July 2023 - openSUSE Factory - openSUSE Mailing Lists

Trial to use a CDN for download.opensuse.org
by Dirk Müller 28 Jul '23

28 Jul '23

Hi all, For a while I've been working in the background to get a sponsored CDN subscription. I am happy to report that Fastly.com has agreed to sponsor the openSUSE project with bandwidth. We primarily intend to use it to improve the reachability (latency) of download.opensuse.org in various areas of the world, but of course can expand it to other usecases as well. Andrii, Bernhard and myself have set up an initial proof of concept under https://cdn.opensuse.org/ which you can now use and report issues with. just use it in place of download.opensuse.org in your zypper repositories or elsewhere. Ideally we would be providing the openSUSE Leap maintenance update repositories directly via the CDN, but that is currently not possible in how the setup is working. We intend to improve that over time but that will require fixes in various places including the Open Build Service itself (it can currently not handle more than one download site). Please don't spread the usage too widely, we're still in a "BETA" stage and need to implement some measures to keep bandwidth usage under control. Happy to hear about any feedback that you might have. Greetings, Dirk

14 29

Problem with build of VirtualBox in Leap 15.6
by Larry Finger 28 Jul '23

28 Jul '23

Hi, I tried to build BirtualBox under Leap 15.6 using the command osc build -M kmp --alternative-project openSUSE:Leap:15.6:Staging:adi:1 standard The build installed the packages and ended with: Verifying integrity of cached packages using keys from SUSE:SLE-15-SP3:Update, SUSE:SLE-15:GA, SUSE:SLE-15-SP4:GA, SUSE:SLE-15:Update, SUSE:SLE-15-SP4:Update, SUSE:SLE-15-SP3:GA, SUSE:SLE-15-SP5:GA, SUSE:SLE-15-SP5:Update, SUSE:SLE-15-SP1:Update, SUSE:SLE-15-SP2:Update, SUSE:SLE-15-SP2:GA, SUSE:SLE-15-SP1:GA, openSUSE:Leap:15.6, openSUSE:Backports warning: /var/tmp/osbuild-packagecache/openSUSE:Backports:SLE-15-SP6/standard/x86_64/kbuild-0.1.9998svn3110-bp156.3.1.x86_64.rpm: Header V3 RSA/SHA512 Signature, key ID 25db7ae0: NOKEY /var/tmp/osbuild-packagecache/openSUSE:Backports:SLE-15-SP6/standard/x86_64/kbuild-0.1.9998svn3110-bp156.3.1.x86_64.rpm : public key not available Is there something wrong with the kbuild package in 15.6? Thanks, Larry

4 7

openSUSE Release Engineering meeting 26.07.2023
by Lubos Kocman 26 Jul '23

26 Jul '23

All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting The meeting is hosted here https://meet.opensuse.org/ReleaseEngineeringMeeting ## Attendees RBrown, DimStar, lkocman,guillaumeg, anag, adrians, maxlin ## Leap The next hackweek will take place in the week of 6th November. Excited about https://grommunio.com/blog/grommunio-packages-in-opensuse-factory/ Deployments (100k users) like this makes me see the convenience for customer to simply register and migrate Leap to get support from SUSE. I helped NETitworks to apply for SUSE partnership. Meeting minutes: https://etherpad.opensuse.org/p/ReleaseEngineering-20230720-netitwork All reported feature requests against 15.6 were processed. https://code.opensuse.org/leap/features Filed several tasks regarding remaining setup of 15.6 (for QA, IT, autobuild, etc). So we give team enough heads up to e.g. plan for the openqa/maint setup around Beta timeframe, especially with all the work on ALP. Need to request Leap Micro 5.6 setup. Some work on openSUSE-repos to support the try-out CDN https://github.com/openSUSE/news-o-o/pull/180 ## openSUSE Tumbleweed openSUSE:Factory build fail stats: 87 failed 5 unresolvable (last week: 90 failed, 1 unresolvable) https://tinyurl.com/ysy4nnnz * openQA migrated to the new data center; snpashots 0720 - 0723 were not tested/released * kernel 6.4.6 (with ZenBleed fix) in staging, should be available by end of the week * libxml2 2.11.x blocked, as it breaks things like perl-XML-LibXML, * fmt 10 blocked, as it breaks mariadb boo#1213219, ceph boo#1213217 ## Richard (Aeon) Really want to get Aeon's own media out soon, but also taking care not to overwhealm OBS with endless experimental changes while the DC migration leaves us with lower resources So been focused on tidying up some organisational backlog https://aeondesktop.org/bugs is now a nice curated list of all open Aeon bugs. I plan to keep this list well managed in the future, maybe by using bots Feel free to file more bugs https://aeondesktop.org/reportbug Considering a structured approach to handling customisation to Aeon in relation to bug reports https://en.opensuse.org/Portal:Aeon/DevelopmentThoughts TL;DR - highest priority will always be given to bug reports from Aeon systems with no altered RPMs. - adding (most) packages from the official TW Repos / NVIDIA will still be supported but at a low priority - adding packages from anywhere else, or known-bad packages from TW Repos, will lead to bug reports from that system being handled with least priority. Userspace and bugzilla bot tooling needs to be written to impliment the above first. ## Richard (ALP Architecture) ALP-Leap-Replacement meeting minutes - https://etherpad.opensuse.org/p/weeklymeeting20230725 Summary - Few community discussions in the last month - 2 ongoing experiemntal concepts - Slowroll - basically a slower version of Tumbleweed to be less scary for Leap users - Linarite - basically a narrower, smaller Leap-like distribution, likely with less desktops and fewer packages, formerly GrassyKnoll - Limited progress to the "Slowroll" concept in the last month - No progress on Linraite since GrassyKnoll - Planning on doing a poll with the official election platform for Members only to get some indication as to whether Slowroll, Linarite, or not replacing Leap is where our contribution bases interest lies. Personal Note: Richard is concerned at the apparant lack of contributor interest in these efforts. Without more contributions we're not likely to have a great solution, or maybe any solution, for Leap users ## Max * Leap 15.6 and Backports-SLE15-SP6 are all good, we're lack of build power though, therefore we do only have enabled x86_64 build for now * The required Backports/Leap 15.6 checkers are running on botmaster * I did submitted package update from 15.5:Update and Backports:SLE-15- SP5:Update to 15.6/Backports:SLE-15-SP6 ## Guillaume - Arm Tumbleweed: * Rolling * gcc13 bug leading to build failure of highway (and maybe more) - https://bugzilla.opensuse.org/show_bug.cgi?id=1213647 * shim currently not signed by Microsoft for aarch64 (Tumbleweed only, Leap is fine). It has been sent upstream for review, so it is progressing - https://bugzilla.suse.com/show_bug.cgi?id=1211297 * armv6: python-setuptools-rust package fixed, so armv6 is now in better shapes - https://bugzilla.opensuse.org/show_bug.cgi?id=1213005 Leap: * 15.5 aarch64: kernel oops seen on openQA aarch64 workers - https://bugzilla.opensuse.org/show_bug.cgi?id=1213620 * 15.5: port for armv7: containers are currently not building/created. Dirk mentioned that driver in 15.4 was the k3s team. ALP: * shim not signed by MS (at least for aarch64, not sure for x86_64) - jsc#ARM-100 WSL: * Works with x86 emulator since appx installer is x86-64, but this is not really an issue since arm64 Win11 includes x86 emulator by default. Team is ok to publish it on Microsoft store anyway, but this would require some testing in openQA which is currently not possible (due to technical issues and MS licensing issues) https://progress.opensuse.org/issues/126083. Steps documented on the wiki to install the appx from download.o.o: https://en.opensuse.org/openSUSE:WSL#With_Appx_from_openSUSE_download_server ## Sarah - s390x Not available Tumbleweed * running * small test issue related to system profile in the installation Leap: * working * waitingSubmissisions with fixes for gtkd and gnu-cobol: https://build.opensuse.org/request/show/1072852 (waiting for a simple Submit Approval of a Requires since 4 months!) -> Alternative submitting directly to zSystems if Maintainers do not respond -> Resolving https://bugzilla.opensuse.org/show_bug.cgi?id=1209438 https://build.opensuse.org/request/show/1078385 * Sarah is organizing access to IBM Z Security Portal regarding security fixes (Spectre v2and other things) -> waiting * SUSE/openSUSE zSystems meeting has happened * The bi-weeky openSUSE zSystems meeting will switch from 18:00 to 19:00. ## Doug Not available * Sponsorship of LinuxFest NorthWest from previous pre-covid sponsorship carries forward this year * Contact ddemaio if plan to attend or want to run a booth * https://linuxfestnorthwest.org/ * openSUSE Conference 2023 videos complete * Thank you c3voc & openSUSE Video Team * Scheduling video posts on social media * Project Clarity * Establishing a clear understanding of projects within the openSUSE Project umbrella and how new project will be identified, verified to be part of the openSUSE Project * Board will be taking this on (Rancher and Uyuni/SUSE Manager) was discussed in the board meeting earlier this week) * openSUSE.Asia Summit * Registrations 4, Submissions 5 * Talks can be onsite or virtual (recorded). * Deadline is August 20. * Submit your proposal at https://events.opensuse.org/ * openALT / Fall 2023 (invoice based) sponsorship approved by Anicka (10k CZK) - Dirk reminded us about OSCC still having some budget available * Trying to troubleshoot one TSP payments * Community meeting * Worked on project clarity & enhancing info on https://en.opensuse.org/openSUSE:How_to_contribute_to_Factory * EL Collaboration Meeting changed to once a month. Next is August 31 * GSoC * Mid-term evaluations complete with 100% Friday, July 14, by 18:00 UTC * openSUSE Boxes * Two companies are thinking about restarting with Start-Up Booklet * Stakeholders informed * Need to schedule followup meeting w/netitwork Static * Still need future storage location * AI topics (static) * Scraping of info & how it might affect costs is being dicussed by board * Dirk: There is a OSCC meetup today touching the topic * Board looking into using AI to help with possible moderation *** ddemaio will be unavailable for this meeting until the August 9 meeting starting next week ## Dirk Not available CDN contract with Fastly is signed, Fastly is sponsoring openSUSE project with CDN bandwidth Currently added as fallback mirror for North America, South America and Europe lkocman: Will this affect our download metrics? Dirk: Since we don't track downloads from instances other than download-o-o, and we're not switching download-o-o currently. So pretty much same state as before. Step 15.6/SP6 enablement for armv7 Various package updates like usual Added openSUSE Tumbleweed BCI images (SLE BCI images built for opensuse, available on registry.o.org) Location changed from registry.opensuse.org/bci/* to registry.opensuse.org/opensuse/bci/* BCI non-devel images are now available in openSUSE Registry, images are TW based. ## Wolfgang (Package Hub), Scott Bahling Not available Project openSUSE:Backpors:SLE-15-SP6 created in OBS (currently build disabled because of AC issues in SRV1, more build workers will be added latest tomorrow) Creating release package for SP6 (SUSE:Backports:SLE-15-SP6) today in IBS ## Maintenance team (Marcus or Maurizio (m4u)) Not available No big news Firefox needs updates of dependencies before it can be updated to the current version (Security fixes) libzypp update in 15.5 was fixed by releasing missing dependency. libzypp issue that can be properly addressed only with respin of DVD. See section above for more details. openQA is OK currently. (snapper was fixed) Some 15.5 updates from between freeze and GA need to be released, WIP for Marcus Key rotation: Migration with changed 4k key. Current autoimport solution is not ideal. Marcus will work on update of the opensuse-build-key https://en.opensuse.org/SDB:System_upgrade#0._New_4096_bit_RSA_signing_key Marcus is working also on the SLES side, the update of package with the new key was released last week, it's just not activated yet, but it will be already trusted by Leap 15.5 systems. Leap 15.4 is working Leap Micro 5.3 is working Leap Micro 5.4 testing is now passing as well Leap 16.0 - we should revisit the update/sle repo as the current setup not exactly mirror friendly. Solutions could be dropping not so popular architectures or split repositories per architecture. lkocman: 15.3 EOL could lead to stopping our physical Source DVD effort, as it seems we will not produce. As this was the last release which you could still get on a physical media. Lkocman: anything against decomissioning it? Not a single valid request since I've joined SUSE. We did receive only requests for binary install media which are not subject to ^. We do not plan to offer this for any new releases. ## Adrian - OBS OBS build power is back to normal after fixing misconfiguration which kept workers busy. Servers for OBS is moving to new datacenters until the end of the month of July AC problems in Nüremberg with openQA servers ## Open Floor

1 0

ALP-Leap-replacement Architecture Meeting Minutes - 25 July 2023
by Richard Brown 25 Jul '23

25 Jul '23

ALP-Leap-replacement Architecture Meeting - https://en.opensuse.org/openSUSE:ALP/ArchitectureTeam Meetings take place on https://meet.opensuse.org/meeting and notes are available at https://etherpad.opensuse.org/p/weeklymeeting Participants: Richard, Lubos, Valentin, Marcus, Bernhard, Phoeinx, Knurpht, Rob, Emiliano, Ish, Dirk 1. Update from Richard: Communications - There has been NO communication on https://matrix.to/#/#alp:opensuse.org since July 1 Q from Richard - have discussions been happening elsewhere? A- There hasn't been much, but there has been some conversations. Richard needs to fix his Matrix client ;) but more people should join and discuss also. Ongoing efforts - there are currently 2 concepts for an ALP-Based-Leap Replacement https://en.opensuse.org/openSUSE:ALP/ArchitectureTeam#Experimental/Research… Linarite update - No progress yet Slowroll update- "I did a snapshot of a random Tumbleweed version (20230705) and setup OBS projects to build a package update ontop of it. That worked with some help from Adrian. During that we discovered that we will probably need an own project like openSUSE:Slowroll to have our own prjconf that can move independently of Factory/Tumbleweed. https://build.opensuse.org/projects/openSUSE:ALP:Experimental:Slowroll/meta I also started https://github.com/bmwiedemann/slowroll-tools that already provides data for a core-ness value for a given package. More tools should be added there later, e.g. to do heuristics on .changes files and code diffs to provide input to the required risk+benefit-assessment. One open question is if we want multiple overlapping slowroll versions. If most work is automated, that should not be much extra effort. Then we could have a slowroll-2023-07 followed by a slowroll-2024-01 with overlapping support periods so that sysadmins can dup on their own schedule. It could be like openSUSE before Leap (but with more automation to keep the work easy). I would like that." 2. Discussing concepts for additional Experiments/Research Projects No additional concepts raised 3. Any other buisness - Group mail from Max, is this another concept? Richard - doesn't seem to be, but does provide many good questions the group needs to consider. - Was recurring suggestions via YouTube and Reddit that openSUSE may not need a Leap replacement. What do we think as a group? A- To be kept in mind and maybe used as a question in poll (see below) Lubos - would like to see a solution for community to be able to touch the maintenance workflow Marcus - the group needs to define what the Leap replacement looks like before worrying about how to maintain it Richard - exactly - well if we did Slowroll, then we wouldn't have a maintenance workflow like the current Leap at all Phoenix - What does lifecylce mean in the context of Slowroll? Richard - Something along the lines of how often/how quickly after a package is in Tumbleweed does it appear in Slowroll Phoenix - But the metric of how often is a package updated is mostly irrelevant for a point release. Users expect a system to be installed and then mostly stay stable. The important question is "are packages maintained" and that does not necessarily align with packages being kept at bleeding edge Dirk - Also Packages in SLES are maintained which means, they will be updated when there is a reason for them to be updated. Lubos - Max tries to update all community packages in Leap 15.X few times during the development cycle. We have it as part of our release process. It's true that some of the SLES packages were not updated since SLES 15(.0):GA, these receive on demand updates typically requested via Jira or https://code.opensuse.org/leap/features Dirk - suggestion to create a poll to gain feedback on which concepts folk might like https://en.opensuse.org/Portal:15.5/Retrospective has plenty feedback on Leap 15.5 pros+cons Ish - the poll should be really specific, and it should be done for Members only, using the election platform. Ish volunteers to run it. AI - Richard, Lubos, Dirk to work on wording for Ish. Poll is likely to focus on the concepts we have on the table, namely Slowroll, Linarite, and not-replacing-Leap. Phoenix - Shares some thoughts - Leap users like Leap because they like a point release. If we give them a rolling release they'll probably just go to a different distro. Contributing to Leap is very difficult and gets in the way of a point release. The main thing contributions want to do is just add new packages, so, why not have a concept which is an expanded packagehub, which a much simpler contribution process. Richard - cool idea..it's not really different from openSUSE:Backports and would likely face the same challenges gathering contributions Lubos - you'll hit the problems we already hit..new package requires an update to FOO which blocks the change until the dependency can be updated in the next point release Richard - Exactly, this is why Tumbleweed has the concept of "To be able to change any one thing, we need to be able to change everything". Any point release model will effectively block such contributions for months or years at a time. Next meeting - after pool closing, TBA -- Richard Brown Distributions Architect SUSE Software Solutions Germany GmbH, Frankenstraße 146, D-90461 Nuremberg, Germany (HRB 36809, AG Nürnberg) Managing Directors/Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Martje Boudien Moerman

1 0

New Tumbleweed snapshot 20230724 released!
by Dominique Leuenberger 25 Jul '23

25 Jul '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apache2-mod_php8 (8.2.7 -> 8.2.8) bind (9.18.16 -> 9.18.17) elfutils-debuginfod hwinfo (23.1 -> 23.2) kernel-source (6.4.3 -> 6.4.4) libshumate (1.0.4 -> 1.0.5) libva (2.18.0 -> 2.19.0) libva-gl (2.18.0 -> 2.19.0) libvirt netcontrol nghttp2 (1.54.0 -> 1.55.1) openssh (9.3p1 -> 9.3p2) openssh-askpass-gnome (9.3p1 -> 9.3p2) openssl-1_1 openssl-3 ovmf (202302 -> 202305) php8 (8.2.7 -> 8.2.8) python-rich qalculate (4.6.1 -> 4.7.0) sysuser-tools tar update-alternatives (1.21.8 -> 1.21.22) virtualbox (7.0.8 -> 7.0.10) virtualbox-kmp (7.0.8_k6.4.3_1 -> 7.0.10_k6.4.4_1) webkit2gtk3 (2.40.3 -> 2.40.4) webkit2gtk3-soup2 (2.40.3 -> 2.40.4) === Details === ==== apache2-mod_php8 ==== Version update (8.2.7 -> 8.2.8) - version update to 8.2.8 * This is a bug fix release. * https://www.php.net/ChangeLog-8.php#8.2.8 - modified patches % php-sort-filelist-phar.patch (refreshed) ==== bind ==== Version update (9.18.16 -> 9.18.17) Subpackages: bind-doc bind-utils - Update to release 9.18.17 Feature Changes: * If a response from an authoritative server has its RCODE set to FORMERR and contains an echoed EDNS COOKIE option that was present in the query, named now retries sending the query to the same server without an EDNS COOKIE option. * The relaxed QNAME minimization mode now uses NS records. This reduces the number of queries named makes when resolving, as it allows the non-existence of NS RRsets at non-referral nodes to be cached in addition to the normally cached referrals. Bug Fixes: * The ability to read HMAC-MD5 key files, which was accidentally lost in BIND 9.18.8, has been restored. * Several minor stability issues with the catalog zone implementation have been fixed. ==== elfutils-debuginfod ==== Subpackages: debuginfod-profile libdebuginfod1 - Replace libdebuginfo1 sub-package's debuginfod-profile Recommends with config(debuginfod-profile) Requires, but on the debuginfod-\ client sub-package, instead. And add binutils, bpftrace-tools, elfutils, gdb, perf, systemd-coredump, and valgrind Supplements to debuginfod-client sub-package. This should make installation of debuginfod-client more consistent, along with debuginfod-\ profile, with software/packages that have debuginfod support. ==== hwinfo ==== Version update (23.1 -> 23.2) Subpackages: libhd23 - merge gh#openSUSE/hwinfo#128 - Add support for loongarch cpu - 23.2 ==== kernel-source ==== Version update (6.4.3 -> 6.4.4) - Linux 6.4.4 (bsc#1012628). - start_kernel: Add __no_stack_protector function attribute (bsc#1012628). - USB: serial: option: add LARA-R6 01B PIDs (bsc#1012628). - usb: dwc3: gadget: Propagate core init errors to UDC during pullup (bsc#1012628). - phy: tegra: xusb: Clear the driver reference in usb-phy dev (bsc#1012628). - extcon: usbc-tusb320: Unregister typec port on driver removal (bsc#1012628). - dt-bindings: iio: ad7192: Add mandatory reference voltage source (bsc#1012628). - iio: addac: ad74413: don't set DIN_SINK for functions other than digital input (bsc#1012628). - iio: adc: ad7192: Fix null ad7192_state pointer access (bsc#1012628). - iio: adc: ad7192: Fix internal/external clock selection (bsc#1012628). - iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF (bsc#1012628). - iio: accel: fxls8962af: fixup buffer scan element type (bsc#1012628). - Revert "drm/amd/display: edp do not add non-edid timings" (bsc#1012628). - fs: pipe: reveal missing function protoypes (bsc#1012628). - s390/kasan: fix insecure W+X mapping warning (bsc#1012628). - blk-mq: don't queue plugged passthrough requests into scheduler (bsc#1012628). - block: Fix the type of the second bdev_op_is_zoned_write() argument (bsc#1012628). - block/rq_qos: protect rq_qos apis with a new lock (bsc#1012628). - splice: Fix filemap_splice_read() to use the correct inode (bsc#1012628). - erofs: kill hooked chains to avoid loops on deduplicated compressed images (bsc#1012628). - x86/resctrl: Only show tasks' pid in current pid namespace (bsc#1012628). - fsverity: use shash API instead of ahash API (bsc#1012628). - fsverity: don't use bio_first_page_all() in fsverity_verify_bio() (bsc#1012628). - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost (bsc#1012628). - x86/sev: Fix calculation of end address based on number of pages (bsc#1012628). - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() (bsc#1012628). - virt: sevguest: Add CONFIG_CRYPTO dependency (bsc#1012628). - blk-mq: fix potential io hang by wrong 'wake_batch' (bsc#1012628). - lockd: drop inappropriate svc_get() from locked_get() (bsc#1012628). - nvme-core: fix memory leak in dhchap_secret_store (bsc#1012628). - nvme-core: fix memory leak in dhchap_ctrl_secret (bsc#1012628). - nvme-core: add missing fault-injection cleanup (bsc#1012628). - nvme-core: fix dev_pm_qos memleak (bsc#1012628). - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (bsc#1012628). - md/raid10: fix overflow of md/safe_mode_delay (bsc#1012628). - md/raid10: fix wrong setting of max_corr_read_errors (bsc#1012628). - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (bsc#1012628). - md/raid10: fix io loss while replacement replace rdev (bsc#1012628). - md/raid1-10: factor out a helper to add bio to plug (bsc#1012628). - md/raid1-10: factor out a helper to submit normal write (bsc#1012628). - md/raid1-10: submit write io directly if bitmap is not enabled (bsc#1012628). - block: fix blktrace debugfs entries leakage (bsc#1012628). - irqchip/loongson-eiointc: Fix irq affinity setting during resume (bsc#1012628). - splice: don't call file_accessed in copy_splice_read (bsc#1012628). - irqchip/stm32-exti: Fix warning on initialized field overwritten (bsc#1012628). - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors (bsc#1012628). - svcrdma: Prevent page release when nothing was received (bsc#1012628). - erofs: fix compact 4B support for 16k block size (bsc#1012628). - posix-timers: Prevent RT livelock in itimer_delete() (bsc#1012628). - tick/rcu: Fix bogus ratelimit condition (bsc#1012628). - tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode() (bsc#1012628). - btrfs: always read the entire extent_buffer (bsc#1012628). - btrfs: don't use btrfs_bio_ctrl for extent buffer reading (bsc#1012628). - btrfs: return bool from lock_extent_buffer_for_io (bsc#1012628). - btrfs: submit a writeback bio per extent_buffer (bsc#1012628). - btrfs: fix range_end calculation in extent_write_locked_range (bsc#1012628). - btrfs: don't fail writeback when allocating the compression context fails (bsc#1012628). - btrfs: only call __extent_writepage_io from extent_write_locked_range (bsc#1012628). - btrfs: don't treat zoned writeback as being from an async ... changelog too long, skipping 1321 lines ... - commit f6ca0bc ==== libshumate ==== Version update (1.0.4 -> 1.0.5) Subpackages: libshumate-1_0-1 libshumate-lang typelib-1_0-Shumate-1_0 - Update to version 1.0.5: + Don't defer frame clock when widget is unrealized. ==== libva ==== Version update (2.18.0 -> 2.19.0) Subpackages: libva-drm2 libva-wayland2 libva-x11-2 libva2 - Update to 2.19.0: * add: Add mono_chrome to VAEncSequenceParameterBufferAV1 * add: Enable support for license acquisition of multiple protected playbacks * fix: use secure_getenv instead of getenv * trace: Improve and add VA trace log for AV1 encode * trace: Unify va log message, replace va_TracePrint with va_TraceMsg. ==== libva-gl ==== Version update (2.18.0 -> 2.19.0) - Update to 2.19.0: * add: Add mono_chrome to VAEncSequenceParameterBufferAV1 * add: Enable support for license acquisition of multiple protected playbacks * fix: use secure_getenv instead of getenv * trace: Improve and add VA trace log for AV1 encode * trace: Unify va log message, replace va_TracePrint with va_TraceMsg. ==== libvirt ==== Subpackages: libvirt-client libvirt-daemon-common libvirt-daemon-config-network libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage libvirt-daemon-driver-storage-core libvirt-daemon-driver-storage-disk libvirt-daemon-driver-storage-iscsi libvirt-daemon-driver-storage-iscsi-direct libvirt-daemon-driver-storage-logical libvirt-daemon-driver-storage-mpath libvirt-daemon-driver-storage-rbd libvirt-daemon-driver-storage-scsi libvirt-daemon-lock libvirt-daemon-log libvirt-daemon-plugin-lockd libvirt-daemon-proxy libvirt-daemon-qemu libvirt-daemon-xen libvirt-libs - CVE-2023-3750: storage: Fix returning of locked objects from 'virStoragePoolObjListSearch' bsc#1213447 ==== netcontrol ==== - Fix EOF handling in xml-reader to avoid `virsh iface-*` commands hang on aarch64 (bsc#1213349) [+ 0001-xml-reader-fix-xml_getc-and-xml_ungetc.patch, + 0002-xml-reader-allow-uppercase-for-lt-gt-and-amp-expansi.patch] ==== nghttp2 ==== Version update (1.54.0 -> 1.55.1) - update to 1.55.1: * Fix memory leak This commit fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails with a fatal error. For example, if GOAWAY frame has been received, a HEADERS frame that opens new stream cannot be sent. This issue has already been made public via CVE-2023-35945 by envoyproxy/envoy project. During embargo period, the patch to fix this bug was accidentally submitted to nghttp2/nghttp2 repository [2]. And they decided to disclose CVE early. I was notified just 1.5 hours before disclosure. I had no time to respond. PoC described in [1] is quite simple, but I think it is not enough to trigger this bug. While it is true that receiving GOAWAY prevents a client from opening new stream, and nghttp2 enters error handling branch, in order to cause the memory leak, nghttp2_session_close_stream function must return a fatal error. NGHTTP2_ERR_NOMEM, as its name suggests, indicates out of memory. It is unlikely that a process gets short of memory with this simple PoC scenario unless application does something memory heavy processing. * NGHTTP2_ERR_CALLBACK_FAILURE is returned from application defined callback function (nghttp2_on_stream_close_callback, in this case), which indicates something fatal happened inside a callback, and a connection must be closed immediately without any further action. As nghttp2_on_stream_close_error_callback documentation says, any error code other than 0 or NGHTTP2_ERR_CALLBACK_FAILURE is treated as fatal error code. More specifically, it is treated as if NGHTTP2_ERR_CALLBACK_FAILURE is returned. I guess that envoy returns NGHTTP2_ERR_CALLBACK_FAILURE or other error code which is translated into NGHTTP2_ERR_CALLBACK_FAILURE. https://github.com/envoyproxy/envoy/security/advisories/GHSA- jfxv-29pc-x22r ==== openssh ==== Version update (9.3p1 -> 9.3p2) Subpackages: openssh-clients openssh-common openssh-server - Update to openssh 9.3p2 (bsc#1213504, CVE-2023-38408): Security ======== Fix CVE-2023-38408 - a condition where specific libaries loaded via ssh-agent(1)'s PKCS#11 support could be abused to achieve remote code execution via a forwarded agent socket if the following conditions are met: * Exploitation requires the presence of specific libraries on the victim system. * Remote exploitation requires that the agent was forwarded to an attacker-controlled system. Exploitation can also be prevented by starting ssh-agent(1) with an empty PKCS#11/FIDO allowlist (ssh-agent -P '') or by configuring an allowlist that contains only specific provider libraries. This vulnerability was discovered and demonstrated to be exploitable by the Qualys Security Advisory team. In addition to removing the main precondition for exploitation, this release removes the ability for remote ssh-agent(1) clients to load PKCS#11 modules by default (see below). Potentially-incompatible changes - ------------------------------- * ssh-agent(8): the agent will now refuse requests to load PKCS#11 modules issued by remote clients by default. A flag has been added to restore the previous behaviour "-Oallow-remote-pkcs11". Note that ssh-agent(8) depends on the SSH client to identify requests that are remote. The OpenSSH >=8.9 ssh(1) client does this, but forwarding access to an agent socket using other tools may circumvent this restriction. ==== openssh-askpass-gnome ==== Version update (9.3p1 -> 9.3p2) - Update to openssh 9.3p2 * No changes for askpass, see main package changelog for details ==== openssl-1_1 ==== Subpackages: libopenssl1_1 - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch ==== openssl-3 ==== Subpackages: libopenssl3 libopenssl3-32bit - Security fix: [bsc#1213487, CVE-2023-3446] * Fix DH_check() excessive time with over sized modulus. * The function DH_check() performs various checks on DH parameters. One of those checks confirms that the modulus ("p" parameter) is not too large. Trying to use a very large modulus is slow and OpenSSL will not normally use a modulus which is over 10,000 bits in length. However the DH_check() function checks numerous aspects of the key or parameters that have been supplied. Some of those checks use the supplied modulus value even if it has already been found to be too large. A new limit has been added to DH_check of 32,768 bits. Supplying a key/parameters with a modulus over this size will simply cause DH_check() to fail. * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Security fix: [bsc#1213383, CVE-2023-2975] * AES-SIV implementation ignores empty associated data entries * Add openssl-CVE-2023-2975.patch ==== ovmf ==== Version update (202302 -> 202305) Subpackages: qemu-ovmf-x86_64 - Removed the following patches because they are not necessary and they blocked for submit to openSUSE:Factory. (bsc#1205978) ovmf-Revert-OvmfPkg-PlatformInitLib-Add-PlatformAddHobCB.patch ovmf-Revert-OvmfPkg-PlatformInitLib-Add-PlatformGetLowMem.patch ovmf-Revert-OvmfPkg-PlatformInitLib-Add-PlatformReservati.patch ovmf-Revert-OvmfPkg-PlatformInitLib-Add-PlatformScanE820-.patch ovmf-Revert-OvmfPkg-PlatformInitLib-reorder-PlatformQemuU.patch - Add openssl.keyring.README to shim.spec as Source113 to avoid erroe when submit to openSUSE:Factory - Enable support for riscv64 - Update to edk2-stable202305 (bsc#1205588) - Features (https://github.com/tianocore/edk2/releases): Expose IBT/BTI compatible runtime DXE drivers via memory attributes table Update toolchain support MdePkg: Support FDT library Add google mocks support to UnitTestFrameworkPkg GoogleTestLib Platform Redfish Host Interface library for USBNIC [OpenSSL] Update OpenSSL version to version 1.1.1t to include CVE fix Replace pre-standard FUNCTION with C99 func throughout edk2 Implement EFI memory attributes protocol for ARM platforms Add TraceHubLib Support - Patches (git log --oneline --date-order edk2-stable202302..edk2-stable202305): ba91d0292e MdeModulePkg/Core/Pei: set AprioriCount=0 before walking through next FV 5ce29ae84d ArmPkg/ArmMmuLib AARCH64: Add missing ISB after page table update c5cf7f69c9 pip-requirements.txt: Update edk2 pip modules 0abfb0be6c OvmfPkg: RiscVVirt: Add missing SerialPortInitialize to Sec 45da4e3135 MdePkg: add SBI-based SerialPortLib for RISC-V 2900e75511 MdePkg: BaseRiscVSbiLib: make more useful to consumers cafb4f3f36 UefiPayloadPkg: Fix boot shell issue for universal UEFI payload 80bc13db83 Maintainers.txt: Update reviewers and maintainers for FdtLib. d322557712 BaseTools/tools_def: Disable overzealous unused variable warning on Clang e2607d3a78 BaseTools/tools_def: Drop ref to undefined CLANGDWARF_ARM_PREFIX 0b37723186 ShellPkg/UefiShellDebug1CommandsLib: Replace hardcoded SMBIOS strings. 2d4c76f783 MdePkg/IndustryStandard: Add SMBIOS anchor string & length defines. c08a3a96fd MdePkg/IndustryStandard: Add IPMI Interface Capabilities definitions 083b029538 MdePkg: Add new PCDs for IPMI SSIF dea6c7dc2a MdePkg/IndustryStandard: Add definitions for IPMI SSIF 0a0e60caf2 Maintainers.txt: Update reviewers and maintainers for TraceHubDebugLib. 0f0422cedc MdeModulePkg: Add TraceHubDebugSysTLib library 3d50fdc5c6 MdePkg: Add NULL library of TraceHubDebugSysTLib c6bb7d54be MdePkg: Add MipiSysTLib library 782948c1a7 MdePkg: Add mipisyst submodule 6dd64168ed BaseTools/Plugin: Too many execute files cause "cmd too long" failure c6382ba0f2 SecurityPkg: Add missing break in Tpm2TestParms 77f75c7fb8 BaseTools: Update Tests/TestTools.py to allow it to work on Windows b9bbb4ae93 BaseTools: only print the environment once in toolsetup.bat dd246227d6 BaseTools: Update toolsetup.bat to not use BASETOOLS_PYTHON_SOURCE f47415e031 BaseTools: Revert Set the CLANGDWARF OBJCOPY path in tools_def.template 6fb2760dc8 OvmfPkg: drop PlatformBootManagerLibGrub 81dc0d8b4c OvmfPkg/AmdSev: stop using PlatformBootManagerLibGrub 63887e272d OvmfPkg/NvVarsFileLib: disable in case PcdBootRestrictToFirmware is set 41d7832db0 OvmfPkg/PlatformBootManagerLib: add PcdBootRestrictToFirmware e6447d2a08 Remove bashisms from edksetup.sh and BaseTools/BuildEnv 373a95532a BaseTools: Remove the CLANGCC build rule for Hii-Binary-Package.UEFI_HII ecbc394365 BaseTools: Set CLANGDWARF RC path to llvm-objcopy in tools_def.template 11f62f4cc0 BaseTools: Set the CLANGDWARF OBJCOPY path in tools_def.template c6f47e678f BaseTools: Remove BUILDRULEFAMILY from CLANGDWARF in tools_def.template 9165a7e95e CryptoPkg: Delete CLANG35 and CLANG38 build flags; add CLANGDWARF flags e97b9b4e5a MdePkg: Add more HobLib/PeiServicesLib gmock support 25c9d44315 MdeModulePkg: Add more PciHostBridgeLib gmock support bee67e0c14 OvmfPkg: Relax assertion that interrupts do not occur at TPL_HIGH_LEVEL ae0be176a8 OvmfPkg: Clarify invariants for NestedInterruptTplLib 5215cd5baf BaseTools: Update toolsetup.bat and Tests/PythonTest.py to check ver e6de6052a0 edksetup.bat: if toolsetup.bat fails, just exit 11ec5161fa BaseTools: use threading.current_thread in NmakeSubdirs.py db7e6291c0 BaseTools: Remove Python2/Python3 detection from toolset.bat 6eeb58ece3 RedfishPkg: Fix compile issue on Linux 665fca9ee7 RedfishPkg: Add missing newline character a1f6485a9b RedfishPkg: Create RestEx child on selected interface 05762bd2e0 RedfishPkg: Fix condition checking of error status c580e27efc RedfishPkg: Correct variable type to prevent memory corruption d89492456f Securitypkg/hddpassword: Update HddPasswordDxeInit to use Variable Policy 8dbf868e02 Add volatile keyword to NvmExpressPei's Passthru CQ 293b97d0c4 Add the volatile keyword to NvmExpressDxe's Passthru CQ 4dea9e4a0e BaseTools/Conf: Add quotes to ADDDEBUGFLAG in tools_def.txt 8e985ac3fd BaseTools/Conf: Align CLANGDWARF and CLANGPDB warning overrides 66494e5324 MdeModulePkg/CapsuleApp: Add EFIAPI to CompareFileNameInAlphabet() eabaeb0613 OvmfPkg: move OvmfTpmDxe.fdf.inc to Include/Fdf 8bca1bb977 OvmfPkg: move OvmfTpmPei.fdf.inc to Include/Fdf b65c0eed6b BaseSynchronizationLib: Fix LoongArch64 synchronization functions 757f502a3b BaseTools/Conf/tools_def.template: Bump VERSION to 3.00 050d6e9434 BaseTools: Delete CLANG38 from tools_def.template 128547b081 BaseTools: Remove CLANG35 toolchain from tools_def.template 4ef4b81c9b BaseTools: As with CLANGDWARF IA32 and X64, use lld for ARM and AARCH64 98edce75fa BaseTools: Add ARM and AARCH64 CLANGDWARF support in tools_def.template 0fc07b1c6a BaseTools/Conf/tools_def.template: Add section for deprecated toolchains 01225075db Add GCC and GCCNOLTO toolchains to tools_def.txt and update packages 66803cafcf BaseTools: Update VS toolchain descriptions in tools_def.txt.template d7c6030a47 BaseTools: Remove EBC (EFI Byte Code) compiler definitions 8b441847e3 BaseTools: Remove unused IPHONE_TOOLS and SOURCERY_CYGWIN_TOOLS defs ba634ce82b edksetup.bat: Remove VS2008-VS2013 remnants c844d86bee MdePkg: Remove VS2008-VS2013 remnants c3ac3301e9 BaseTools: Remove VS2008-VS2013 remnants 0363584ac9 BaseTools: Remove VS2008, 2010, 2012 and 2013 toolchain definitions 94c802e108 MdePkg/BasePeCoffLib: Deal with broken debug directories ff7cb2d7c9 .pytool: Support FDT library. 5d586606c7 MdePkg: Support FDT library. 10416bf46e Tianocore: Support FDT library. d992a05ade Maintainers.txt: Update for IntelFsp2Pkg and IntelFsp2WrapperPkg. ... changelog too long, skipping 312 lines ... issue be fixed. ==== php8 ==== Version update (8.2.7 -> 8.2.8) Subpackages: php8-cli php8-ctype php8-dom php8-gd php8-gettext php8-iconv php8-mbstring php8-mysql php8-openssl php8-pdo php8-sqlite php8-tokenizer php8-xmlreader php8-xmlwriter - version update to 8.2.8 * This is a bug fix release. * https://www.php.net/ChangeLog-8.php#8.2.8 - modified patches % php-sort-filelist-phar.patch (refreshed) ==== python-rich ==== - %{?sle15_python_module_pythons} mut be at beginning to work. ==== qalculate ==== Version update (4.6.1 -> 4.7.0) Subpackages: libqalculate22 qalculate-data - version update to 4.7.0 * Support for custom default angle unit, e.g. turn, arcsec, arcmin * Append default angle unit (instead of always radians) when converting value without unit to angle unit * More consistent addition and removal of angle unit from function arguments * Always interpret ./, .*, and .^ as entrywise operators if user intention is unclear * Change order of operations to place entrywise and ordinary operators on the same precedence level * Add function, kron(), for Kronecker product, and constants for Pauli matrices * Add radius to planets dataset and update other properties * Support replacement of unknown variables within variable values * Fix besselj(0, 0) * Fix incomplete calculation in tan() with try exact approximation * Fix 0/0=0 equality (do not return true) and output of 2/0 (and similar) * Fixes and improvements for newtonsolve() and secantsolve() * Fix segfault when MathStructure is deleted after Calculator, and in destructor of calculated DynamicVariable (called from Calculator destructor) * Do not save mode on exit if "-defaults" command line switch where used (CLI) * Allow multiple actions for keyboard shortcuts (GTK, Qt) * Add toggle precision, and min, max, or min and max decimals to available shortcut and button actions (GTK, Qt) * Add option to exclude units for unformatted ASCII copy (GTK, Qt) * Add optional value to copy result action, allowing expression copy and formatting selection (GTK, Qt) * Fix copy unformatted ASCII when local digit group separator is same as selected decimal separator (GTK, Qt) * Add option to automatically copy result (Qt) * Always set (primary) selection clipboard contents when whole expression is selected or selection is cleared, e.g. after calculation (Qt) * Improve support dark mode and high contrast modes, and change default style to Fusion, on Windows (Qt) * Minor bug fixes and feature enhancements ==== sysuser-tools ==== - Add "quilt setup" friendly hint to %sysusers_requires usage It is not required to have sysuser-tools installed when working with a pkg source which uses sysuser-tools at build time. ==== tar ==== Subpackages: tar-lang tar-rmt - Update tests-skip-time01-on-32bit-time_t.patch to not run test on armv6 either ==== update-alternatives ==== Version update (1.21.8 -> 1.21.22) - openssl.patch: use openssl library for MD5 calculation instead of relying on libmd. libmd is not in Ring0 - require Perl 5.28.1 or later ==== virtualbox ==== Version update (7.0.8 -> 7.0.10) - VirtualBox 7.0.10 (released July 18 2023) This is a maintenance release. The following items were fixed and/or added: OCI: Introduced general improvements VMM: Fixed a bug while walking page tables while executing nested VMs causing flooding of the release log as a consequence (Intel hosts only, bug #21551) GUI: Added general improvements TPM: Fixed a crash when a VM has a TPM version 1.2 configured (bug #21622) 3D: Initial support for OpenGL 4.1 3D: Fixed various graphics issues with Windows 11 guests (bugs #21136, #21515) Guest Control/VBoxManage: Fixed parameter "--ignore-orphaned-processes" Guest Control/VBoxManage: Fixed behavior of how handling argument 0 for a started guest process works: One can now explicitly specify it with the newly added option "--arg0". This will effectively restore the behavior of former VirtualBox versions Audio: Also use the PulseAudio backend when pipewire-pulse is running instead of falling back to ALSA (bug #21575) NAT: Adjusted UDP proxy timeout from 18-21 to 21-24 range to respect intended 20 second timeout (bug #21560) Linux Host: Added initial support for Indirect Branch Tracking (bug #21435) Linux Host: Added initial support for kernel 6.5 (NOTE: Guest Additions do not support kernel 6.5 yet) Linux Host and Guest: Improved condition check when kernel modules need to be signed Linux Host and Guest: Added initial support for RHEL 8.8 (bug #21692), 8.9 (bug #21690) and 9.3 (bugs #21598 and #21671) kernels Linux Guest Additions: Fixed issue when kernel modules were rebuilt on each boot when guest system has no X11 installed Linux Guest Additions: Added initial support for kernel 6.4 Linux Guest Additions: Fixed issue when vboxvideo module reloading caused kernel panic in some guests (bug #21740) Linux Guest Additions: Introduced general improvements in the installer area Windows Guest Additions: Introduced general improvements in graphics drivers area removed "fixes_for_kernel_6.4.patch" as this is fixed upstream Fix issue with kernel on newer CPU (boo#1212209) ==== virtualbox-kmp ==== Version update (7.0.8_k6.4.3_1 -> 7.0.10_k6.4.4_1) - VirtualBox 7.0.10 (released July 18 2023) This is a maintenance release. The following items were fixed and/or added: OCI: Introduced general improvements VMM: Fixed a bug while walking page tables while executing nested VMs causing flooding of the release log as a consequence (Intel hosts only, bug #21551) GUI: Added general improvements TPM: Fixed a crash when a VM has a TPM version 1.2 configured (bug #21622) 3D: Initial support for OpenGL 4.1 3D: Fixed various graphics issues with Windows 11 guests (bugs #21136, #21515) Guest Control/VBoxManage: Fixed parameter "--ignore-orphaned-processes" Guest Control/VBoxManage: Fixed behavior of how handling argument 0 for a started guest process works: One can now explicitly specify it with the newly added option "--arg0". This will effectively restore the behavior of former VirtualBox versions Audio: Also use the PulseAudio backend when pipewire-pulse is running instead of falling back to ALSA (bug #21575) NAT: Adjusted UDP proxy timeout from 18-21 to 21-24 range to respect intended 20 second timeout (bug #21560) Linux Host: Added initial support for Indirect Branch Tracking (bug #21435) Linux Host: Added initial support for kernel 6.5 (NOTE: Guest Additions do not support kernel 6.5 yet) Linux Host and Guest: Improved condition check when kernel modules need to be signed Linux Host and Guest: Added initial support for RHEL 8.8 (bug #21692), 8.9 (bug #21690) and 9.3 (bugs #21598 and #21671) kernels Linux Guest Additions: Fixed issue when kernel modules were rebuilt on each boot when guest system has no X11 installed Linux Guest Additions: Added initial support for kernel 6.4 Linux Guest Additions: Fixed issue when vboxvideo module reloading caused kernel panic in some guests (bug #21740) Linux Guest Additions: Introduced general improvements in the installer area Windows Guest Additions: Introduced general improvements in graphics drivers area removed "fixes_for_kernel_6.4.patch" as this is fixed upstream Fix issue with kernel on newer CPU (boo#1212209) ==== webkit2gtk3 ==== Version update (2.40.3 -> 2.40.4) Subpackages: WebKitGTK-4.1-lang libjavascriptcoregtk-4_1-0 libwebkit2gtk-4_1-0 typelib-1_0-JavaScriptCore-4_1 typelib-1_0-WebKit2-4_1 webkit2gtk-4_1-injected-bundles - Update to version 2.40.4: + Fix a bug in JavaScript reading variable arguments in a call. ==== webkit2gtk3-soup2 ==== Version update (2.40.3 -> 2.40.4) Subpackages: WebKitGTK-4.0-lang libjavascriptcoregtk-4_0-18 libwebkit2gtk-4_0-37 webkit2gtk-4_0-injected-bundles - Update to version 2.40.4: + Fix a bug in JavaScript reading variable arguments in a call.

1 0

New package submission for Factory: xdp-tools
by Shung-Hsi Yu 25 Jul '23

25 Jul '23

Hi, I'd like to submit a new package from network to Factory. The package is xdp-tools, which consists of utilities, helper library, and example programs for use with eXpress Data Path (XDP). XDP is a high performance and user-programmable network data path in the Linux kernel, supported since Linux Kernel v4.8. It allows bypassing the kernel's networking stack for performance, but still preserve the possibility of failing back to the network stack if needed; while the user-programmable part are done with eBPF programs. xdp-tools packaged itself provides a few utilities that are powered by XDP under the hood: - xdpdump: a tcpdump-like tool that captures packet - xdp-filter: packet filtering utility with drop rates up to tens of millions of packets per second per core - xdp-trafficgen: network traffic generator that can generate millions of packets per second per core - xdp-loader: simple loader for XDP program with support for attaching multiple XDP program to the same interface - xdp-monitor: monitors and display various XDP related statistics and events - xdp-bench: XDP benchmarking tool It also comes with a helper library libxdp that does the heavy lifting and libxdp-devel that provides the programming interface for those who needs finer control. This is a bit of a late addition. When libbpf (which is in Factory) remove its support for AF_XDP in 2021, the features are moved in libxdp[1]; so in an ideal world xdp-tools should have already been added back then. But better later then never :) Shung-Hsi 1: https://github.com/libbpf/libbpf/wiki/Libbpf:-the-road-to-v1.0#xskch-is-mov…

3 3

New Tumbleweed snapshot 20230719 released!
by Dominique Leuenberger 25 Jul '23

25 Jul '23

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: 7zip cheese (44.0.1 -> 44.1) dracut (059+suse.447.g9d1fc722 -> 059+suse.476.g5e324584) exiv2 kmod libX11 (1.8.5 -> 1.8.6) libstorage-ng (4.5.123 -> 4.5.127) libwebp (1.3.0 -> 1.3.1) libyajl openexr pipewire (0.3.72 -> 0.3.74) qemu (8.0.2 -> 8.0.3) setools systemd (253.5 -> 253.7) systemd-presets-branding-openSUSE taglib (1.13 -> 1.13.1) xkeyboard-config (2.38 -> 2.39) yast2-trans (84.87.20230708.d1de37aed1 -> 84.87.20230714.966688ddd0) === Details === ==== 7zip ==== - Enable ARM64 ASM introduced in 23.01 ==== cheese ==== Version update (44.0.1 -> 44.1) Subpackages: cheese-lang libcheese-common libcheese-gtk25 libcheese8 typelib-1_0-Cheese-3_0 - Update to version 44.1: + Update AppStream metadata. + Updated translations. ==== dracut ==== Version update (059+suse.447.g9d1fc722 -> 059+suse.476.g5e324584) - Update to version 059+suse.476.g5e324584: This is the 2nd backport of the most important fixes and features from the upstream master branch, while the release date of version 060 is still undefined. Features: * feat(network-wicked): remove module * feat(systemd-rfkill): remove module * feat(livenet): add memory size check depending on live image size * feat(nvmf): add code for parsing the NBFT Fixes: * fix(systemd-sysext): handle confexts and correct extensions search path * fix(modsign): load keys to correct keyring * fix(dmsquash-live-autooverlay): specify filesystemtype when it is already known * fix(fs-lib): remove quoting form the first argument of the e2fsck call * fix(Makefile): remove leftover rpm build rules * fix(Makefile): no longer upload to kernel.org * fix(nvmf): support /etc/nvme/config.json * fix(nvmf): install 8021q module unconditionally * fix(install.d): respect even more kernel-install vars, plus style fixes * fix(install.d): respect more kernel-install env variables * fix(dracut.sh): also prevent fsfreeze for tmpfs * fix(dmsquash-live): allow other fstypes * fix(bluetooth): make bluetooth rules more strict * fix(bluetooth): add missing files * fix(bluetooth): include it if Appearance matches the value assigned for keyboard * fix(btrfs): do not require module via cmdline when --no-kernel * fix(btrfs): add missing cmdline function Other: * refactor(dracut-init.sh): remove redundant "dracut" from "dracut module" prints * refactor(virtiofs): remove exit after die * build: remove rpm spec file and build rules * docs: remove rd.lvm.snapsize and rd.lvm.snapshot * chore(gentoo.conf): remove examples to avoid confusion * chore: remove git2spec.pl, it is no longer used ==== exiv2 ==== - add exiv2-metadata-null-checks.patch fixes gwenview crashes and other apps https://github.com/Exiv2/exiv2/issues/2638 ==== kmod ==== Subpackages: kmod-bash-completion libkmod2 - Edit usr-lib-modules.patch to /lib/modules provide fallback behavior for successfully running `make modules_install` in pristine tarballs. ==== libX11 ==== Version update (1.8.5 -> 1.8.6) Subpackages: libX11-6 libX11-data libX11-xcb1 - update to 1.8.6: * InitExt.c: Add bounds checks for extension request, event, & error codes * Fixes CVE-2023-3138: X servers could return values from XQueryExtension that would cause Xlib to write entries out-of-bounds of the arrays to store them, though this would only overwrite other parts of the Display struct, not outside the bounds allocated for that structure. - drop U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch (upstream) ==== libstorage-ng ==== Version update (4.5.123 -> 4.5.127) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#941 - added get_version_string function - 4.5.127 - merge gh#openSUSE/libstorage-ng#940 - wait for block device before using blkdiscard - 4.5.126 - merge gh#openSUSE/libstorage-ng#939 - wait for block device before using wipefs (bsc#1213420) - coding style - 4.5.125 - Translated using Weblate (Georgian) (bsc#1149754) - 4.5.124 ==== libwebp ==== Version update (1.3.0 -> 1.3.1) Subpackages: libsharpyuv0 libwebp7 libwebpdemux2 libwebpmux3 - Update to version 1.3.1: * security fixes for lossless encoder (CVE-2023-1999) * improve error reporting through WebPPicture error codes * fix upsampling for RGB565 and RGBA4444 in NEON builds * img2webp: add -sharp_yuv & -near_lossless * fix webp_js with emcc >= 3.1.27 (stack size change) * CMake fixes * further updates to the container and lossless bitstream docs - Drop libwebp-double-free.patch: fixed upstream. ==== libyajl ==== - add libyajl-CVE-2023-33460.patch (CVE-2023-33460, bsc#1212928) ==== openexr ==== Subpackages: libIex-3_1-30 libIlmThread-3_1-30 libOpenEXR-3_1-30 - Add patch to fix regression on non-SSE architectures https://github.com/AcademySoftwareFoundation/openexr/issues/1460: * 1488.patch - Also disable 'DWA[AB]Compression' test on aarch64 as the patch above fixes the issue for all targets, except aarch64 ==== pipewire ==== Version update (0.3.72 -> 0.3.74) Subpackages: gstreamer-plugin-pipewire libpipewire-0_3-0 pipewire-alsa pipewire-jack pipewire-lang pipewire-libjack-0_3 pipewire-modules-0_3 pipewire-pulseaudio pipewire-spa-plugins-0_2 pipewire-spa-tools pipewire-tools - Update to version 0.3.74: * Highlights - Fix a critical bug where audio to bluetooth devices would cut out randomly. - Improve RAOP compatibility. - Avoid crashes after an update. - Small fixes and improvements. * PipeWire - Mix info on port is now created explicitly. - Remove the node as a driver peer when stopping. This caused some problem with playback on and other remote bluetooth devices. - Work on avoiding crashes when loading new modules that use internal API with old libpipewire. This is typical after an update where the old library is still loaded by an application but when a new stream is created, updated modules are loaded. * Modules - The RTP source module now has an option to ignore the SSRC, which is useful to continue to receive the stream when the sender is restarted. - The native protocol will refuse to load twice now instead of silently ignoring the error. - module-raop is compatible with more devices. * SPA - plugins will now warn when running out of buffers. This is always a bad thing. - Merge scope based cleanup macros. - Add ratelimit function. - Update to version 0.3.73: * Highlights - Fixes an ALSA resume after suspend error. - Handle and disable seemingly wrong hires timestamps from ALSA. - Filter-chain now has loadable plugin modules. The LV2 and sofa plugins are moved to a separate .so file to make things more modular. - Rate changes in the graph should now be handled more gracefully by loopback and filter-chain. - A regression in the rtp-sap module was fixed where it would in some cases fail to start. - A potential crash in the peaks resampler was fixed. - Many cleanups and other small bug fixes. * PipeWire - Fix a potential segfault when no fallback driver was set in the config. - Improve OPUS detection. - Add ASYNC flag to pw-filter and pw-stream when queue/dequeue is not called from the process function. This ensure we allocate an extra buffer. - Discard pending process callbacks when disconnecting. - Cleanups and improvements to the debug environment variable parsing. - The graph rate was tweaked to better handle very low rates Â such as those requested by pavucontrol when it does the signal monitoring. * Modules - An example filter module was added. - Filter-chain and loopback now disable the resamplers if no rate is specified and will always follow the graph rate. - Improve setup of filter-chain. The graph is now created when starting because this ensure the target graph rate is known. - Filter-chain can now link notify ports to control ports in the graph. - Filter-chain now has loadable plugin modules. The LV2 and sofa plugins are moved to a separate .so file. - A regression in the rtp-sap module was fixed where it would in some cases fail to start. - Module-rt now has options to disable rlimits, portal and rtkit. - module-raop-discover now has an options to set the latency. * Tools - pw-cat now supports overriding all stream properties. * SPA - Disable rate negotiation when the resampler is disabled. We will always follow the graph rate. - Set device.icon property for UCM ports as well. - Improve ALSA recover when using hires timestamps. This fixes some problems after resume from suspend. - ALSA will now warn and disable hires timestamp when they seem wrong. They can also be disabled manually with a property. - V4l2 will now gracefully handle ENOTTY when enumerating frame sizes and frame rates. - A potential crash in the peaks resampler was fixed. * pulse-server - A client crash in pavucontrol is avoided by always setting a card name. - The graph rate is now taken correctly when using the FIX flags. - An option was added to ignore the FIX flags of a stream. Also the documentation for those options was updated. - module-raop-discover now support latency_msec. * Bluetooth - Remove an assert and issue a warning/recover instead when a buffer is too small. * GStreamer - The device provider does locking when destroying the registry. ==== qemu ==== Version update (8.0.2 -> 8.0.3) Subpackages: qemu-accel-tcg-x86 qemu-audio-spice qemu-block-curl qemu-block-nfs qemu-block-rbd qemu-chardev-spice qemu-guest-agent qemu-hw-display-qxl qemu-hw-display-virtio-gpu qemu-hw-display-virtio-gpu-pci qemu-hw-display-virtio-vga qemu-hw-usb-host qemu-hw-usb-redirect qemu-hw-usb-smartcard qemu-img qemu-ipxe qemu-ksm qemu-lang qemu-microvm qemu-pr-helper qemu-seabios qemu-tools qemu-ui-curses qemu-ui-gtk qemu-ui-opengl qemu-ui-spice-app qemu-ui-spice-core qemu-vgabios qemu-x86 - Update to version 8.0.3: * See full log: https://lists.nongnu.org/archive/html/qemu-stable/2023-07/msg00086.html * Security issues fixed: - 9pfs: prevent opening special files (CVE-2023-2861) - vhost-vdpa (CVE-2023-3301) * Use the official xkb name for Arabic layout, not the legacy synonym (bsc#1212966) * [openSUSE][RPM] Update to version 8.0.3 ==== setools ==== Subpackages: python311-setools setools-console - Add python3-setuptools as a runtime requirement of python3-setools (boo#1213305) ==== systemd ==== Version update (253.5 -> 253.7) Subpackages: libsystemd0 libsystemd0-32bit libudev1 systemd-32bit systemd-container systemd-coredump systemd-lang udev - Import commit 2dac0aff9ced1eca0cd11c24e264b33095ee5a5e (merge of v253.7) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/6458c066547eaadf0e9709e441ea36a… - Import commit 6458c066547eaadf0e9709e441ea36ad03faa860 (merge of v253.6) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/07bb12a282b0ea378850934c4a76008… - Drop 5002-Revert-core-service-when-resetting-PID-also-reset-kn.patch, it's been backported to v253.6. - Move a bunch of files from systemd to udev. These are pretty useless without block devices. ==== systemd-presets-branding-openSUSE ==== - enable the various libvirt modular daemons (boo#1212195) ==== taglib ==== Version update (1.13 -> 1.13.1) Subpackages: libtag1 libtag_c0 - Update to version 1.13.1: * Fixed parsing of TXXX frames without description. * Detect MP4 atoms with invalid length or type. * Do not miss ID3v2 frames when an extended header is present. * Use property "DISCSUBTITLE" for ID3v2 "TSST" frame. * Build system improvements: Use absolute path for macOS dylib install name, support --define-prefix when using pkg-config, fixed minimum required CppUnit version. * Code clean up using clang-tidy. ==== xkeyboard-config ==== Version update (2.38 -> 2.39) Subpackages: xkeyboard-config-lang - Update to version 2.39 * another bugfix release; also needed for changes for the Amharic (am_ET.UTF-8) compose key sequences in libX11 1.8.5 (see corresponding changelog entry in libX11 package); removes old remappings like ar --> ara (git db45bd75, 470ad2cd) [breaks current qemu build] ==== yast2-trans ==== Version update (84.87.20230708.d1de37aed1 -> 84.87.20230714.966688ddd0) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sr yast2-trans-sv yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20230714.966688ddd0: * Translated using Weblate (Indonesian) * Translated using Weblate (Indonesian) * Translated using Weblate (Indonesian)

1 0

kernel 6.4.x and power management on kaby lake
by Michal Hlavac 24 Jul '23

24 Jul '23

Hi, I have Dell xps 9560 with kaby lake CPU. After upgrading to kernel 6.4.x suspend to ram does not work when power suply is disconnected. when I disconnect power suply I get errors: [Ne júl 23 11:35:28 2023] ata2: SATA link down (SStatus 4 SControl 300) [Ne júl 23 11:35:30 2023] pci 0000:01:00.0: not ready 1023ms after resume; waiting [Ne júl 23 11:35:31 2023] pci 0000:01:00.0: not ready 2047ms after resume; waiting [Ne júl 23 11:35:33 2023] pci 0000:01:00.0: not ready 4095ms after resume; waiting [Ne júl 23 11:35:38 2023] pci 0000:01:00.0: not ready 8191ms after resume; waiting [Ne júl 23 11:35:46 2023] pci 0000:01:00.0: not ready 16383ms after resume; waiting [Ne júl 23 11:36:03 2023] pci 0000:01:00.0: not ready 32767ms after resume; waiting [Ne júl 23 11:36:38 2023] pci 0000:01:00.0: not ready 65535ms after resume; giving up [Ne júl 23 11:36:38 2023] pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible [Ne júl 23 11:36:38 2023] pci 0000:01:00.0: Unable to change power state from D3cold to D0, device inaccessible lspci 01:00.0 3D controller: NVIDIA Corporation GP107M [GeForce GTX 1050 Mobile] (rev a1) Do I have to create kernel bug or do you have any hints what can I do. thanks, miso

2 2

New package: kubo
by Bernhard M. Wiedemann 24 Jul '23

24 Jul '23

Hi fellow Geekos, I'm submitting kubo (formerly go-ipfs) to Factory: https://build.opensuse.org/request/show/1099919 This allows to access the InterPlanetary FileSystem (IPFS) either as fixed immuntable content like /ipfs/bafybeigjlurskpf5c5rguw5ywynx4pzzhehjipw7stgvl2gqi4ykxrfdji or via dynamic references to the above, e.g. as ipfs ls /ipns/opensuse.zq1.de/ also available as FUSE mount via ipfs mount https://github.com/ipfs/kubo/blob/master/docs/fuse.md Below the surface it uses a DHT to locate chunks identified by their hash and like bittorrent it re-shares downloaded chunks, which can help distributing files to a large userbase. Ciao Bernhard M.

3 2

Kernel 6.4.3 comes with lockdown enabled
by Frank Krüger 23 Jul '23

23 Jul '23

JFYI: Kernel 6.4.3-3.g5ab030f-default from Kernel:stable has lockdown enabled (i.e. "cat /sys/kernel/security/lockdown -> integrity"), which was announced some time ago. Since hibernation is not working in this case with secure boot enabled, is there any solution in sight? Thx. Regards, Frank

3 5