February 2024 - openSUSE Factory - openSUSE Mailing Lists

20240209 postfix.service broken
by Joe Salmeri 12 Feb '24

12 Feb '24

postfix.service fails to start after update to 20240209 /usr/bin/systemd-sysusers --replace=/usr/lib/sysusers.d/postfix-user.conf - Executing upgrade-configuration. postfix: fatal: bad string length 0 < 1: myhostname = Updating /etc/sysconfig/postfix ... Updating /etc/sysconfig/mail ... I do not have any custom changes to the default configuration systemctl start postfix.service Job for postfix.service failed because the control process exited with error code. See "systemctl status postfix.service" and "journalctl -xeu postfix.service" for details. systemctl status postfix.service × postfix.service - Postfix Mail Transport Agent Loaded: loaded (/usr/lib/systemd/system/postfix.service; enabled; preset: enabled) Active: failed (Result: exit-code) since Mon 2024-02-12 18:01:09 EST; 7s ago Process: 15425 ExecStartPre=/bin/echo Starting mail service (Postfix) (code=exited, status=0/SUCCESS) Process: 15430 ExecStartPre=/usr/bin/touch /var/spool/postfix/pid/master.pid (code=exited, status=0/SUCCESS) Process: 15433 ExecStartPre=/sbin/restorecon -Rv /var/spool/postfix/pid/master.pid (code=exited, status=0/SUCCESS) Process: 15436 ExecStartPre=/usr/lib/postfix/systemd/config_postfix (code=exited, status=0/SUCCESS) Process: 15441 ExecStartPre=/usr/lib/postfix/systemd/update_chroot (code=exited, status=0/SUCCESS) Process: 15445 ExecStartPre=/usr/lib/postfix/systemd/update_postmaps (code=exited, status=0/SUCCESS) Process: 15471 ExecStart=/usr/sbin/postfix start (code=exited, status=1/FAILURE) Process: 15472 ExecStopPost=/usr/lib/postfix/systemd/cond_slp deregister (code=exited, status=0/SUCCESS) CPU: 319ms postfix/postmap[15457]: fatal: bad string length 0 < 1: myhostname = update_postmaps[15464]: postalias: fatal: bad string length 0 < 1: myhostname = postfix/postalias[15464]: fatal: bad string length 0 < 1: myhostname = update_postmaps[15467]: postalias: fatal: bad string length 0 < 1: myhostname = postfix/postalias[15467]: fatal: bad string length 0 < 1: myhostname = postfix[15471]: postfix: fatal: bad string length 0 < 1: myhostname = postfix[15471]: fatal: bad string length 0 < 1: myhostname = systemd[1]: postfix.service: Control process exited, code=exited, status=1/FAILU> systemd[1]: postfix.service: Failed with result 'exit-code'. systemd[1]: Failed to start Postfix Mail Transport Agent. Do you want a bug report ? -- Regards, Joe

1 0

Tighten permissions for DRM render nodes (/dev/dri/renderD128)
by Wolfgang Frisch 11 Feb '24

11 Feb '24

Hi, DRM render nodes [1] provide an interface for unprivileged GPU operations such as video encoding or off-screen rendering. They are currently world-writable in Factory: > crw-rw-rw- root:render /dev/dri/renderD128 This configuration allows every user, even `nobody`, to access the GPU drivers, cause load on the hardware and exploit hypothetical driver bugs. To our *current knowledge* this does not represent a security vulnerability. But given enough time and energy it very well might. It certainly does increase a local attack surface unnecessarily. Given the complexity of graphics drivers, maintaining such open permissions seems imprudent. While mode 0666 is the default [2], upstream has also been supporting an alternative configuration with mode 0660 and uaccess ACLs [3]. For context, here's how other distributions manage this: > Debian: mode 660 with uaccess > Ubuntu: mode 660 with uaccess > Fedora: mode 666 A submission [4] is underway to switch openSUSE Factory to this alternative configuration. This will result in Factory having these permissions: > crw-rw----+ root:render /dev/dri/renderD128 The impact of this change is likely to be zero for most users. If you have any workloads that depend on unprivileged GPU operations, you can simply add your user to the `render` group. Specific scenarios include: - Remote GPU access via ssh - Local GPU access by non-interactive users that aren't part of the render group yet, e.g. system users, cron jobs or `su` to another user. Best regards Wolfgang [1] https://dri.freedesktop.org/docs/drm/gpu/drm-uapi.html#render-nodes [2] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [3] https://github.com/systemd/systemd/blob/a3f5976ded023257f6299ca07b9749fd148… [4] https://build.opensuse.org/request/show/1128161 -- Wolfgang Frisch <wolfgang.frisch(a)suse.com> Security Engineer OpenPGP fingerprint: A2E6 B7D4 53E9 544F BC13 D26B D9B3 56BD 4D4A 2D15 SUSE Software Solutions Germany GmbH Maxfeldstr. 5, 90409 Nuremberg, Germany (HRB 36809, AG Nürnberg) Managing Director: Felix Imendörffer

6 10

New Tumbleweed snapshot 20240209 released!
by Dominique Leuenberger 11 Feb '24

11 Feb '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: SDL2 (2.28.5 -> 2.30.0) c-ares (1.20.1 -> 1.26.0) distribution-logos-openSUSE (20230921 -> 20240207) fwupd (1.9.12 -> 1.9.13) gstreamer-plugins-bad libzypp (17.31.28 -> 17.31.31) lzip (1.23 -> 1.24) man numactl (2.0.17.8.g67984e5 -> 2.0.18.0.g3871b1c) polkit-default-privs (1550+20231213.09963a4 -> 1550+20240207.d833f4b) postgresql postgresql16 (16.1 -> 16.2) pulseaudio (16.1 -> 17.0) python-mysqlclient (2.2.1 -> 2.2.4) python-typing_extensions selinux-policy (20240116 -> 20240205) yast2-network (5.0.1 -> 5.0.2) === Details === ==== SDL2 ==== Version update (2.28.5 -> 2.30.0) - Update to release 2.30 * Added support for 2 bits-per-pixel indexed surface formats. * Added the function SDL_GameControllerGetSteamHandle() to get the Steam API handle for a controller, if available. * Added the event SDL_CONTROLLERSTEAMHANDLEUPDATED which is sent when the Steam API handle for a controller changes. This could also change the name, VID, and PID of the controller. * Added the environment variable SDL_LOGGING to control default log output. ==== c-ares ==== Version update (1.20.1 -> 1.26.0) - Ensure multibuild flavors result in different src names. - c-ares 1.26.0: * Event Thread support. Integrators are no longer required to monitor the file descriptors registered by c-ares for events and call ares_process() when enabling the event thread feature via ARES_OPT_EVENT_THREAD passed to ares_init_options(). * Added flags to are_dns_parse() to force RAW packet parsing * Mark ares_fds() as deprecated * Bug fixes - move tests into a build flavor to avoid gtest/gmock build loop - Update to version 1.25 Changes: o Rewrite ares_strsplit() as a wrapper for ares__buf_split() for memory safety reasons. o The ahost utility now uses ares_getaddrinfo() and returns both IPv4 and IPv6 addresses by default. Bug Fixes: o Tests: Live reverse lookups for Google's public DNS servers no longer return results, replace with CloudFlare pubic DNS servers. o Connection failures should increment the server failure count first or a retry might be enqueued to the same server o On systems that don't implement the ability to enumerate network interfaces the stubs used the wrong prototype. o Fix minor warnings and documentation typos o Fix support for older GoogleTest versions o getrandom() may require sys/random.h on some systems. o Fix building tests with symbol hiding enabled. - 0001-Use-RPM-compiler-options.patch: dropped, obsolete - Update to version 1.24 Features: * Add support for IPv6 link-local DNS servers. Nameserver formats can now accept the 0face suffix, and a new ares_get_servers_csv() function was added to return servers that can contain the link-local interface name. Changes: * Unbundle GoogleTest for test cases. Package maintainers will now need torequire GoogleTest (GMock) as a build dependency if building tests. New GoogleTest versions require C++14 or later. * Replace nameserver parsing code to use new memory-safe functions. * Replace the sortlist parser with new memory-safe functions. * Various warning fixes and dead code removal. Bugfixes: * Old Linux versions require POSIX_C_SOURCE or _GNU_SOURCE to compile with thread safety support * A non-responsive DNS server that caused timeouts wouldn't increment thefailure count, this would lead to other servers not being tried. Regression introduced in 1.22.0 * Some projects that depend on c-ares expect invalid parameter option valuespassed into ares_init_options() to simply be ignored. This behavior has been restored * getrandom() can fail if the kernel doesn't support the syscall, fall back to another random source * ares_cancel() when performing ares_gethostbyname() or ares_getaddrinfo()with AF_UNSPEC, if called after one address class was returned but before the other address class, it would return ARES_SUCCESS rather than ARES_ECANCELLED - disable-live-tests.patch: dropped, not needed - Update to version 1.23 Features: Introduce optional (but on by default) thread-safety for the c-ares library. This has no API nor ABI implications. resolv.conf in modern systems uses attempts and timeouts options instead of the old retrans and retry options. Query caching support based on TTL of responses. Can be enabled via ares_init_options() with ARES_OPT_QUERY_CACHE. Bugfixes: ares_init_options() for ARES_OPT_UDP_PORT and ARES_OPT_TCP_PORT accept theport in host byte order, but it was reading it as network byte order. Regression introduced in 1.20.0. ares_init_options() for ARES_FLAG_NOSEARCH was not being honored forares_getaddrinfo() or ares_gethostbyname(). Regression introduced in 1.16.0. Autotools MacOS and iOS version check was failing Environment variables passed to c-ares are meant to be an override for system configuration. Regression introduced in 1.22.0. Spelling fixes as detected by codespell. The timeout returned by ares_timeout() was truncated to milliseconds butvalidated to microseconds which could cause a user to attempt to process timeouts prior to the timeout actually expiring. CMake was not honoring CXXFLAGS passed in via the environment which couldcause compile and link errors with distribution hardening flags during packaging. Fix Windows UWP and Cygwin compilation. ares_set_servers_*() for legacy reasons needs to accept an empty server listand zero out all servers. This results in an inoperable channel and thus is only used in simulation testing, but we don't want to break users. Regression introduced in 1.21.0. Changes in version 1.22.1 Bugfixes: Fix /etc/hosts processing performance with all entries using same IPaddress. Large hosts files using the same IP address for all entries could use exponential time. Fix typos in manpages Fix OpenWatcom building Changes in version 1.22.0 Features: ares_reinit() is now implemented to re-read any system configuration and immediately apply to an existing ares channel The adig command line program has been rewritten and its format now more closely matches that of BIND's dig utility The new DNS message parser and writer functions have now been made public RFC9460 HTTPS and SVCB records are now supported RFC6698 TLSA records are now supported The server list is now internally dynamic and can be changed without impacting existing queries Hosts file processing is now cached until the file is detected to be changed to speed up repetitive lookups of large hosts files Changes: Internally all DNS messages are now written using the new DNS writing functions EDNS is now enabled by default Internal cleanups in function prototypes Bugfixes: Randomize retry penalties to prevent thundering herd issues when dns servers throttle requests Fix Windows build error for missing if_indextoname() - update to 1.21.0: * Replace multiple DNS hand-made parsers with new memory-safe DNS message parser * developer visible changes and bug fixes ==== distribution-logos-openSUSE ==== Version update (20230921 -> 20240207) Subpackages: distribution-logos-openSUSE-Tumbleweed distribution-logos-openSUSE-icons - switch to a service using zstd - list the source url - Update Leap 15.6 branding poo#131666 ==== fwupd ==== Version update (1.9.12 -> 1.9.13) Subpackages: fwupd-bash-completion fwupd-lang libfwupd2 typelib-1_0-Fwupd-2_0 - Update to version 1.9.13: + This release adds the following features: - Add a timer inhibit if the daemon took a long time to startup. - Add a concept of 'Test Mode' rather than enabling specific plugins. - Do not idle-quit the daemon if there is a connected D-Bus client. + This release fixes the following bugs: - Allow plugins to opt-out of the child-device first depsolve. - Allow setting multiple flags in LVFS::DeviceFlags. - Do not migrate config comments for removed keys. - Do not request the Advantech BMC to reboot. - Do not warn the user about ESP when using MBR. - Fix a critical warning when adding a PixArt wireless device. - Fix migration of legacy config files. - Only save config values to the mutable config file. - Parse DS-20 descriptors earlier in device setup. - Store the version format in the history database to fix offline reports. - Use the correct GUID for matching realtek-mst and parade-lspcon. + This release adds support for the following hardware: - GoodWay Acer Dock. ==== gstreamer-plugins-bad ==== Subpackages: gstreamer-plugins-bad-lang libgstadaptivedemux-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstplayer-1_0-0 libgstsctp-1_0-0 libgsttranscoder-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0 - Require libvpl only on supported architectures (x86_64 and aarch64) ==== libzypp ==== Version update (17.31.28 -> 17.31.31) - tui: allow to access the underlying ostream of out::Info. - Add MLSep: Helper to produce not-NL-terminated multi line output. - version 17.31.31 (22) - applydeltaprm: Create target directory if it does not exist (bsc#1219442) - Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514) - Fix problems with EINTR in ExternalDataSource::getline (fixes bsc#1215698) - version 17.31.30 (22) - CheckAccessDeleted: fix running_in_container detection (bsc#1218782) - Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime (bsc#1218831) - Make Wakeup class EINTR safe. - Add a way to cancel media operations on shutdown (openSUSE/zypper#522) This patch adds a mechanism to signal libzypp that a shutdown was requested, usually when CTRL+C was pressed by the user. Currently only the media backend will utilize this, but can be extended to all code paths that use g_poll() to wait for events. - Manually poll fds for curl in MediaCurl. Using curl_easy_perform does not give us the required control on when we want to cancel a download. Switching to the MultiCurl implementation with a external poll() event loop will give us much more freedom and helps us to improve our Ctrl+C handling. - Move reusable curl poll code to curlhelper.h. - version 17.31.29 (22) ==== lzip ==== Version update (1.23 -> 1.24) - Update to release 1.24 * Added the command-line switches --empty-error and - -marking-error * The option -o/--output now preserves dates, permissions, and ownership of the file when (de)compressing exactly one file. * The option -o/--output now creates missing intermediate directories when writing to a file. ==== man ==== - Make lua scriplets more failsafe (boo#1219370) ==== numactl ==== Version update (2.0.17.8.g67984e5 -> 2.0.18.0.g3871b1c) Subpackages: libnuma1 - Update to version 2.0.18.0.g3871b1c: * Increase version number to 2.0.18 * man pages: fix table include preprocessor ==== polkit-default-privs ==== Version update (1550+20231213.09963a4 -> 1550+20240207.d833f4b) - Update to version 1550+20240207.d833f4b: * profiles: remove no longer used device-rebind action ==== postgresql ==== Subpackages: postgresql-contrib postgresql-server - bsc#1219340: Require fillup. ==== postgresql16 ==== Version update (16.1 -> 16.2) Subpackages: libpq5 postgresql16-contrib postgresql16-server - Upgrade to 16.2: * bsc#1219679, CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY. One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent refresh on that view, the view's owner could control code executed with the privileges of the user running REFRESH. Fix things so that all user-determined code is run as the view's owner, as expected * If you use GIN indexes, you may need to reindex after updating to this release. * LLVM 18 is now supported. * https://www.postgresql.org/docs/release/16.2/ ==== pulseaudio ==== Version update (16.1 -> 17.0) Subpackages: libpulse-mainloop-glib0 libpulse0 pulseaudio-setup pulseaudio-utils system-user-pulse - Update to version 17.0: * Updates to ALSA UCM-based setups * Battery level indication to Bluetooth devices * Support for the Bluetooth FastStream codec * webrtc-audio-processing dependency updated * Trigger role groups added to module-role-cork * XDG base directory spec for profile-set loading * PA_RATE_MAX increased * webrtc-audio-processing dependency updated For details, see: https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/17.0/ - Drop obsoleted patches: echo-cancel-add-webrtc-AEC3-support.patch build-sys-Bump-cpp_std-to-c-17.patch build-sys-Bump-webrtc-audio-processing-dependency.patch ==== python-mysqlclient ==== Version update (2.2.1 -> 2.2.4) - update to 2.2.4: * Support ssl=True in connect(). ==== python-typing_extensions ==== - Add backport-recent-implementation-of-protocol.patch upstream patch gh#python/typing_extensions@004b893ddce2 ==== selinux-policy ==== Version update (20240116 -> 20240205) Subpackages: selinux-policy-targeted - Update to version 20240205: * Allow gpg manage rpm cache * Allow login_userdomain name_bind to howl and xmsg udp ports * Allow rules for confined users logged in plasma * Label /dev/iommu with iommu_device_t * Remove duplicate file context entries in /run * Dontaudit getty and plymouth the checkpoint_restore capability * Allow su domains write login records * Revert "Allow su domains write login records" * Allow login_userdomain delete session dbusd tmp socket files * Allow unix dgram sendto between exim processes * Allow su domains write login records * Allow smbd_t to watch user_home_dir_t if samba_enable_home_dirs is on * Allow chronyd-restricted read chronyd key files * Allow conntrackd_t to use bpf capability2 * Allow systemd-networkd manage its runtime socket files * Allow init_t nnp domain transition to colord_t * Allow polkit status systemd services * nova: Fix duplicate declarations * Allow httpd work with PrivateTmp * Add interfaces for watching and reading ifconfig_var_run_t * Allow collectd read raw fixed disk device * Allow collectd read udev pid files * Set correct label on /etc/pki/pki-tomcat/kra * Allow systemd domains watch system dbus pid socket files * Allow certmonger read network sysctls * Allow mdadm list stratisd data directories * Allow syslog to run unconfined scripts conditionally * Allow syslogd_t nnp_transition to syslogd_unconfined_script_t * Allow qatlib set attributes of vfio device files * Allow systemd-sleep set attributes of efivarfs files * Allow samba-dcerpcd read public files * Allow spamd_update_t the sys_ptrace capability in user namespace * Allow bluetooth devices work with alsa * Allow alsa get attributes filesystems with extended attributes * Allow hypervkvp_t write access to NetworkManager_etc_rw_t * Add interface for write-only access to NetworkManager rw conf * Allow systemd-sleep send a message to syslog over a unix dgram socket * Allow init create and use netlink netfilter socket * Allow qatlib load kernel modules * Allow qatlib run lspci * Allow qatlib manage its private runtime socket files * Allow qatlib read/write vfio devices * Label /etc/redis.conf with redis_conf_t * Remove the lockdown-class rules from the policy * Allow init read all non-security socket files * Replace redundant dnsmasq pattern macros * Remove unneeded symlink perms in dnsmasq.if * Add additions to dnsmasq interface * Allow nvme_stas_t create and use netlink kobject uevent socket * Allow collectd connect to statsd port * Allow keepalived_t to use sys_ptrace of cap_userns * Allow dovecot_auth_t connect to postgresql using UNIX socket * Make named_zone_t and named_var_run_t a part of the mountpoint attribute * Allow sysadm execute traceroute in sysadm_t domain using sudo * Allow sysadm execute tcpdump in sysadm_t domain using sudo * Allow opafm search nfs directories * Add support for syslogd unconfined scripts * Allow gpsd use /dev/gnss devices * Allow gpg read rpm cache * Allow virtqemud additional permissions * Allow virtqemud manage its private lock files * Allow virtqemud use the io_uring api * Allow ddclient send e-mail notifications * Allow postfix_master_t map postfix data files * Allow init create and use vsock sockets * Allow thumb_t append to init unix domain stream sockets * Label /dev/vas with vas_device_t * Create interface selinux_watch_config and add it to SELinux users * Update cifs interfaces to include fs_search_auto_mountpoints() * Allow sudodomain read var auth files * Allow spamd_update_t read hardware state information * Allow virtnetworkd domain transition on tc command execution * Allow sendmail MTA connect to sendmail LDA * Allow auditd read all domains process state * Allow rsync read network sysctls * Add dhcpcd bpf capability to run bpf programs * Dontaudit systemd-hwdb dac_override capability * Allow systemd-sleep create efivarfs files * Allow map xserver_tmpfs_t files when xserver_clients_write_xshm is on * Allow graphical applications work in Wayland * Allow kdump work with PrivateTmp * Allow dovecot-auth work with PrivateTmp * Allow nfsd get attributes of all filesystems * Allow unconfined_domain_type use io_uring cmd on domain * ci: Only run Rawhide revdeps tests on the rawhide branch * Label /var/run/auditd.state as auditd_var_run_t * Allow fido-device-onboard (FDO) read the crack database * Allow ip an explicit domain transition to other domains * Label /usr/libexec/selinux/selinux-autorelabel with semanage_exec_t * Allow winbind_rpcd_t processes access when samba_export_all_* is on * Enable NetworkManager and dhclient to use initramfs-configured DHCP connection * Allow ntp to bind and connect to ntske port. ==== yast2-network ==== Version update (5.0.1 -> 5.0.2) - Consider firmware configured interfaces as non bridgeable (bsc#1218595). - 5.0.2

1 0

BOINC and NVIDIA
by Ed Goforth 11 Feb '24

11 Feb '24

Since the latest Tumbleweed update, BOINC is no longer recognizing my NVIDIA card. farmville:~ # cat /etc/os-release NAME="openSUSE Tumbleweed" # VERSION="20240209" ID="opensuse-tumbleweed" ID_LIKE="opensuse suse" VERSION_ID="20240209" PRETTY_NAME="openSUSE Tumbleweed" ANSI_COLOR="0;32" # CPE 2.3 format, boo#1217921 CPE_NAME="cpe:2.3:o:opensuse:tumbleweed:20240209:*:*:*:*:*:*:*" #CPE 2.2 format #CPE_NAME="cpe:/o:opensuse:tumbleweed:20240209" BUG_REPORT_URL="https://bugzilla.opensuse.org" SUPPORT_URL="https://bugs.opensuse.org" HOME_URL="https://www.opensuse.org" DOCUMENTATION_URL="https://en.opensuse.org/Portal:Tumbleweed" LOGO="distributor-logo-Tumbleweed" I have not yet tried doing a rollback because there were several thousand package updates as part of that last zypper dup. The card is definitely seen and utilized by the system, and nvidia-smi, nvidia-settings and clinfo can see it. Even boinc --detect_cpus sees it, though there is a<warning>[coproc] cuMemGetInfo(0) returned 201</warning> Any suggestions?Thanks,Ed

1 0

Bug in glibc 2.39
by Larry Finger 09 Feb '24

09 Feb '24

Hi, Since the 20240202 TW snapshot, glibc 2.38 was replaced with 2.39. Since then, USB passthrou for VirtualBox has failed. This was verified by reinstalling 2.38 from the Slowroll repos to a fully updated TW system. None of the listed changes leap out as a probable cause, but I hope that this will jog the memory of one or more of the devs. The bug report is at boo#1219766. Thanks, Larry

1 0

Tumbleweed - Review of the week 2024/06
by Dominique Leuenberger 09 Feb '24

09 Feb '24

Dear Tumbleweed users and hackers, Last week’s report was written on Friday, but it was only published on Monday by accident. As it nonetheless only covered changes to Friday, I will include changes to Tumbleweed since I last WROTE a review – not since I last published one. This means this weekly review covers the six snapshots 0202, 0204…0208. This week, glibc was updated to version 2.39, and Python modules are newly also built for Python 3.12. For this kind of change, we had to give the control to rebuild the dependency chains to OBS, which in turn resulted in larger snapshots. As those updates were done, the rebuild strategy was reset to ‘rebuild packages with local source changes plus things identified by our bot needing a rebuild’ The most interesting changes of this week were: * glibc 2.39 * Python 3.12 (python modules built for it, but /usr/bin/python3 will still point to Python 3.11 for now) * Gstreamer 1.22.9 * QEmu 8.2.0 * timezone 2024a * Mesa 23.3.5 * AppArmor 3.1.7 * Linux kernel 6.7.4 With glibc and python off the queue, some of the larger changes are gone from our todo. But we’re far from done with the list – and new things keep on appearing. Just the way we like it. We are currently testing the integration of these changes: * Python 3.12.2 * A bunch of cleanup work to eliminate more of python2 (boo#1219306) * dbus-broker: a big step forward; upgrades seem to be an issue that needs to be addressed * libxml 2.12.x: slow progress * c-ares 1.26.0: The release cycle could be addressed (splitting tests out into a 2nd run). We expect to ship this soon. * GCC 14: our usual 2-phase approach to introduce it. Currently working on phase 1, meaning GCC14 will be providing the base libraries (libgcc_s1, libstdc++…). The compiler itself will stay at version 13 for now. Only one issue left: qemu fails to build; phase 2 testing has started, but will take several weeks Cheers, Dominique

1 0

Including packages in main repositories vs additional
by Michal Suchánek 09 Feb '24

09 Feb '24

maintainer-specific repositories Reply-To: In-Reply-To: <CAEg-Je8NafVZu2QUPCFKQKAEYrbjSV+oRJ40d9QSFCWXY5TDvA(a)mail.gmail.com> Hello, On Fri, Feb 09, 2024 at 08:54:18AM -0500, Neal Gompa wrote: > We also should be striving for things to be integrated in the main > repositories rather than telling people to activate random extra OBS > projects, because random repos on people's systems are just asking for > trouble in a whole new way. Should we? Apparently the Calibre maintainer wants to direct users to his repository rather than accept package changes that would make it possible to include Calibre in Leap: https://bugzilla.opensuse.org/show_bug.cgi?id=1218707 SLE is slow in taking the packages that are *really* required by Calibre (eg. there is cmake update pending) so it's not possible to include yet, anyway. Still with how the package is maintained it's not really feasible at all. If there is a goal to itegrate things into the main repositories how to tackle problems like this? Thanks Michal

2 1

New Tumbleweed snapshot 20240208 released!
by Dominique Leuenberger 09 Feb '24

09 Feb '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: gwenview5 inxi (3.3.32 -> 3.3.33) kdsoap libgit2 (1.7.1 -> 1.7.2) libidn2 (2.3.4 -> 2.3.7) libjxl (0.9.0 -> 0.9.2) libjxl-gtk (0.9.0 -> 0.9.2) libxfce4ui (4.18.4 -> 4.18.5) libxfce4util (4.18.1 -> 4.18.2) nvidia-open-driver-G06-signed openssl-1_1 openssl-3 permissions (1699_20230602 -> 1699_20240206) qt6-wayland rebootmgr (2.1 -> 2.2) spectacle systemd transmission === Details === ==== gwenview5 ==== Subpackages: gwenview5-lang - Add patch to support newer kImageAnnotator: * 0001-Support-building-against-kImageAnnotator-Qt5-as-well.patch ==== inxi ==== Version update (3.3.32 -> 3.3.33) - Updated to version 3.3.33: + /usr/share/doc/packages/inxi/inxi.changelog. ==== kdsoap ==== - Fix package docs - Fix build to handle changes in (open)SUSE specific cmake macros, no user visible changes ==== libgit2 ==== Version update (1.7.1 -> 1.7.2) - update to 1.7.2: * CVE-2024-24574: infinite loop condition given specially crafted inputs (boo#1219664) * CVE-2024-24577: arbitrary code execution due to heap corruption in git_index_add (boo#1219660) * Fix a bug in the smart transport negotiation could have caused an out-of-bounds read when a remote server did not advertise capabilities. ==== libidn2 ==== Version update (2.3.4 -> 2.3.7) Subpackages: libidn2-0 libidn2-0-32bit libidn2-lang - update to 2.3.7: * Un-deprecate idn2_to_ascii_4i and make it NUL terminate output * Export punycode APIs * Developer visible code maintenance ==== libjxl ==== Version update (0.9.0 -> 0.9.2) Subpackages: libjxl0_9 libjxl0_9-x86-64-v3 - Update to release 0.9.2 * Fixed some unspecified bugs in the gdk-pixbuf plugin ==== libjxl-gtk ==== Version update (0.9.0 -> 0.9.2) Subpackages: gdk-pixbuf-loader-jxl gimp-plugin-jxl - Update to release 0.9.2 * Fixed some unspecified bugs in the gdk-pixbuf plugin ==== libxfce4ui ==== Version update (4.18.4 -> 4.18.5) Subpackages: libxfce4kbd-private-3-0 libxfce4ui-2-0 libxfce4ui-lang libxfce4ui-tools typelib-1_0-Libxfce4ui-2_0 - Update to version 4.18.5 * Update copyright year * build: Search for bind_textdomain_codeset in libintl too * sm-client: Reset SmcConnection when IceConnection is closed on error * docs: Improve xfce_sm_client_get() * shortcuts-grabber: Fix filtering by level * shortcuts-grabber: Simplify filtering by group * shortcuts-grabber: Variable renaming * shortcuts-grabber: Filter grabbing by key level * Detect keyboard shortcuts with only single modifier keys on key release * Translation Updates ==== libxfce4util ==== Version update (4.18.1 -> 4.18.2) Subpackages: libxfce4util-lang libxfce4util7 typelib-1_0-Libxfce4util-1_0 - Update to version 4.18.2 * Update copyright year * Search for bind_textdomain_codeset in libintl too * xfce-rc: Add support for the LANGUAGE environment variable * Add missing config.h includes * Improve checksum calculation (#17) * xfce-rc: Document the fact that delimiter escaping is not supported * xfce-rc: Properly write translated entries when available * Update bug report address ==== nvidia-open-driver-G06-signed ==== - provide nvidia-open-driver-G06-kmp = %version (jsc#PED-7117) * this makes it easy to replace the package from nVidia's CUDA repository with this presigned package ==== openssl-1_1 ==== Subpackages: libopenssl1_1 - Rename engines directories to the same name like in SLE: /etc/ssl/engines1_1.d -> /etc/ssl/engines1.1.d /etc/ssl/engdef1_1.d -> /etc/ssl/engdef1.1.d * Add migration script to move files (bsc#1219562) /etc/ssl/engines.d/* -> /etc/ssl/engines1.1.d /etc/ssl/engdef.d/* -> /etc/ssl/engdef1.1.d - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch ==== openssl-3 ==== Subpackages: libopenssl3 libopenssl3-32bit libopenssl3-x86-64-v3 - Add migration script to move old files (bsc#1219562) /etc/ssl/engines.d/* -> /etc/ssl/engines1.1.d.rpmsave /etc/ssl/engdef.d/* -> /etc/ssl/engdef1.1.d.rpmsave They will be later restored by openssl-1_1 package to engines1.1.d and engdef1.1.d - Security fix: [bsc#1219243, CVE-2024-0727] * Add NULL checks where ContentInfo data can be NULL * Add openssl-CVE-2024-0727.patch ==== permissions ==== Version update (1699_20230602 -> 1699_20240206) Subpackages: chkstat permissions-config - Drop superfluous mkdir /usr/share/permissions/permissions.d This is now created by the Makefile. See also commit 5900bc1ffe6275298ded3c96dee03a5c98e4db1c - Update to version 20240206: * Whitelisting libgtop_server2 (bsc#1218921) * Removing bogus whitespaces * chkstat: harmonize and transform to a more compact coding and doc style * gitignore: also ignore hidden ctags * build: Create /usr/share/permissions/permissions.d for packagers * profiles: drop /usr/sbin/lockdev which is no longer packaged in Factory * profiles: drop /etc/ftpusers which is no longer shipped in netcfg ==== qt6-wayland ==== Subpackages: libQt6WaylandClient6 libQt6WaylandCompositor6 libQt6WaylandEglClientHwIntegration6 libQt6WaylandEglCompositorHwIntegration6 libQt6WlShellIntegration6 - Add patch to fix a frequent crash (kde#479302) * client-avoid-creating-decorations-in-the-render-thread.patch ==== rebootmgr ==== Version update (2.1 -> 2.2) - Update to version 2.2 - Make sure /run/reboot-needed get's deleted after a soft-reboot ==== spectacle ==== Subpackages: spectacle-lang - Drop meanwhile unneeeded BuildReqs on kColorPicker and kImageAnnotator ==== systemd ==== Subpackages: libsystemd0 libsystemd0-32bit libudev1 systemd-32bit systemd-boot systemd-container systemd-coredump systemd-lang udev - Drop python3-pefile dependency from the experimental package. MicroOs is fond of the experimental stuff but OTOH it doesn't ship python3. Let's drop the dependency for now, users of ukify are invited to install python3-pe manually. - Move systemd-reboot.service from udev to the main package as this service is useful in containers. ==== transmission ==== Subpackages: transmission-common transmission-gtk transmission-gtk-lang - Add correct creation of the transmission user/group (needed by the latest RPM 4.19). - Remove now useless Provides in the daemon subpackage.

1 0

Issues with Leap / Tumbleweed VMWare images?
by Johannes Kastl 09 Feb '24

09 Feb '24

Hi all, short question, are the Leap and Tumbleweed VMWare disk images (VMDK) tested automatically in some way? Are there any regressions known? For a customer I tried to get something deployed in their vSphere, but as soon as I try some automatic configuration (cloud-init), Terraform/OpenTofu spits out an issue and the machine neither gets an IP address and no user configuration. So unfortunately I cannot log in to troubleshoot... :-( When launching without cloud-init configuration the VM boots fine and shows the interactive setup screen. I also gets an IP address via DHCP. I do not want to pollute the factory list with something that is more of a support question, but the people in the know regarding openQA testing might be on this list... :-) Have a nice evening/day everyone! Johannes

2 1

New Tumbleweed snapshot 20240207 released!
by Dominique Leuenberger 08 Feb '24

08 Feb '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apparmor (3.1.6 -> 3.1.7) gcc13 imlib2 (1.12.1 -> 1.12.2) kernel-source (6.7.2 -> 6.7.4) libapparmor (3.1.6 -> 3.1.7) libgarcon (4.18.1 -> 4.18.2) microos-tools (2.21+git9 -> 2.21+git11) numactl (2.0.17.4.g63befa8 -> 2.0.17.8.g67984e5) virtualbox virtualbox-kmp (7.0.14_k6.7.2_1 -> 7.0.14_k6.7.4_1) webkit2gtk3 (2.42.4 -> 2.42.5) webkit2gtk3-soup2 (2.42.4 -> 2.42.5) yast2-installation (5.0.5 -> 5.0.6) === Details === ==== apparmor ==== Version update (3.1.6 -> 3.1.7) Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor - Update to AppArmor 3.1.7 - aa-logprof: don't skip exec events in hats - fix aa-cleanprof to work with named profiles - add permissions in various abstractions - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.7 for the full list of changes - drop upstreamed apparmor-systemd-sessions.patch ==== gcc13 ==== Subpackages: cpp13 gcc13-locale libasan8 libatomic1 libgcc_s1 libgcc_s1-32bit libgccjit0 libgfortran5 libgomp1 libhwasan0 libitm1 liblsan0 libobjc4 libquadmath0 libstdc++6 libstdc++6-32bit libstdc++6-locale libstdc++6-pp libstdc++6-pp-32bit libtsan2 libubsan1 - Use %{_target_cpu} to determine host and build. ==== imlib2 ==== Version update (1.12.1 -> 1.12.2) Subpackages: imlib2-loaders libImlib2-1 - update to 1.12.2: * Fixes for Y4M, ANI, PNG and JPG loaders ==== kernel-source ==== Version update (6.7.2 -> 6.7.4) Subpackages: kernel-default kernel-default-devel kernel-devel kernel-macros - Linux 6.7.4 (bsc#1012628). - asm-generic: make sparse happy with odd-sized put_unaligned_*() (bsc#1012628). - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (bsc#1012628). - arm64: irq: set the correct node for VMAP stack (bsc#1012628). - drivers/perf: pmuv3: don't expose SW_INCR event in sysfs (bsc#1012628). - powerpc: Fix build error due to is_valid_bugaddr() (bsc#1012628). - powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() (bsc#1012628). - powerpc/64s: Fix CONFIG_NUMA=n build due to create_section_mapping() (bsc#1012628). - x86/boot: Ignore NMIs during very early boot (bsc#1012628). - powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE (bsc#1012628). - powerpc/lib: Validate size for vector operations (bsc#1012628). - x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel (bsc#1012628). - sched/numa: Fix mm numa_scan_seq based unconditional scan (bsc#1012628). - perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file (bsc#1012628). - debugobjects: Stop accessing objects after releasing hash bucket lock (bsc#1012628). - sched/fair: Fix tg->load when offlining a CPU (bsc#1012628). - regulator: core: Only increment use_count when enable_count changes (bsc#1012628). - audit: Send netlink ACK before setting connection in auditd_set (bsc#1012628). - ACPI: tables: Correct and clean up the logic of acpi_parse_entries_array() (bsc#1012628). - ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop (bsc#1012628). - PNP: ACPI: fix fortify warning (bsc#1012628). - ACPI: extlog: fix NULL pointer dereference check (bsc#1012628). - selftests/nolibc: fix testcase status alignment (bsc#1012628). - ACPI: NUMA: Fix the logic of getting the fake_pxm value (bsc#1012628). - kunit: tool: fix parsing of test attributes (bsc#1012628). - kunit: Reset test->priv after each param iteration (bsc#1012628). - PM / devfreq: Synchronize devfreq_monitor_[start/stop] (bsc#1012628). - ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events (bsc#1012628). - OPP: The level field is always of unsigned int type (bsc#1012628). - thermal: core: Fix thermal zone suspend-resume synchronization (bsc#1012628). - FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree (bsc#1012628). - UBSAN: array-index-out-of-bounds in dtSplitRoot (bsc#1012628). - jfs: fix slab-out-of-bounds Read in dtSearch (bsc#1012628). - jfs: fix array-index-out-of-bounds in dbAdjTree (bsc#1012628). - jfs: fix uaf in jfs_evict_inode (bsc#1012628). - hwrng: starfive - Fix dev_err_probe return error (bsc#1012628). - crypto: p10-aes-gcm - Avoid -Wstringop-overflow warnings (bsc#1012628). - pstore/ram: Fix crash when setting number of cpus to an odd number (bsc#1012628). - erofs: fix up compacted indexes for block size < 4096 (bsc#1012628). - crypto: starfive - Fix dev_err_probe return error (bsc#1012628). - crypto: octeontx2 - Fix cptvf driver cleanup (bsc#1012628). - erofs: fix ztailpacking for subpage compressed blocks (bsc#1012628). - crypto: stm32/crc32 - fix parsing list of devices (bsc#1012628). - afs: fix the usage of read_seqbegin_or_lock() in afs_lookup_volume_rcu() (bsc#1012628). - rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() (bsc#1012628). - jfs: fix array-index-out-of-bounds in diNewExt (bsc#1012628). - s390/boot: always align vmalloc area on segment boundary (bsc#1012628). - arch: consolidate arch_irq_work_raise prototypes (bsc#1012628). - arch: fix asm-offsets.c building with -Wmissing-prototypes (bsc#1012628). - s390/vfio-ap: fix sysfs status attribute for AP queue devices (bsc#1012628). - s390/ptrace: handle setting of fpc register correctly (bsc#1012628). - KVM: s390: fix setting of fpc register (bsc#1012628). - sysctl: Fix out of bounds access for empty sysctl registers (bsc#1012628). - SUNRPC: Fix a suspicious RCU usage warning (bsc#1012628). - ext4: treat end of range as exclusive in ext4_zero_range() (bsc#1012628). - smb: client: fix renaming of reparse points (bsc#1012628). - smb: client: fix hardlinking of reparse points (bsc#1012628). - cifs: fix in logging in cifs_chan_update_iface (bsc#1012628). - ecryptfs: Reject casefold directory inodes (bsc#1012628). - ext4: fix inconsistent between segment fstrim and full fstrim (bsc#1012628). - ext4: unify the type of flexbg_size to unsigned int (bsc#1012628). - ext4: remove unnecessary check from alloc_flex_gd() (bsc#1012628). ... changelog too long, skipping 1153 lines ... - commit f71b395 ==== libapparmor ==== Version update (3.1.6 -> 3.1.7) - Update to AppArmor 3.1.7 - aa-logprof: don't skip exec events in hats - fix aa-cleanprof to work with named profiles - add permissions in various abstractions - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.1.7 for the full list of changes - drop upstreamed apparmor-systemd-sessions.patch ==== libgarcon ==== Version update (4.18.1 -> 4.18.2) Subpackages: libgarcon-1-0 libgarcon-data libgarcon-lang - Update to version 4.18.2 * Update copyright year * garcon-gtk: Remove weak ref on GarconMenu on finalize() * Use target desktop files instead of symlinks (Fixes #1) * garcon-gtk: Avoid populating a wrong menu * garcon-gtk: Prevent use-after-free when loading garcon menu * Add icon at 64px, clean up SVG metadata * Translation Updates ==== microos-tools ==== Version update (2.21+git9 -> 2.21+git11) - Update to version 2.21+git11: * Install man-online alias only for bash ==== numactl ==== Version update (2.0.17.4.g63befa8 -> 2.0.17.8.g67984e5) Subpackages: libnuma1 - Update to version 2.0.17.8.g67984e5: * numastat: Print package version number instead of own. * numastat: Remove commented out perl code * Check for MPOL_PREFERRED_MANY lazily * libnuma: add numa_set_mempolicy_home_node API ==== virtualbox ==== - Fix build on Leap 15.6. ==== virtualbox-kmp ==== Version update (7.0.14_k6.7.2_1 -> 7.0.14_k6.7.4_1) - Fix build on Leap 15.6. ==== webkit2gtk3 ==== Version update (2.42.4 -> 2.42.5) Subpackages: WebKitGTK-4.1-lang libjavascriptcoregtk-4_1-0 libwebkit2gtk-4_1-0 typelib-1_0-JavaScriptCore-4_1 typelib-1_0-WebKit2-4_1 webkit2gtk-4_1-injected-bundles - Update to version 2.42.5 (boo#1219604): + Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI. + Ignore stops with offset zero before last one when rendering gradients with cairo. + Write bwrapinfo.json to disk for xdg-desktop-portal. + Fix gamepads detection by correctly handling focused window in GTK4. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213. - Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream. - Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86 architectures. ==== webkit2gtk3-soup2 ==== Version update (2.42.4 -> 2.42.5) Subpackages: WebKitGTK-4.0-lang libjavascriptcoregtk-4_0-18 libwebkit2gtk-4_0-37 webkit2gtk-4_0-injected-bundles - Update to version 2.42.5 (boo#1219604): + Fix webkit_web_context_allow_tls_certificate_for_host to handle IPv6 URIs produced by SoupURI. + Ignore stops with offset zero before last one when rendering gradients with cairo. + Write bwrapinfo.json to disk for xdg-desktop-portal. + Fix gamepads detection by correctly handling focused window in GTK4. + Fix several crashes and rendering issues. + Security fixes: CVE-2024-23222, CVE-2024-23206, CVE-2024-23213. - Drop webkit2gtk3-CVE-2024-23222.patch: fixed upstream. - Add webkit2gtk3-llint-build-fix.patch: fix the build for non-x86 architectures. ==== yast2-installation ==== Version update (5.0.5 -> 5.0.6) - Restore the selected products after reloading the package manager, properly install all products for new modules and extensions when upgrading from SLE12 (bsc#1218391) - 5.0.6

1 0