January 2024 - openSUSE Factory - openSUSE Mailing Lists

Tighten permissions for DRM render nodes (/dev/dri/renderD128)
by Wolfgang Frisch 11 Feb '24

11 Feb '24

Hi, DRM render nodes [1] provide an interface for unprivileged GPU operations such as video encoding or off-screen rendering. They are currently world-writable in Factory: > crw-rw-rw- root:render /dev/dri/renderD128 This configuration allows every user, even `nobody`, to access the GPU drivers, cause load on the hardware and exploit hypothetical driver bugs. To our *current knowledge* this does not represent a security vulnerability. But given enough time and energy it very well might. It certainly does increase a local attack surface unnecessarily. Given the complexity of graphics drivers, maintaining such open permissions seems imprudent. While mode 0666 is the default [2], upstream has also been supporting an alternative configuration with mode 0660 and uaccess ACLs [3]. For context, here's how other distributions manage this: > Debian: mode 660 with uaccess > Ubuntu: mode 660 with uaccess > Fedora: mode 666 A submission [4] is underway to switch openSUSE Factory to this alternative configuration. This will result in Factory having these permissions: > crw-rw----+ root:render /dev/dri/renderD128 The impact of this change is likely to be zero for most users. If you have any workloads that depend on unprivileged GPU operations, you can simply add your user to the `render` group. Specific scenarios include: - Remote GPU access via ssh - Local GPU access by non-interactive users that aren't part of the render group yet, e.g. system users, cron jobs or `su` to another user. Best regards Wolfgang [1] https://dri.freedesktop.org/docs/drm/gpu/drm-uapi.html#render-nodes [2] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [3] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [4] https://build.opensuse.org/request/show/1128161 -- Wolfgang Frisch <wolfgang.frisch(a)suse.com> Security Engineer OpenPGP fingerprint: A2E6 B7D4 53E9 544F BC13 D26B D9B3 56BD 4D4A 2D15 SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nuremberg, Germany (HRB 36809, AG Nürnberg) Managing Director: Felix Imendörffer

6 10

RPM 4.19 soon in Factory (packaging changes inside)
by Ana Guerrero Lopez 06 Feb '24

06 Feb '24

Dear Tumbleweed hackers and packagers, After a lengthy staging period, RPM 4.19 is shaping up and all issues noticed in the rings (packages guaranteed to build/be installable) have been addressed or have fixes pending. As you are all aware, the rings cover only about 20% of the packages in Factory. The release notes for RPM 4.19 are at https://rpm.org/wiki/Releases/4.19.0 Out of the RPM release notes (https://rpm.org/wiki/Releases/4.19.0) the two most noteworthy bullets are: * Any non-root ownership in the %files section (through %attr() or %defattr()) now generates an automatic dependency on the named user and/or group. This dependency can be satisfied by another package shipping a sysusers.d(5) file or the /etc/passwd and /etc/group files themselves. Existing packages shipping any of these files will have to be rebuilt with RPM 4.19 in order for them to carry the respective user and/or group provides. This may require distro-level coordination to ensure proper installation of all the affected packages. For more information, please consult the manual. * %patch without arguments (previously an alias to %patch 0) is now a build error (use %patch N instead) The %patch one is rather simple and results in a build failure; monitoring your devel packages should give you hints very soon if your package is impacted. We created submit requests for most, if not all, packages affected by that in the last months. The story around the users can be trickier to be identified, as the build might succeed, but the package not being installable at the end due to missing dependencies reported. This usually happens when users are generated in %pre scripts using useradd. Either convert those packages to use sysusers.d ( https://en.opensuse.org/openSUSE:Packaging_guidelines#Users_and_Groups) or, as a quickest measure, usually helpful if no other package relies on the same users, manually add the respective Provides: user(USERNAME) and Provides: group(GROUPNAME) to the package generating the relevant user (as done for example in cluster-glue, https://build.opensuse.org/request/show/1138101 for reference) If you have any questions or need with your package, the opensuse-packaging mailing list is always at your disposal. Ana, on behalf of the Release Team

18 30

Installation without import previous user data
by Obs Geeko 01 Feb '24

01 Feb '24

Hello everyone, When install TW/Leap, I don't want to import previous user ssh keys. In "Local Uesers" step, the "Import User Data from a Previous Installation" is un-checked as default. But in installation summary step, "import SSH Host Keys and Configuration" is checked as default. So if we do not de-select it, it will import previous ssh keys. Does it conflict with "Local Uesers" step? "Import User Data" means not include ssh keys? I found this is not only happens recently in Tumbleweed, Leap 15.4, 15.5 also have this problem. Thank you. Best regards.

4 3

How Factory or ALP Workbench select bootstrap packages?
by Obs Geeko 31 Jan '24

31 Jan '24

Hello, May I ask how do you select packages for "SUSE:ALP:Workbench:1.0", to make it can be built everything else from itself? Is there scripts to do so? I notice some revision's comment like "initial import", "initial import needed for building eigen3:docs,eigen3", etc. How do you solve dependency problem? Manually? Another similar question: May I ask how do you select bootstrap package for "Rings:0-Bootstrap", "Rings:1-MinimalX"? Thank you.

3 4

package for sale: libx86
by Stefan Seyfried 31 Jan '24

31 Jan '24

Hi all, I just learned via bug 1219395 that I am still listed as the maintainer of libx86. I last touched that package 16 years ago, and I don't think that it is still needed today. So if someone thinks it should be kept, it's up for grabs. If not, it's https://build.opensuse.org/request/show/1143135 Have fun, seife -- Stefan Seyfried "For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." -- Richard Feynman

1 0

[opensuse-factory] reproducible builds status 2024-01
by Bernhard M. Wiedemann 31 Jan '24

31 Jan '24

Hi, I made some more nice patches this month and even found bugs in meson and qt6. Here are the autogenerated bits: last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2023-12/ I uploaded https://rb.zq1.de/compare.factory-20240131/ today https://rb.zq1.de/spec/glossar.txt explains the meaning of below values: total-packages: 15212 (+46) build-tried: 15189 (+48) build-failed: 111 (+1) build-n-a: 230 (-3) build-succeeded: 14848 (+50) build-official-failed+na: 95 (+0) build-compare-failed: 166 (-6) build-compare-succeeded: 14682 (+56) verify-failed: 15 (+0) verified-semi-reproducible: 20 (+1) verified-bit-identical: 0 (+0) bit-by-bit-identical: 14082 (+66) not-bit-by-bit-identical: 768 (-15) not-bit-by-bit-identicalcheck: 766 (-16) https://rb.zq1.de/compare.factory-20240131/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 4 were in ring0 32 were in ring1 That makes it 36/3850 => 0.94 % which is below the overall average of 166/14848 => 1.12 % 768/14848 => 5.17 % of packages are not perfectly bit-reproducible package notes: ==> ./aws-c-common/.rb.notes <== FTBFS-j1 osc build --noservice --vm-type=kvm -j1 standard ==> ./cartridges/.rb.notes <== FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./cockpit/.rb.notes <== filesys (from python) /usr/lib/python3.11/site-packages/cockpit/data/cockpit-bridge.beipack.xz ==> ./emacs/.rb.notes <== = https://lists.gnu.org/archive/html/emacs-devel/2024-01/msg00464.html ==> ./impression/.rb.notes <== FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./libjcat/.rb.notes <== => SR 1138082 = https://bugzilla.opensuse.org/show_bug.cgi?id=1218715 crypto ==> ./loupe/.rb.notes <== rust/llvm ==> ./mumble/.rb.notes <== => SR 1141433 #=> https://github.com/mumble-voip/mumble/pull/6147 filesys (python listdir) ==> ./objectweb-asm/.rb.notes <== javadoc toolchain filesys readdir order ; strip-nd ==> ./presenterm/.rb.notes <== rust/llvm ==> ./python-grpcio/.rb.notes <== #=> https://github.com/grpc/grpc/pull/35687 sort filesys ==> ./perl-DateTime-TimeZone/.rb.notes <== FTBFS-j1 osc build --clean --no-preinstallimage --noservice --vm-type=kvm --alternative-project home:bmwiedemann:reproducible -j1 openSUSE_Tumbleweed ==> ./python-rjsmin/.rb.notes <== => SR 1137474 var_rjsmin_methods 4-byte diff ==> ./qt6-declarative/.rb.notes <== /usr/lib64/libQt6QuickDialogs2QuickImpl.so.6.4.2 differs in ELF sections order variation in qtdeclarative-everywhere-src-6.4.2/build/build.ninja , ColorDialog_qml.cpp from qmlcachegen ==> ./qt6-virtualkeyboard/.rb.notes <== = https://bugreports.qt.io/browse/QTBUG-121643 parallelism ==> ./scala/.rb.notes <== filesys in /usr/share/java/scala/scala-compiler.jar/scala/tools/nsc/fsc/CompileSocket.class ==> ./tbb/.rb.notes <== stuck tests FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./woodstox-core/.rb.notes <== javadoc toolchain filesys

1 0

New Tumbleweed snapshot 20240130 released!
by Dominique Leuenberger 31 Jan '24

31 Jan '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaFirefox apache2 apache2-manual apache2-prefork apache2-utils apparmor cryptsetup (2.6.1 -> 2.7.0) duktape firewalld (2.1.0 -> 2.1.1) fwupd (1.9.11 -> 1.9.12) kernel-firmware (20240115 -> 20240126) libapparmor libjcat (0.2.0 -> 0.2.1) mdevctl (1.2.0 -> 1.3.0) mutter numactl (2.0.16.21.g693fee1 -> 2.0.17.4.g63befa8) openssl-3 openssl python-argcomplete (3.2.1 -> 3.2.2) python-authheaders (0.16.1 -> 0.16.2) python-pyOpenSSL (23.3.0 -> 24.0.0) strace (6.6 -> 6.7) xdg-utils (1.2.0~beta1+20230929 -> 1.2.0+20240130) xf86-video-qxl xorg-x11-server xterm (388 -> 389) === Details === ==== MozillaFirefox ==== Subpackages: MozillaFirefox-translations-common - Fix file list ==== apache2 ==== - use grep -E for egrep ==== apache2-manual ==== - use grep -E for egrep ==== apache2-prefork ==== - use grep -E for egrep ==== apache2-utils ==== - use grep -E for egrep ==== apparmor ==== Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor - Add dovecot-unix_chkpwd.diff to allow dovecot-auth to execute unix_chkpwd, and add a profile for unix_chkpwd. This is needed for PAM 1.6 (boo#1219139) - Refresh apparmor.keyring - the key was renewed ==== cryptsetup ==== Version update (2.6.1 -> 2.7.0) Subpackages: cryptsetup-doc cryptsetup-lang libcryptsetup12 - Update to 2.7.0: * Full changelog in: mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.7/v2.7.0-ReleaseNotes * Introduce support for hardware OPAL disk encryption. * plain mode: Set default cipher to aes-xts-plain64 and password hashing to sha256. * Allow activation (open), luksResume, and luksAddKey to use the volume key stored in a keyring. * Allow to store volume key to a user-specified keyring in open and luksResume commands. * Do not flush IO operations if resize grows the device. This can help performance in specific cases where the encrypted device is extended automatically while running many IO operations. * Use only half of detected free memory for Argon2 PBKDF on systems without swap (for LUKS2 new keyslot or format operations). * Add the possibility to specify a directory for external LUKS2 token handlers (plugins). * Do not allow reencryption/decryption on LUKS2 devices with authenticated encryption or hardware (OPAL) encryption. * Do not fail LUKS format if the operation was interrupted on subsequent device wipe. * Fix the LUKS2 keyslot option to be used while activating the device by a token. * Properly report if the dm-verity device cannot be activated due to the inability to verify the signed root hash (ENOKEY). * Fix to check passphrase for selected keyslot only when adding new keyslot. * Fix to not wipe the keyslot area before in-place overwrite. * bitlk: Fix segfaults when attempting to verify the volume key. * Add --disable-blkid command line option to avoid blkid device check. * Add support for the meson build system. * Fix wipe operation that overwrites the whole device if used for LUKS2 header with no keyslot area. * Fix luksErase to work with detached LUKS header. * Disallow the use of internal kernel crypto driver names in "capi" specification. * Fix reencryption to fail early for unknown cipher. * tcrypt: Support new Blake2 hash for VeraCrypt. * tcrypt: use hash values as substring for limiting KDF check. * Add Aria cipher support and block size info. * Do not decrease PBKDF parameters if the user forces them. * Support OpenSSL 3.2 Argon2 implementation. * Add support for Argon2 from libgcrypt (requires yet unreleased gcrypt 1.11). * Used Argon2 PBKDF implementation is now reported in debug mode in the cryptographic backend version. For native support in OpenSSL 3.2 or libgcrypt 1.11, "argon2" is displayed. If libargon2 is used, "cryptsetup libargon2" (for embedded library) or "external libargon2" is displayed. * Link only libcrypto from OpenSSL. * Disable reencryption for Direct-Access (DAX) devices. * Print a warning message if the device is not aligned to sector size. * Fix sector size and integrity fields display for non-LUKS2 crypt devices for the status command. * Fix suspend for LUKS2 with authenticated encryption (also suspend dm-integrity device underneath). * Update keyring and locking documentation and LUKS2 specification for OPAL2 support. * Remove patches fixed upstream: - cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch - cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch - cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch ==== duktape ==== - Build with distro flags ==== firewalld ==== Version update (2.1.0 -> 2.1.1) Subpackages: firewalld-bash-completion firewalld-lang python3-firewall - update to 2.1.1: * fix(offline-cmd): use family when creating ipset (64f78a9) * fix(firewall-config): allow rich rule forwarded ports to be logged (d46ea62) * fix(ipXtables): log forwarded ports only (07dc202) * fix(nftables): log forwarded ports (5c26b73) * fix(io.ipset): raise exception if entries exceed limit (a2da5fb) * fix(policy): ipXtables: multiple policies using same zone (b6f2f09) * fix(policy): dispatch update for active policies (7f6f0e2) ==== fwupd ==== Version update (1.9.11 -> 1.9.12) Subpackages: fwupd-bash-completion fwupd-lang libfwupd2 typelib-1_0-Fwupd-2_0 - Update to version 1.9.12: + This release adds the following features: - Add remote modification support to fwupdtool - Add support for more modify-config options - Generate HTML pages for all man pages + This release fixes the following bugs: - Assume the legacy LVFS::UpdateRequestId tag is non-generic - Avoid crashing the daemon if not using udisks - Correctly mark the CPU as supported - Correctly match invalid EFI partitions - Do not change the device status until the action has completed - Do not require systemd for fwupdtool modify-config - Enable access to the home interface for snap - Fix an assertion when enabling lvfs-testing for the first time - Fix a possible crash in fwupdtool build-cabinet - Handle systems with more than one ccp device - Only check AMD CPUs for SHSTK, not IBT - Only write the mutable fwupd.conf with the current values - Re-evaluate supported every time pci-psp attributes are refreshed - Show "CET OS support" on AMD systems too + This release adds support for the following hardware: - AVer CAM340plus - AVer VB342 Pro - More Algoltek devices ==== kernel-firmware ==== Version update (20240115 -> 20240126) Subpackages: kernel-firmware-all kernel-firmware-amdgpu kernel-firmware-ath10k kernel-firmware-ath11k kernel-firmware-ath12k kernel-firmware-atheros kernel-firmware-bluetooth kernel-firmware-bnx2 kernel-firmware-brcm kernel-firmware-chelsio kernel-firmware-dpaa2 kernel-firmware-i915 kernel-firmware-intel kernel-firmware-iwlwifi kernel-firmware-liquidio kernel-firmware-marvell kernel-firmware-media kernel-firmware-mediatek kernel-firmware-mellanox kernel-firmware-mwifiex kernel-firmware-network kernel-firmware-nfp kernel-firmware-nvidia kernel-firmware-platform kernel-firmware-prestera kernel-firmware-qcom kernel-firmware-qlogic kernel-firmware-radeon kernel-firmware-realtek kernel-firmware-serial kernel-firmware-sound kernel-firmware-ti kernel-firmware-ueagle kernel-firmware-usb-network - Update to version 20240126 (git commit 8fa621d2f9c1): * qcom: Add Audio firmware for SM8650 MTP * linux-firmware: Add firmware for Cirrus CS35L41 on HP Consumer Laptops * Intel Bluetooth: Make spacing consistent with rest of WHENCE * amdgpu: update raven2 firmware * amdgpu: update raven firmware * amdgpu: update SDMA 5.2.7 firmware * amdgpu: update PSP 13.0.8 firmware * amdgpu: update VCN 3.1.2 firmware * amdgpu: update SDMA 5.2.6 firmware * amdgpu: update PSP 13.0.5 firmware * amdgpu: update GC 10.3.6 firmware * amdgpu: add GC 11.0.1 rlc_1 firmware * amdgpu: update vega20 firmware * amdgpu: update VCN 4.0.0 firmware * amdgpu: update SMU 13.0.0 firmware * amdgpu: update PSP 13.0.0 firmware * amdgpu: update GC 11.0.0 firmware * amdgpu: update vega12 firmware * amdgpu: update vega10 firmware * amdgpu: update beige goby firmware * amdgpu: update picasso firmware * amdgpu: update dimgrey cavefish firmware * amdgpu: update vangogh firmware * amdgpu: update navy flounder firmware * amdgpu: update green sardine firmware * amdgpu: update sienna cichlid firmware * amdgpu: update PSP 13.0.11 firmware * amdgpu: update GC 11.0.4 firmware * amdgpu: update VCN 4.0.2 firmware * amdgpu: update PSP 13.0.4 firmware * amdgpu: update GC 11.0.1 firmware * amdgpu: update arcturus firmware * amdgpu: update navi14 firmware * amdgpu: add VCN 4.0.3 firmware * amdgpu: add SDMA 4.4.2 firmware * amdgpu: add SMU 13.0.6 firmware * amdgpu: add PSP 13.0.6 firmware * amdgpu: Add GC 9.4.3 firmware * amdgpu: update renoir firmware * amdgpu: update VCN 4.0.4 firmware * amdgpu: update SMU 13.0.7 firmware * amdgpu: update PSP 13.0.7 firmware * amdgpu: update GC 11.0.2 firmware * amdgpu: update navi12 firmware * amdgpu: update yellow carp firmware * amdgpu: update SMU 13.0.10 firmware * amdgpu: update SDMA 6.0.3 firmware * amdgpu: update PSP 13.0.10 firmware * amdgpu: update GC 11.0.3 firmware * amdgpu: update navi10 firmware * amdgpu: update aldebaran firmware * linux-firmware: Update AMD cpu microcode * RTL8192E: Remove old realtek WiFi firmware - Update aliases ==== libapparmor ==== - Add dovecot-unix_chkpwd.diff to allow dovecot-auth to execute unix_chkpwd, and add a profile for unix_chkpwd. This is needed for PAM 1.6 (boo#1219139) - Refresh apparmor.keyring - the key was renewed ==== libjcat ==== Version update (0.2.0 -> 0.2.1) - Update to version 0.2.1: + Do not dedupe sig and sig-of-checksum when loading. + Fix the installed tests. + Show the sig-of-checksum results clearer on the CLI. ==== mdevctl ==== Version update (1.2.0 -> 1.3.0) - Update to version 1.3.0 (jsc#PED-4981): * tests: add tests for live and defined support * doc: document live support and its options * cli: add live and defined parameters to modify command * callouts: add callout live event support * main: refactor jsonfile loading * main: refactor getting active devices * tests: add callout versioning tests * callouts: add warning for unknown supported actions and events * callouts: prevent repeating unsuccessful script searches * callouts: add versioning on callout scripts * callouts: make callout method reusable * callouts: add a check_result_fn to invoke_first_matching_script * Fix new clippy warnings * Cargo.toml: move tempfile to dev-dependencies * main: assemble active devices without overwriting * mdevctl.spec.in: Add systemd as build requirement * callout: ignore broken pipe on stdin * cli: improve lsmdev help * callouts: set script in callout on success only * main: fix file open error being suppressed * Fix clippy warning for useless vec * callouts: replace negated check and improve msgs * callouts: improve debug messages in get_attributes * callouts: match code format in Display for Event and Action * tests/callouts: make scripts cross distro compliant * actions: update release action to newer versions * Bump clap to 4.0 * Bump env_logger dependency to 0.9.0 * Fix deprecated github actions * cli: change modify parameter relationships * tests: use printf over echo * tests: add callout constructor panic tests * callouts: add MDev to callout struct * callouts: Move stdin generation from Callout::invoke_script() * callouts: Add a Callout argument to the invoke callback function * callouts: Reuse Callout::callout() for get_attributes() * callouts: Return Output from Callout::callout() * callouts: Remove Callout::callout_dir() * callouts: Move self.script invocation to callout() * callouts: make Callout::invoke() a method * mdev: provide better error message for invalid attr index * mdev: change attribute index arguments to usize * cli: adjust help text for modify option addattr * modify: ensure required parameter is given * trim trailing null from callout script get-attributes output * Add --force option for commands that have callouts * Bump 'nix' dependency * tests: test 'stop' with callouts * tests: remove stray debug prints during fork * tests: make test failure reports more obvious * Bump version to 1.3.0 * undefine: report error if device is not undefined * modify: add jsonfile optional parameter * cli: add cli tests * cli: fix clap deprecations warnings * tests: fix test_modify() when auto and manual are both set * Fix panic on modify delattr with invalid index * Active attributes (#71) * clippy: remove needless borrows * mdevctl.rst: align use of term state * Add tests for callout dir priority * Add system callout script dir outside /etc. * Add ability to set env root with env variable * Rename Environment::persist_base() to config_base() * Update github checkout action * Relax 'nix' dependency version requirement * callouts: remove return value from Callout::notify() * callouts: remove separate is_dir() check in notify() * callouts: filter and map iterator in notifier loop * Update uuid version * tests: verify that callout scripts are executed in order * callouts: make sure scripts are sorted * callouts: simplify loop through callout dir * callouts: Remove call to count() on callout dir entries * Fix new clippy warnings * Fix intermittent callout failure during test * rpm: set debug env vars when running tests in rpm build * Add python3-docutils to rpm BuildRequires ==== mutter ==== Subpackages: mutter-lang - mutter-SLE-bsc984738-grab-display.patch: * Temporary disable this SLE-only patch as it makes mutter 45 lock-up on non-CSD apps (bsc#1218935) ==== numactl ==== Version update (2.0.16.21.g693fee1 -> 2.0.17.4.g63befa8) Subpackages: libnuma1 - Update to version 2.0.17.4.g63befa8: * Fix CodeQl Warn: Wrong type of arguments to formatting function * libnuma: Fix incorrect print and exit of numa_preferred/_many APIs * libnuma: Fix unexpected output * Fix README.md * Increase version number * Fix build badge * Fix README.md * Update README.md * Add configure file for release * Fix unused function return warning in numastat * fix complain() fuction print newline * Document that numa_police_memory may cause data races * Add numastat_diff from jirka-h * Enable v1 compatibility for unused getnodemask test * libnuma: Handle initialization without sysfs * Support empty memory nodes * numactl: Add --version option to print version * Remove obsolete numamon file * numactl: Use standard tab indent for print_node_cpus * Avoid using /proc/cpuinfo in test suite * numact: Add --cpu-compress option * Pin release workflow script to minimize risk of supply chain attacks * move_pages: Fix warning (missing hunk from earlier revert) * numastat: Remove unused functions * distance: Remove unused variable (NFC) * numademo: Adjust memcpy test bandwidth calculation * numactl.c: Refactor print_node_cpus to display CPU ranges * numactl.c: Refactor print_node_cpus to display CPU ranges * numactl.c: Refactor print_node_cpus to display CPU ranges * Refactor print_node_cpus to display CPU ranges instead of individual CPUs * numactl: Fix manual for --preferred and --preferred-many * Revert "Fix build error on riscv64 by linking libatomic" * Include <fcntl.h> instead of <sys/fcntl.h> * Fix the example usage in the numactl manual * Fix issue #190 about numa_exit_on_warn does not work * Create SECURITY.md * fix: fix memory leaks when run with -H * use mems allowed nodes to test prefer_many policy. * fix typo in memhog.8 * Update move_pages.c * migspeed don't have to be linked against librt * Add MPOL_F_RELATIVE/STATIC_NODES ==== openssl-3 ==== Subpackages: libopenssl3 libopenssl3-32bit libopenssl3-x86-64-v3 - Encapsulate the fips provider into a new package called libopenssl-3-fips-provider. - Added openssl-3-use-include-directive.patch so that the default /etc/ssl/openssl.cnf file will include any configuration files that other packages might place into /etc/ssl/engines3.d/ and /etc/ssl/engdef3.d/. Also create symbolic links /etc/ssl/engines.d/ and /etc/ssl/engdef.d/ to above versioned directories. - Updated spec file to create the two new necessary directores for the above patch and two symbolic links to above directories. [bsc#1194187, bsc#1207472, bsc#1218933] - Security fix: [bsc#1218810, CVE-2023-6237] * Limit the execution time of RSA public key check * Add openssl-CVE-2023-6237.patch - Rename openssl-Override-default-paths-for-the-CA-directory-tree.patch to openssl-crypto-policies-support.patch - Embed the FIPS hmac. Add openssl-FIPS-embed-hmac.patch - Load the FIPS provider and set FIPS properties implicitly. * Add openssl-Force-FIPS.patch [bsc#1217934] - Disable the fipsinstall command-line utility. * Add openssl-disable-fipsinstall.patch - Add instructions to load legacy provider in openssl.cnf. * openssl-load-legacy-provider.patch - Disable the default provider for the test suite. * openssl-Disable-default-provider-for-test-suite.patch - Security fix: [bsc#1218690, CVE-2023-6129] * POLY1305: Fix vector register clobbering on PowerPC * Add openssl-CVE-2023-6129.patch - Add patch to fix BTI enablement on aarch64: * openssl-Enable-BTI-feature-for-md5-on-aarch64.patch ==== openssl ==== - New libopenssl-fips-provider package. ==== python-argcomplete ==== Version update (3.2.1 -> 3.2.2) - update to 3.2.2: * Expand tilde in zsh ==== python-authheaders ==== Version update (0.16.1 -> 0.16.2) - update to 0.16.2: * Add checks for None results to avoid tracebacks (#31) * Account for FWS in From (which is legal, apparently) * Delete more setup.py cruft for non-supported Pythons ==== python-pyOpenSSL ==== Version update (23.3.0 -> 24.0.0) - update to 24.0.0: * Added OpenSSL.SSL.Connection.get_selected_srtp_profile to determine which SRTP profile was negotiated. #1279. ==== strace ==== Version update (6.6 -> 6.7) - Update to strace 6.7 * Implemented -kk/--stack-traces=source option for libdw-based stack tracing. * Implemented decoding of futex_wake, futex_wait, and sys_futex_requeue syscalls. * Updated lists of BPF_*, BTRFS_*, IORING_*, KVM_*, LANDLOCK_*, PR_*, and TCP_* constants. * Updated lists of ioctl commands from Linux 6.7. * Fix strace -r during the first second after booting to show correct relative timestamps. * Fix strace -f entering deadlock on exit if there are tracee processes spawned using vfork semantics. ==== xdg-utils ==== Version update (1.2.0~beta1+20230929 -> 1.2.0+20240130) - Update to Version 1.2.0 (Lining up with the upstream release) * all: Add xdg-realpath to better handle Canonicalizing filenames (#66) * xdg-open: Use url.dll as url opener on wsl (#242) * tests: Fix quoting issues in t-xdg-open.sh * xdg-open: Added a reporting issues section to xdg-open in the hopes that more issues will be attributed correctly * xdg-mime: Added a secutity note on xdg-mime default to warn against confusing openers and runners * xdg-open: Added paragraph explaining the wiered return behaviour of xdg-open * xdg-email: shellcheck * xdg-mime: shellcheck * xdg-settings: Add support for deeping-desktop browser setting in xdg-settings. * all: Fix config.status warning about ignored --datarootdir setting * all: Shellchecked xdg-utils-common.in * xdg-open: shellcheck * xdg-mime: Create a generic implementation for KDE * all: Move to markdown for README's * xdg-mime: Improve Documentation around query file/default * xdg-open: Document not handling '-' at the start of filenames * xdg-open: Deduplicate URL recognition * xdg-open: remove unused open_generic_xdg_file_mime * xdg-open: use LC_ALL=C with URLs * xdg-open: Fix URI/URL handling * xdg-email: Remove default BROWSER logic, no longer needed * xdg-mime: Improve synopsis * xdg-settings: read KDE browser settings the right way around * xdg-open: Improve WSL support * xdg-mime: actually handle lists in mimeapps.list correctly ==== xf86-video-qxl ==== - Xspice-python3.patch * for python3 interpreter needs to be /usr/bin/python3 ==== xorg-x11-server ==== Subpackages: xorg-x11-server-Xvfb xorg-x11-server-extra - no longer (build-)require obsolete Xprint/XprintUtil ==== xterm ==== Version update (388 -> 389) Subpackages: xterm-bin xterm-resize - update to 389: * interchange variables in subparameter parsing, fixing a bug where subparameters after the first parameter could be misidentified * correct popping of icon/window titles in a case where only one was pushed from patch #385 changes. * add XTQMODKEYS response in DECRQSS, as alternative for vim. * correct DECCIR encoded information on character set size, handle a VT525 quirk, and add DECST8C (Windows Terminal [#14984]). * improve DECRQCRA (prompted by discussion with James Holderness, Windows Terminal #14974). * add part of VT525 color controls: + DECAC, to update default foreground/background, respond to DECRQSS + DECATC, to respond with DECRQSS * prevent Unicode non-characters from being printed * modify send_SGR() to avoid modifying colors 16 to 255 in printed output (patch by Grady Martin). * minor cleanup of miscellaneous error-codes with ERROR_MISC. * remove legacy CSI 53 for locator status, corrected in patch * modify DECRQUPSS and DECAUPSS feature to support VT5xx character sets (report by Thomas Wolff). * improve EWMH handling (report/analysis by Edward Rosten) + reset _NET_WM_STATE_HIDDEN flag from _NET_WM_STATE before mapping the window to deiconify. + cache X properties to reduce latency (adapted from patch by Edward Rosten).

1 0

Difference between organizations “rpm” and “pool” in “src.opensuse.org”
by Obs Geeko 31 Jan '24

31 Jan '24

Hello, May I ask what are the differences between these two organizations in "src.opensuse.org"? They both have a similar package list. https://src.opensuse.org/pool https://src.opensuse.org/rpm/ By the way, will this old site continue to update? https://code.opensuse.org/group/package Thank you.

6 6

install Tumbleweed minimal without AppArmor
by Obs Geeko 31 Jan '24

31 Jan '24

Hello everyone, I got "These patterns need to be selected to install AppArmor. Please manually select the needed items to install." Product: openSUSE Tumbleweed Patterns: + Base System + Minimal Appliance Base I am using net-install with https://download.opensuse.org/tumbleweed/repo/oss/boot/x86_64/loader/{linux… to install Tumbleweed. I have de-select Pattern AppArmor, and select only "Base System" and package "zypper". Must we install AppArmor? How can we install a very minimal Tumbleweed like JeOS? Thank you. Best regards

6 6

openSUSE Release Engineering meeting 31.01.2024
by Lubos Kocman 31 Jan '24

31 Jan '24

How to join the meeting? https://calendar.opensuse.org/teams/release/events/opensuse_release_enginee… All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting ## Attendees lkocman, DimStar, GuillaumeG, ana, Max, DocB, Douglas ## Leap New Leap 15.6 with Gnome 45 was published yesterday https://openqa.opensuse.org/tests/overview?distri=opensuse&version=15.6&bui… We should start working on the Beta announcement to capture all interesting SP6 updates etc. We could use https://code.opensuse.org/leap/features/issues as an input Reminder that we have check in deadline for Leap 15.6 beta on 21st February (corresponds with SLES 15 SP6 Public Beta check in deadline) https://en.opensuse.org/openSUSE:Roadmap#Schedule_for_openSUSE_Leap_15.6 ALP Marble 6.0 was synced to OBS, I'll be working on the initial setup. https://build.opensuse.org/project/subprojects/openSUSE:Leap:Micro:6.0 de-branding in-progress In person discussion with Granite PM, on Thursday Data driven decision for migration (re-use binaries vs rebuild sources etc). PM is not keen on keeping identical packages with buildroot-only SLES/ALP packages. Desktop component awareness in ALP GnuHealth 4.4 - tracking of sr against SLES python311* https://etherpad.opensuse.org/p/gnuhealth Agama team - Scanning Leap 16 Roadmap, since they're aligning with Granite/SLATE ## openSUSE Tumbleweed (ana) openSUSE:Factory build fail stats: 65 failed 5 unresolvable (last week 76 failed, 11 unresolvable) https://tinyurl.com/ysy4nnnz Many changes going on, some of the very most relevant updates: * Linux Kernel enabled multibuild * ruby 3.3 is now the default * Update openssl 3 (still 3.1.4), many CVE fixed. * GPG2 2.4.4 * Mesa 23.3.4 * MozillaFirefox 122.0 * podman 4.9.0 lkocman: we just updated podman in SLES 15 SP6, I think we should consider 4.9.0 too * Rust 1.75 * systemtap 5.0 Updates waiting / work still in progress: * RPM 4.19.1, planning to accept it today. Packages not included in rings will need updates, see https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Dirk: do we plan a full rebuild after the RPM acceptance? I would like to have a full rebuild after python312 enablement. We should not have rpm + gcc + python312 all in a single rebuild. If the rebuild happens this week I'd be happy * Additional Python 3.12 and setuptools modules in Staging:K, blocked by RPM 4.19.1 * GCC 14 (only for runtime libraries) * Kubernetes 1.29 * QEMU 8.2.0, ovmf build to stall against this version * libxml 2.12.1 (lots of work to do), libzypp and some packages got fixed, on hold * dbus-broker as default dbus session manager, now everything builds, two openQA checks failing. * c-ares: after nodejs updates, there is an issues with a new package cycle * cmake, macro changes (DOCDIR MANDIR INFODIR) make a few packages FBTFS ## Richard (Aeon+botmaster) Not available ## Bernhard (Slowroll) * kernel-longterm expected around March * first openQA test WIP * next major version bump expected in 2-3 weeks (mid February) * Vacation 2024-02-05 to 09 ## Max Leap 15.6 - build stats in Backports: 52(was 59) faild, 67 unresolvable(was 63) * Build597.1 has been published * The remaining qt5/qt6 applications got merged for adapt to the Qt5 5.15.12 and Qt6 6.6.1 from SLE15 * Merged many python application update or deleterequests, but still, most of unresolvables were python applications, and still has many were pending in staging * The tweak of skippkg-finder and 000package-groups works, the noarch ones has been selected to ftp-tree instead of the arch-dependent ones(with an unmatched version number) * Vacation: Feb. 7-14 ## Guillaume - Arm * Tumbleweed: - Rolling - WIP: Still some packages built without PAC/BTI, two main reasons: * assembler files without PAC/BTI (usually reported upstream, e.g. openssl, gnutls, etc) * Packages built without distro flags (usually fixed in spec file) - rpmlint: https://rpmlint.opensuse.org/ * we noticed that rpmlint does not check anymore for packages built without distro %{optflags}. We should add it back. https://bugzilla.opensuse.org/show_bug.cgi?id=1217840 - WIP to get Tumbleweed to run on Lenovo X13s: * Audio: kernel config fix lost on last update. Fixed in next kernel update. * Main pieces in place. Latest status available at https://en.opensuse.org/HCL:ThinkpadX13s * Leap 15.6/Backports SP6: - No update * WSL: x86_64 is fetched from Microsoft Strore for Tumbleweed image instead of arm64. See https://bugzilla.opensuse.org/show_bug.cgi?id=1219372 lkocman: Ah thank you. I'll share that with team. Contents of the image are x86_64. Possible workaround would be a second application e.g. Leap 15 aarch64, Tumbleweed aarch64 etc ... ## Sarah - s390x Not available ## Doug * FOSDEM * All set for travel. Mobile #s exchanged * Items organized * At GNU Health Booth on Saturday & distro devroom on Sunday * Telegram group for everyone on the bus (and others from SUSE might join): https://t.me/+ZnUyy8AcJABlM2Vk Adrian: if this would be a public channel non-telegram users could access it via webbrowser. * GSoC * Application now open. Deadline Feb. 6 at 18:00 UTC * Planning Community-Summit at SUSECON * Details not confirmed yet * Working with organizers on availability of room and structure lkocman: The interesting part for us is definitely the size of the SUSECon. Last year 600 people on a physical one. Previously 1000 on virtual. * openSUSE Conference * 22 Registrations, 18 Submissions, 10 Hours * Contract signed and returned to Z-Bau * Article about visa and TSP deadline released * The Geeko Foundation is taking over TSP * Wiki updated * Waiting on donation Static * oSC24 dates June 27 to 29 reserved (Thursday - Saturday) * Open 4 Business June 26 between 2 - 6 p.m. at Franken Campus * AI topics (static) ## Dirk - various python 3.12 fallout preparations - tried to split egrep/fgrep from "grep" into a separate subpackage, reducing fallout - drop overlays over python311 on Backports SP6 is in progress Dirk: it would help if we could have all the drops in a single staging as they have common build failure root causes. ## Wolfgang (Package Hub), Scott Bahling Not available ## Maintenance team (Marcus or Maurizio (m4u)) QAM scheduled 15.6 Beta openQA setup for the next sprint, so it should be ready in mid-February according to the plan. ## Adrian - OBS The new composer/product builder discussion was covered in Max's section. Heads up: a first SR related to the composer is on the way. This is done to setup new products. ## Simon (Leap Replacement/Linarite) Not available ## Open Floor Context was that the last request took a month to be processed. Research seems to show that only a portion of people know how to process them. openSUSE membership process - should not document connect.o.o anymore in https://en.opensuse.org/openSUSE:Membership_officials

1 0