forms Remove method Hints::getPageRanges qt5: * Fix crash when overprint preview is enabled * Don't fail signature basics tests if backend is not configured qt6: * Fix crash when overprint preview is enabled * Don't fail signature basics tests if backend is not configured utils: * pdfsig: Allow showung and selecting signature backend * pdfsig: Describe signature dump format in manual page ==== poppler-qt5 ==== Version update (23.06.0 -> 23.07.0) - update to 23.07.0: core: * Fix reading of utf8-with-bom files * Fix crash if CERT_ExtractPublicKey doesn't return a public key * Fix rendering of some malformed documents. Issue #1395 * Allow for stream compression and compress font streams in forms Remove method Hints::getPageRanges qt5: * Fix crash when overprint preview is enabled * Don't fail signature basics tests if backend is not configured qt6: * Fix crash when overprint preview is enabled * Don't fail signature basics tests if backend is not configured utils: * pdfsig: Allow showung and selecting signature backend * pdfsig: Describe signature dump format in manual page ==== python-charset-normalizer ==== Version update (3.1.0 -> 3.2.0) - update to 3.2.0: * Typehint for function `from_path` no longer enforce `PathLike` as its first argument * Minor improvement over the global detection reliability * Introduce function `is_binary` that relies on main capabilities, and optimized to detect binaries * Propagate `enable_fallback` argument throughout `from_bytes`, `from_path`, and `from_fp` that allow a deeper control over the detection (default True) * Edge case detection failure where a file would contain 'very- long' camel cased word (Issue #289) ==== python-importlib-metadata ==== Version update (6.6.0 -> 6.8.0) - update to 6.8.0: * Require Python 3.8 or later. * #453: When inferring top-level names that are importable for distributions in ``package_distributions``, now symlinks to other directories are honored. ==== python-lxml ==== - Add ISO-Schematron-schema-optional.patch and remove-ISO-Schematron-schema.patch to remove non-free RNG schema file (bsc#1213351). ==== rsyslog ==== Version update (8.2212.0 -> 8.2306.0) - Upgrade to rsyslog 8.2306.0 * 2023-06-09: mmnormalize bugfix: if msg cannot be parsed, parser chain is stopped * 2023-06-08: Add new global config option "libcapng.default" * 2023-06-08: imjournal: Add FileCreateMode module parameter * 2023-04-17: core bugfix: potential segfault on busy systems * 2023-05-11: GNUTls Driver: Fix memory leaks in gtlsInitCred * 2023-05-24: CI: update base ubuntu image for github actions * 2023-05-16: OMHIREDIS::ADDED:: New support for 'stream' mode * 2023-05-17: OMHIREDIS::ADDED:: new tests for existing functionalities * 2023-04-25: OMHIREDIS::FIXED:: Correctly suspend module in case of failure * 2023-05-17: OMHIREDIS::FIXED:: Synchronously try to authenticate * 2023-04-25: IMHIREDIS::ADDED:: New support for 'stream' mode * 2023-04-25: REDIS::ADDED:: Implement tests for imhiredis module * 2023-04-12: IMHIREDIS::CLEAN:: various improvements and fixes [#]## CHANGED - [IMHIREDIS] factorize code for different modes - [IMHIREDIS] Clean and improve logging lines - [IMHIREDIS] Poll extinction state less frequently for main thread (less aggresive) - [IMHIREDIS] Set 'key' action parameter to REQUIRED - [IMHIREDIS] Use known message length instead of calculating it when enqueuing message [#]## ADDED - [IMHIREDIS] Missing redis replies' types in enumeration [#]## FIXED - [IMHIREDIS] Correctly initialize instance object, especially for redisNodesList - [IMHIREDIS] Correctly print input mode's value in logs when set incorrectly * 2023-05-17: tests: mmexternal-SegFault-empty-jroot-vg.sh: fix typo * 2023-03-21: modify testbench test to detect wrong imptcp truncation * 2023-03-21: imptcp bugfix: spam log on oversize message * 2023-03-23: core/bugfix: using $uuid msg prop can deadlock rsyslog on shutdown * 2023-03-13: Remove halted LGTM badges on README * 2023-02-16: Do not preserve capabilities when changing credentials * 2023-01-23: CI/QA: do compile test both with NDEBUG set/unset * 2023-01-23: Fixed wrong type conversion in cstrLen() for debug mode as well * 2023-01-18: core/template: implement negative position.to * 2023-01-18: CI: fix github CodeQL settings * 2023-01-17: Remove CAP_DAC_OVERRIDE if privileges dropped * 2023-01-17: Adjust the capability set * 2023-01-13: substring function: enhancement and hardening * 2023-01-11: omfile: add action parameters "rotation.*" * 2023-01-11: CI: use newer version of zookeeper * 2023-01-09: ffaup fix : memory corruption with concurrent workers * 2023-01-02: openssl: fix undefined reference to CRYPTO_set_id_callback * 2022-12-30: testbench: add test for invalid json template generation * 2022-12-30: core bugfix: template system may generate invalid json * 2022-12-28: Fixed wrong type conversion in cstrLen() * 2022-12-08: Add CodeQL workflow for GitHub code scanning ==== smartmontools ==== - smartmontools.generate_smartd_opts.in: Fix generated options when SMARTD_SAVESTATES or SMARTD_ATTRLOG are set to "no" (bsc#1207461). ==== util-linux ==== Subpackages: libblkid1 libfdisk1 libmount1 libsmartcols1 libuuid1 util-linux-lang - Add patch to detect MD array as container of LUKS properly (boo#1213227, gh#util-linux/util-linux#2373): * 0001-Revert-libblkid-try-LUKS2-first-when-probing.patch ==== xterm ==== Version update (382 -> 384) Subpackages: xterm-bin xterm-resize - update to 384: * exclude ASCII space from showMissingGlyphs, since a few bitmap fonts lack this * correct a step in rendering double-width characters with bitmap-fonts * fixes for ReGIS-related problems: * mimic an undocumented hardware VT340 feature which handles color initialization with incomplete parameters. * handle whitespace between operator/operands for color values. * reset ReGIS-context when resetting graphics in RIS. ==== zimg ==== Version update (3.0.4 -> 3.0.5) - Update to 3.0.5 * colorspace: add ST.428-1 (gamma 2.6) transfer function * depth: fix AVX-512 integer to float border handling (introduced in 2.6) * depth: fix NEON dither border handling (introduced in 3.0) * graph: fix clipping in alpha premultiplication (introduced in 3.0) * x86: optimizations for AMD Zen4 processors - Drop e29571.patch

1 0

New Tumbleweed snapshot 20230716 released!
by Dominique Leuenberger 17 Jul '23

17 Jul '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaFirefox (115.0.1 -> 115.0.2) audit (3.0.9 -> 3.1.1) audit-secondary (3.0.9 -> 3.1.1) bind cryptsetup iproute2 (6.3 -> 6.4) kernel-source (6.4.2 -> 6.4.3) libHX (4.13 -> 4.14) libbpf (1.2.0 -> 1.2.2) libvirt (9.4.0 -> 9.5.0) python-libvirt-python (9.4.0 -> 9.5.0) qpdf (11.4.0 -> 11.5.0) rpm-config-SUSE (20220926 -> 20230712) texlive util-linux util-linux-systemd === Details === ==== MozillaFirefox ==== Version update (115.0.1 -> 115.0.2) Subpackages: MozillaFirefox-translations-common - Mozilla Firefox 115.0.2 * Fixed a bug with displaying a caret in the text editor on some websites (bmo#1840804) * Fixed a bug with broken audio rendering on some websites (bmo#1841982) * Fixed a bug with patternTransform translate using the wrong units (bmo#1840746) MFSA 2023-26 (bsc#1213230) * CVE-2023-3600 (bmo#1839703) Use-after-free in workers ==== audit ==== Version update (3.0.9 -> 3.1.1) Subpackages: libaudit1 libaudit1-32bit libauparse0 - Update to 3.1.1: * Add user friendly keywords for signals to auditctl * In ausearch, parse up URINGOP and DM_CTRL records * Harden auparse to better handle corrupt logs * Fix a CFLAGS propogation problem in the common directory * Move the audispd af_unix plugin to a standalone program - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Enable livepatching on main library on x86_64. - Update to 3.1: * Disable ProtectControlGroups in auditd.service by default * Fix rule checking for exclude filter * Make audit_rule_syscallbyname_data work correctly outside of auditctl * Add new record types * Add io_uring support * Add support for new FANOTIFY record fields * Add keyword, this-hour, to ausearch/report start/end options * Add Requires.private to audit.pc file * Try to interpret OPENAT2 fields correctly ==== audit-secondary ==== Version update (3.0.9 -> 3.1.1) Subpackages: audit python3-audit system-group-audit - Update to 3.1.1: * Add user friendly keywords for signals to auditctl * In ausearch, parse up URINGOP and DM_CTRL records * Harden auparse to better handle corrupt logs * Fix a CFLAGS propogation problem in the common directory * Move the audispd af_unix plugin to a standalone program - Add _multibuild to define additional spec files as additional flavors. Eliminates the need for source package links in OBS. - Update to 3.1: * Disable ProtectControlGroups in auditd.service by default * Fix rule checking for exclude filter * Make audit_rule_syscallbyname_data work correctly outside of auditctl * Add new record types * Add io_uring support * Add support for new FANOTIFY record fields * Add keyword, this-hour, to ausearch/report start/end options * Add Requires.private to audit.pc file * Try to interpret OPENAT2 fields correctly ==== bind ==== Subpackages: bind-doc bind-utils - Enable dnstap support ==== cryptsetup ==== Subpackages: cryptsetup-doc cryptsetup-lang libcryptsetup12 - luksFormat: Handle system with low memory and no swap space [bsc#1211079] * Check for physical memory available also in PBKDF benchmark. * Try to avoid OOM killer on low-memory systems without swap. * Use only half of detected free memory on systems without swap. * Add patches: - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch ==== iproute2 ==== Version update (6.3 -> 6.4) Subpackages: iproute2-bash-completion - Update to release 6.4 * bridge: mdb: added underlay destination IP support, UDP destination port support, destination VNI support, source VNI support, outgoing interface support * macvlan: added the "bclim" parameter ==== kernel-source ==== Version update (6.4.2 -> 6.4.3) - Linux 6.4.3 (bsc#1012628). - mm: call arch_swap_restore() from do_swap_page() (bsc#1012628). - bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page (bsc#1012628). - commit 5fb5b21 ==== libHX ==== Version update (4.13 -> 4.14) - Update to release 4.14 * socket: make HX_addrport_split work on portless bracketed hostspec ==== libbpf ==== Version update (1.2.0 -> 1.2.2) - update to v1.2.2: * fix a regression in perf tool caused by libbpf resetting its custom catch-all SEC() handler on explicit bpf_program__set_type() call * fix possible double-free in USDT-related libbpf code, which happens when libbpf runs out of space in __bpf_usdt_specs map due to having too many unique USDT specs ==== libvirt ==== Version update (9.4.0 -> 9.5.0) Subpackages: libvirt-client libvirt-daemon-common libvirt-daemon-config-network libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage libvirt-daemon-driver-storage-core libvirt-daemon-driver-storage-disk libvirt-daemon-driver-storage-iscsi libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-logical libvirt-daemon-driver-storage-mpath libvirt-daemon-driver-storage-rbd libvirt-daemon-driver-storage-scsi libvirt-daemon-lock libvirt-daemon-log libvirt-daemon-plugin-lockd libvirt-daemon-proxy libvirt-daemon-qemu libvirt-daemon-xen libvirt-libs - libxl: Improve handling of errors across migration phases bsc#1213186 - apparmor: Support local overrides in all profiles and abstractions spec: Don't replace /etc/apparmor.d/<profile> on package upgrade spec: No longer package empty /etc/apparmor.d/local/* files bsc#1211472 - Update to libvirt 9.5.0 - Many incremental improvements and bug fixes, see https://libvirt.org/news.html#v9-5-0-2023-07-03 - Add upstream commit 5f7f6ceb47 to fix builds on Leap 15.x - Drop downstream commit adding SUSE-specific migration parameters ==== python-libvirt-python ==== Version update (9.4.0 -> 9.5.0) - Update to 9.5.0 - Add all new APIs and constants in libvirt 9.5.0 ==== qpdf ==== Version update (11.4.0 -> 11.5.0) - Update to 11.5.0: * When copying the same page more than once, ensure that annotations are copied and not shared among multiple pages. * Add new method Buffer::copy and deprecate Buffer copy constructor and assignment operator. Buffer copies are expensive and should be done explicitly. * The source code was reformatted to 100 columns instead of 80. Numerous cosmetic changes and changes suggested by clang-tidy were made. ==== rpm-config-SUSE ==== Version update (20220926 -> 20230712) - Update to version 20230712: * Add more prjconf macros * update comment about _lto_cflags * drop %usrmerged macro (boo#1206798) * Fix SLE sbat macros used on Leap (bsc#1198458) ==== texlive ==== Subpackages: libkpathsea6 libsynctex2 - The rungs lua script belongs to texlive-scripts(-bin) only ==== util-linux ==== - Add patch to detect MD array as container of LUKS properly (boo#1213227, gh#util-linux/util-linux#2373): * 0001-Revert-libblkid-try-LUKS2-first-when-probing.patch ==== util-linux-systemd ==== - Add patch to detect MD array as container of LUKS properly (boo#1213227, gh#util-linux/util-linux#2373): * 0001-Revert-libblkid-try-LUKS2-first-when-probing.patch

1 0

Why does the installer still use LUKS1 by default?
by zaper＠dmc.chat 17 Jul '23

17 Jul '23

Hello, Why does the OpenSUSE installer still use LUKS1 with decryption handled by grub by default instead of using LUKS2 and handing off the decryption to systemd-cryptsetup? Thank you. Regards, Zaper

4 5

New Tumbleweed snapshot 20230714 released!
by Dominique Leuenberger 15 Jul '23

15 Jul '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: ibus-table (1.17.0 -> 1.17.1) libnftnl (1.2.5 -> 1.2.6) libshumate (1.0.3 -> 1.0.4) python311-pyparsing (3.0.9 -> 3.1.0) redis (7.0.11 -> 7.0.12) snapper unixODBC === Details === ==== ibus-table ==== Version update (1.17.0 -> 1.17.1) - Update version to 1.17.1 * Fix mypy warnings * Return empty program_name and window_title in get_active_window_xprop() when xprop results are unexpected (Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2215466) * Translation update from Weblate ==== libnftnl ==== Version update (1.2.5 -> 1.2.6) - Update to release 1.2.6 * expr: meta: introduce broute meta expression ==== libshumate ==== Version update (1.0.3 -> 1.0.4) Subpackages: libshumate-1_0-1 libshumate-lang typelib-1_0-Shumate-1_0 - Update to version 1.0.4: + Throttle tile download during animations. ==== python311-pyparsing ==== Version update (3.0.9 -> 3.1.0) - Add upstream patch limit-error-messages.patch as a part of a workaround for boo#1213007 - update to 3.1.0 * API ENHANCEMENT: `Optional(expr)` may now be written as `expr | ""` * Added new class property `identifier` to all Unicode set classes in `pyparsing.unicode`, using the class's values for `cls.identchars` and `cls.identbodychars`. * ParseResults` now has a new method `deepcopy()`, in addition to the current `copy()` method. * Reworked `delimited_list` function into the new `DelimitedList` class. * Added new class method `ParserElement.using_each` * Added new builtin `python_quoted_string`, which will match any form of single-line or multiline quoted strings defined in Python. * `ParserElement.validate()` is deprecated. * Added bool `embed` argument to `ParserElement.create_diagram()`. * Added support for Python 3.12. * Updated `create_diagram()` code to be compatible with railroad-diagrams package version 3.0. * Many other changes, see upstream CHANGES ==== redis ==== Version update (7.0.11 -> 7.0.12) - redis 7.0.12: * (CVE-2022-24834) A specially crafted Lua script executing in Redis can trigger a heap overflow in the cjson and cmsgpack libraries, and result in heap corruption and potentially remote code execution. The problem exists in all versions of Redis with Lua scripting support, starting from 2.6, and affects only authenticated and authorized users. (bsc#1213193) * (CVE-2023-36824) Extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. Specifically: using COMMAND GETKEYS* and validation of key names in ACL rules. (bsc#1213249) * Re-enable downscale rehashing while there is a fork child * Fix possible hang in HRANDFIELD, SRANDMEMBER, ZRANDMEMBER when used with <count> * Improve fairness issue in RANDOMKEY, HRANDFIELD, SRANDMEMBER, ZRANDMEMBER, SPOP, and eviction * Fix WAIT to be effective after a blocked module command being unblocked * Avoid unnecessary full sync after master restart in a rare case ==== snapper ==== Subpackages: libsnapper7 snapper-zypp-plugin - document disadvantage of using network users and order services after nss-user-lookup (gh#openSUSE/snapper#823) ==== unixODBC ==== - Add missing requires for glibc-locale-base, required for utf16 codec (bsc#1213242)

1 0