February 2024 - openSUSE Factory - openSUSE Mailing Lists

New Tumbleweed snapshot 20240228 released!
by Dominique Leuenberger 29 Feb '24

29 Feb '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: apache2 apache2-manual apache2-prefork apache2-utils apparmor cpio cups distribution-logos-openSUSE docbook-xsl dracut (059+suse.554.g6144bf71 -> 059+suse.557.g8a62bf73) file fwupd (1.9.13 -> 1.9.14) gdb gle gpsd greybird-geeko-theme gsl guile icewm icewm-theme-branding libapparmor libgpg-error (1.47 -> 1.48) libimobiledevice-glue (1.0.0+git3.20230513 -> 1.1.0+git0.20240222) libixion (0.18.1 -> 0.19.0) liborcus (0.18.1 -> 0.19.2) libstorage-ng (4.5.191 -> 4.5.193) ncurses (6.4.20240210 -> 6.4.20240224) nvidia-open-driver-G06-signed open-vm-tools rubygem-childprocess (4.1.0 -> 5.0.0) setserial slang spamassassin transfig upower (1.90.2 -> 1.90.2+15) xfsdump xmlsec1 zlib (1.3 -> 1.3.1) === Details === ==== apache2 ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== apache2-manual ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== apache2-prefork ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== apache2-utils ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== apparmor ==== Subpackages: apparmor-abstractions apparmor-docs apparmor-parser apparmor-parser-lang apparmor-profiles apparmor-utils apparmor-utils-lang python3-apparmor - Fix systemd userdb access in unix-chkpwd ==== cpio ==== Subpackages: cpio-lang cpio-mt - Use %autopatch instead of deprecated %patchN. ==== cups ==== Subpackages: cups-client cups-config libcups2 libcupsimage2 - Use %patch -P N instead of deprecated %patchN. ==== distribution-logos-openSUSE ==== Subpackages: distribution-logos-openSUSE-Tumbleweed distribution-logos-openSUSE-icons - Add handling for Leap Micro 6.X and Leap 16.X ==== docbook-xsl ==== - Use %patch -P N instead of deprecated %patchN. ==== dracut ==== Version update (059+suse.554.g6144bf71 -> 059+suse.557.g8a62bf73) - Update to version 059+suse.557.g8a62bf73: * fix(zfcp_rules): correct shellcheck regression when parsing ccw args (bsc#1220485) ==== file ==== Subpackages: file-magic libmagic1 - Prepare for RPM 4.20 ==== fwupd ==== Version update (1.9.13 -> 1.9.14) Subpackages: fwupd-bash-completion fwupd-lang libfwupd2 typelib-1_0-Fwupd-2_0 - Update to version 1.9.14: * Correctly detect ARM32 and RISC-V UEFI binaries. * Correctly migrate the database schema from very old fwupd versions. * Fix DS-20 descriptors by opening the GUsbDevice earlier. * Fix updating the fingerprint reader on the Framework 13 and 16 laptop. * Fix warning when probing devices using the metadata allowlist. * Only recover the version format for specific devices. ==== gdb ==== - Use %patch -P N instead of deprecated %patchN. - Maintenance script qa.sh: * Add PR31214 kfail. * Add kfail for fails in gdb.reverse/solib-precsave.exp / gdb.reverse/solib-reverse.exp fixed by commit fe6356def67 ("PowerPC and aarch64: Fix reverse stepping failure"). * Extend PR31004 kfail. - Don't require %{python}-base for gdb-testresults package. - Fix debuginfod handling: * Enable for sle_version >= 150400 (bsc#1185605, jsc#PED-1149, jsc#PED-1138), SLE15-SP4 and later. * Enable for suse_version >= 1600, ALP and Tumbleweed. * Add back "BuildRequires: libdebuginfod1" to prevent selecting dummy variant. * Add "BuildRequires: debuginfod-client" to prevent unresolved due to conflict with dummy variant. * Add --with-debuginfod=yes to prevent silently dropping support. - Patches added (backport from master): * gdb-testsuite-add-missing-no-prompt-anchor-in-gdb.ba.patch * gdb-testsuite-remove-spurious-in-save_vars.patch ==== gle ==== - Use SRPM base name for subpackages like -devel. - Delete old specfile constructs. - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== gpsd ==== - Use %patch -P N instead of deprecated %patchN. ==== greybird-geeko-theme ==== Subpackages: gtk2-metatheme-greybird-geeko gtk3-metatheme-greybird-geeko gtk4-metatheme-greybird-geeko metatheme-greybird-geeko-common - Use %patch -P N instead of deprecated %patchN. ==== gsl ==== Subpackages: libgsl27 libgslcblas0 - Use %patch -P N instead of deprecated %patchN. ==== guile ==== Subpackages: guile-modules-3_0 libguile-3_0-1 - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== icewm ==== Subpackages: icewm-config-upstream icewm-default icewm-lang icewm-lite - Use %patch -P N instead of deprecated %patchN. ==== icewm-theme-branding ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN - Add fix-web-browser-icon.patch: The Adwaita theme does not provide much legacy apps icon now, redirect icewm web-browser icon to the right place. See: https://gitlab.gnome.org/GNOME/adwaita-icon-theme/-/issues/163 https://gitlab.gnome.org/GNOME/adwaita-icon-theme/-/merge_requests/34/ ==== libapparmor ==== - Fix systemd userdb access in unix-chkpwd ==== libgpg-error ==== Version update (1.47 -> 1.48) Subpackages: libgpg-error0 libgpg-error0-32bit - Update to 1.48: * New configure option --with-libtool-modification. [T6619] * New option parser flag to detect commands given without a double dash. There is also the new meta command "command-mode" to set this flag via a config file. [T6978] * Added an es_fopen mode flag "sequential" with support on Windows. [rE7a42ff0ec9] * Added an es_fopen mode flag "wipe" to cleanup internal buffers at close time. [T6954] * New function gpgrt_wipememory. [T6964] * Improvements to setenv on Windows. [rE89e53ad90f] * Fixed call to estream-printf string filters. [T6737] * Many improvements to the yat2m tool. * Updates to the build system. * Interface changes relative to the 1.47 release: - ARGPARSE_FLAG_COMMAND NEW. - gpgrt_wipememory NEW. * Release-info: https://dev.gnupg.org/T6441 * Update upstream libgpg-error.keyring ==== libimobiledevice-glue ==== Version update (1.0.0+git3.20230513 -> 1.1.0+git0.20240222) - Update to version 1.1.0+git0.20240222: - Changes: * socket: Use poll() - when available - instead of select() * socket: Allow NULL as address for socket_create() and socket_connect() * win32: Remove windows.h from public headers * Add version function to interface - Bugfixes: * opack: Fixed 32bit buffer overflow * opack: Fix parsing of 32 and 64 bit packed values - Internal: * Move LIMD_GLUE_API definitions to public headers * socket: Conditionally compile using poll or select based on availability * socket: Fix select failing when the process has many file descriptors by using poll instead * win32: Fix external compilation using libimobiledevice-glue/thread.h ==== libixion ==== Version update (0.18.1 -> 0.19.0) - Update to 0.19.0: * C++ API * added support for renaming sheets after they have been created. * formula interpreter * added support for inline arrays. ==== liborcus ==== Version update (0.18.1 -> 0.19.2) - Update to orcus 0.19.2: * fixed a build issue with gcc 14 due to a missing include for std::find_if and std::for_each. * fixed a segmentation fault with the orcus-test-xml-mapped test which manifested on hppa hardware, as originally reported on https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054376. * fixed a crash when loading a document that includes a style record referencing an unnamed style record as its parent. In Excel-generated documents, styles only reference named styles as their parents. But in 3rd-party generated documents, styles referencing unnamed styles as their parents can occur. * fixed a crash when the document model returned a null pointer when a reference resolver interface was requested. - Update to orcus 0.19.1: * implemented orcus::create_filter() which instantiates a filter object of specified type. The returned object is of type orcus::iface::import_filter. * moved test cases for format detection to the respective filter test files. * fixed a bug where the import filter did not set the formula grammer prior to importing. - Update to orcus 0.19.0: * added support for allowing use of std::filesystem, std::experimental::filesystem or boost::filesystem per build configuration. * refactored styles import to use style indices returned by the document model implementer rather than using the indices stored in the file. This allows the implementer to aggregate some style records and re-use the same index for records that are stored as different records in the original file. * fixed a bug where column styles were not applied to the correct columns when the starting column index was not 0. * overhauled the Gnumeric import filter to fix many bugs and support many missing features relative to the other filters included in orcus. Most notable mentions are: * cell styles * rich-text strings * named ranges * row heights and column widths * merged cells * added partial support for Apache Parquet import filter. This is still heavily experimental. - Remove patches: * 0001-Possibility-to-build-against-a-host-of-filesystem-im.patch (upstreamed) * 0002-Allow-using-older-boost-filesystem.patch ==== libstorage-ng ==== Version update (4.5.191 -> 4.5.193) Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1 - merge gh#openSUSE/libstorage-ng#988 - allow more control of environment in SystemCmd class - 4.5.193 - merge gh#openSUSE/libstorage-ng#987 - fixed check in testsuite - 4.5.192 ==== ncurses ==== Version update (6.4.20240210 -> 6.4.20240224) Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen - Add ncurses patch 20240217 + add vt100+noapp, vt100+noapp+pc, xterm+app+pc, xterm+decedit from xterm #389 -TD + fix inconsistent description of wmouse_trafo() (Debian #1059778). + modify wenclose() to handle pads (Debian #1059783). + improve manpage discussion of mouseinterval() (Debian #1058560). - Add ncurses patch 20240224 + improve man/curs_mouse.3x style (Brandon Robinson, Sven Joachim). + provide for CCHARW_MAX greater than 1 + eliminate use of PATH_MAX in lib_trace.c + work around misconfiguration of MacPorts gcc13, which exposes invalid definition of MB_LEN_MAX in gcc's fallback copy of limits.h (MacPorts [#69374]). ==== nvidia-open-driver-G06-signed ==== - let's provide/obsolete nvidia-open-driver-G06 instead of nvidia-open-driver-G06-kmp since older versions still had conflicts to nvidia-open-driver-G06-kmp ... ==== open-vm-tools ==== Subpackages: libvmtools0 open-vm-tools-desktop - Use %patch -P N instead of deprecated %patchN. ==== rubygem-childprocess ==== Version update (4.1.0 -> 5.0.0) - ### Version 5.0.0 / 2024-01-06 * [#175](https://github.com/enkessler/childprocess/pull/175): Replace all backends by `Process.spawn` for portability, reliability and simplicity. * [#185](https://github.com/enkessler/childprocess/pull/185): Add support for Ruby 3.x ==== setserial ==== - Use %patch -P N instead of deprecated %patchN. ==== slang ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== spamassassin ==== Subpackages: perl-Mail-SpamAssassin spamassassin-spamc - Use %patch -P N instead of deprecated %patchN. ==== transfig ==== - Use %patch -P N instead of deprecated %patchN ==== upower ==== Version update (1.90.2 -> 1.90.2+15) Subpackages: libupower-glib3 typelib-1_0-UpowerGlib-1_0 upower-lang - Update to version 1.90.2+15: * Revert "ci: Update last ABI break" * Revert "build: Bump the library soname after recent changes" * Revert "all: Remove Lid handling" * Revert "lib: Remove deprecated up_client_get_devices()" * dbus: org.freedesktop.UPower: EnergyRate is a positive value * linux: Adjust test_bluetooth_le_device for dbusmock 0.30.1 * linux: stop assuming power supply of unknown type as battery * linux: drop f-literals without format string * linux: prefer is not None over != * build: make 'udevrulesdir' and 'udevhwdbdir' as Linux-only - Introduce _service obs_scm and obsinfo files for automated update service via: osc service mr ==== xfsdump ==== - Use %patch -P N instead of deprecated %patchN. ==== xmlsec1 ==== Subpackages: libxmlsec1-1 libxmlsec1-nss1 libxmlsec1-openssl1 - Use %patch -P N instead of deprecated %patchN. ==== zlib ==== Version update (1.3 -> 1.3.1) Subpackages: libminizip1 libminizip1-x86-64-v3 libz1 libz1-32bit libz1-x86-64-v3 - Use %autopatch instead of %patch - Update to 1.3.1: * Reject overflows of zip header fields in minizip * Fix bug in inflateSync() for data held in bit buffer * Add LIT_MEM define to use more memory for a small deflate speedup * Fix decision on the emission of Zip64 end records in minizip * Add bounds checking to ERR_MSG() macro, used by zError() * Neutralize zip file traversal attacks in miniunz * Fix a bug in ZLIB_DEBUG compiles in check_match() - Update pacthes: * CVE-2023-45853.patch * zlib-1.3-IBM-Z-hw-accelerated-deflate-s390x.patch

1 0

openSUSE Release Engineering meeting 28.02.2024
by Lubos Kocman 29 Feb '24

29 Feb '24

!!! HEADS UP WE WILL BE BACK USING JITSI SINCE THE NEXT MEETING !!! https://meet.opensuse.org/ReleaseEngineeringMeeting How to join the meeting? https://calendar.opensuse.org/teams/release/events/opensuse_release_enginee… All meeting minutes can be found here: https://etherpad.opensuse.org/p/ReleaseEngineering-meeting ## Attendees ana, GuillaumeG, lkocman, DocB, ddemaio, wengel ## Leap Leap 15.6 will have a new build today within few hours (ftp-tree is finishing). update: the build will be released on Friday, we fixed https://bugzilla.opensuse.org/show_bug.cgi?id=1220603 https://en.opensuse.org/openSUSE:Roadmap#Schedule_for_openSUSE_Leap_15.6 Progress on Leap Micro 6.0 building. Focusing on having self-install image built. Few more debranding needed (systemd-presets and related deps). SCC enablement for Leap Micro was questioned. DP was invited to osc2024, he was pleased to see that it's not weekend-only event. I think we should approach him with potential idea for a keynote. ## openSUSE Tumbleweed (ana) openSUSE:Factory build fail stats: 170 failed 26 unresolvable (last week 189 failed, 26 unresolvable) https://tinyurl.com/ysy4nnnz => Many (>100) are python packages that are still failing to build with Python 3.12 Most relevant updates: * Linux Kernel Longterm 6.6.18 (new in Tumbleweed!) * Linux Kernel 6.7.6 * git 2.44.0 * c-ares 1.27.0 * qemu 8.2.1 * Ruby 3.3 is now the default version * lkocman: should we give headsup to ALP? They're still based on 3.2. (I suppose Agama 7 already uses 3.3 anyway). Updates waiting / work still in progress: * RPM 4.19.11 + 4.20 * RPM 4.19.1.1 (user/group dependencies), Packages not included in rings getting updates, still some more to go, see https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… (currently about 10 missing) * Preparations for RPM 4.20, %patchN won't be supported anymore, see https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Careful: spec-cleaner 'cleans' this in the wrong direction: https://github.com/rpm-software-management/spec-cleaner/issues/319 (fixed in git, package not yet updated?) * Python: Not everything yet fixed to build with Python 3.12, removal of python 3.9 OK blocked by build failures * KDE Frameworks and Plasma 6 releasing this week, work in progress * go1.22 as default go version, blocked on i586 with packages which export CGO_ENABLED=0 and go build -buildmode pie https://github.com/golang/go/issues/64875 * systemd 255.3 ( SR#1152118) * update openSUSE-build-key (new suse container key!) SR#1150669 - blocked until key is replaced * libxml 2.12.1 (lots of work to do), on hold, remove from staging to allow security update * dbus-broker as default dbus session manager, now everything builds, two openQA checks failing. ## Richard (Aeon+botmaster) Not available ## Max Not available ## Guillaume - Arm * Tumbleweed: - Rolling - WIP: Still some packages built without PAC/BTI, two main reasons: * assembler files without PAC/BTI (usually reported upstream, e.g. openssl, gnutls, etc) * Packages built without distro flags (usually fixed in spec file) * TW installer seems to have have issues with PAC/BTI - https://bugzilla.suse.com/show_bug.cgi?id=1219717 - rpmlint: https://rpmlint.opensuse.org/ * we noticed that rpmlint does not check anymore for packages built without distro %{optflags}. We should add it back. https://bugzilla.opensuse.org/show_bug.cgi?id=1217840 * Leap 15.6/Backports SP6: - CVE for python-onnx but update impossible because of missing deps and some deps requiring newer python. https://bugzilla.opensuse.org/show_bug.cgi?id=1220313 I'll make the drop sr. * WSL: x86_64 is fetched from Microsoft Store GUI for Tumbleweed image instead of arm64. But `wsl --install openSUSE-Tumbleweed --web-download` works just fine! - https://bugzilla.opensuse.org/show_bug.cgi?id=1219372. Scott Bradnick made the instructions for Windows for Arm into image description for Tumbleweed. I believe we've also updated WSL wiki with the instrucitons. https://en.opensuse.org/openSUSE:WSL ## Sarah - s390x Not available ## Doug * Contribution Workshops * More sign ups at https://etherpad.opensuse.org/p/openSUSE-Contribution-Workshop * Episodes 2 released * Episode 3 postponed * Episode 4 - Language-specific packaging - Rust and Go provided link. Will come in March lkocman: Are we growing on numbers compared to first episode? * Dropping off some additional items to openSUSE booth organizers for Chemnitz Linux Tage * Plan to release next week SD Boot Utils article * Waiting for one more review - https://etherpad.opensuse.org/p/SD_Boot_Util * GSoC * Admins and mentors are being added to this year's session * Will published tw monthly review * Approving some TSPs * Community Summit * 4 Registrations, 4 Submissions, 2 Hours (pre-announcement) * Article published - https://news.opensuse.org/2024/02/26/community-summit-berlin/ lkocman: I was made co-speaker of Sergio's SLE Micro talk, but I'm really afraid I won't be able to make it. * openSUSE Conference * 45 Registrations, 27 Submissions, 16 Hours (4 Open 4 Business Submissions) ** I won't be available the next two weeks Static * oSC24 dates June 27 to 29 reserved (Thursday - Saturday) * Open 4 Business June 26 between 2 - 6 p.m. at Franken Campus * AI topics (static) ## Dirk Not available ## Wolfgang (Package Hub), Scott Bahling No news ## Maintenance team (Marcus or Maurizio (m4u)) Dominique: the new key seems to raise some issues - transition needs to be figured out. Marcus: I did check podman documentation and am looking if we can have temporarily two keys in parallel. Marcus: will we resign all the images on the registry or only new ones? Dominique: for rpm we usually accept both old and new key for about a half a year. lkocman: Leap Micro 6.X update channel setup will have to be done soon (within a few weeks). ## Adrian - OBS Not available lkocman: we need to cleanup accepted / rejected requests in SUSE:SLE-15-SP6:GA in OBS. lkocman doesn't have permissions to do so. Workaround would be to re-add/reject suse-sle-reviewers review. ## Simon (Leap Replacement/Linarite) Not available ## Bernhard Slowroll * kernel-longterm 6.6.18 from Factory * kernel-default should now follow Factory * first openQA test https://openqa.opensuse.org/tests/overview?distri=opensuse&version=Slowroll… * did version bump to 20240213 * OBS now has a Slowroll distribution target, so it is easy to add in devel projects ## Open Floor We'll return back to jitsi on the meeting.

1 0

slowroll is broken
by Larry Len Rainey 29 Feb '24

29 Feb '24

4 7

This RPM is bad - workaround provided
by Larry Len Rainey 29 Feb '24

29 Feb '24

2 1

New Tumbleweed snapshot 20240227 released!
by Dominique Leuenberger 28 Feb '24

28 Feb '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: MozillaFirefox (122.0.1 -> 123.0) c-ares (1.26.0 -> 1.27.0) cdparanoia chrony (4.4 -> 4.5) cronie ddskk delayacct-utils dhcp dmidecode docbook_4 drbd drbd-utils dump emacs-jinx (1.2 -> 1.3) fcitx fcitx-chewing fcitx-configtool fcitx-zhuyin fcoe-utils fltk gcin giflib (5.2.1 -> 5.2.2) git (2.43.2 -> 2.44.0) glyr gnutls libksba (1.6.5 -> 1.6.6) libunistring (1.1 -> 1.2) mokutil mozilla-nss multipath-tools (0.9.8~1+82+suse.dcd98a3 -> 0.9.8+83+suse.bcae610) npth (1.6 -> 1.7) openssh (9.3p2 -> 9.6p1) openssh-askpass-gnome (9.3p2 -> 9.6p1) openvpn python-PyYAML rubygem-concurrent-ruby (1.2.2 -> 1.2.3) rubygem-excon (0.104.0 -> 0.109.0) rubygem-google-protobuf (3.25.1 -> 3.25.2) rubygem-googleapis-common-protos-types (1.10.0 -> 1.11.0) rubygem-mime-types (3.5.1 -> 3.5.2) rubygem-mime-types-data (3.2023.1003 -> 3.2023.1205) rubygem-net-ssh (7.2.0 -> 7.2.1) rubygem-parallel (1.23.0 -> 1.24.0) rubygem-parallel_tests (4.3.0 -> 4.4.0) rubygem-public_suffix (5.0.3 -> 5.0.4) rubygem-rack-2.2 (2.2.8 -> 2.2.8.1) rubygem-rack (3.0.8 -> 3.0.9.1) salt sazanami-fonts sbl sendmail sha1collisiondetection sord soundtouch speex splix susepaste syslogd system-config-printer sysvinit thin-provisioning-tools (1.0.11 -> 1.0.12) tigervnc usbutils virtiofsd vlc xauth xdm xf86-input-evdev xf86-input-vmmouse xf86-input-wacom xf86-video-intel xf86-video-nouveau xf86-video-nv xf86-video-vesa xinit xkeyboard-config xorg-x11-server xrandr yast2-trans (84.87.20240219.f6e4117fe0 -> 84.87.20240224.f7ab2886c1) === Details === ==== MozillaFirefox ==== Version update (122.0.1 -> 123.0) Subpackages: MozillaFirefox-translations-common - Mozilla Firefox 123.0 https://www.mozilla.org/en-US/firefox/123.0/releasenotes/ MFSA 2024-05 (bsc#1220048) * CVE-2024-1546 (bmo#1843752) Out-of-bounds memory read in networking channels * CVE-2024-1547 (bmo#1877879) Alert dialog could have been spoofed on another site * CVE-2024-1554 (bmo#1816390) fetch could be used to effect cache poisoning * CVE-2024-1548 (bmo#1832627) Fullscreen Notification could have been hidden by select element * CVE-2024-1549 (bmo#1833814) Custom cursor could obscure the permission dialog * CVE-2024-1550 (bmo#1860065) Mouse cursor re-positioned unexpectedly could have led to unintended permission grants * CVE-2024-1551 (bmo#1864385) Multipart HTTP Responses would accept the Set-Cookie header in response parts * CVE-2024-1555 (bmo#1873223) SameSite cookies were not properly respected when opening a website from an external browser * CVE-2024-1556 (bmo#1870414) Invalid memory access in the built-in profiler * CVE-2024-1552 (bmo#1874502) Incorrect code generation on 32-bit ARM devices * CVE-2024-1553 (bmo#1855686, bmo#1867982, bmo#1871498, bmo#1872296, bmo#1873521, bmo#1873577, bmo#1873597, bmo#1873866, bmo#1874080, bmo#1874740, bmo#1875795, bmo#1875906, bmo#1876425, bmo#1878211, bmo#1878286) Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8 * CVE-2024-1557 (bmo#1746471, bmo#1848829, bmo#1864011, bmo#1869175, bmo#1869455, bmo#1869938, bmo#1871606) Memory safety bugs fixed in Firefox 123 - requires NSS 3.97 ==== c-ares ==== Version update (1.26.0 -> 1.27.0) - c-ares 1.27.0 Security: * Moderate. CVE-2024-25629. Reading malformatted /etc/resolv.conf, /etc/nsswitch.conf or the HOSTALIASES file could result in a crash. GHSA-mg26-v6qh-x48q (CVE-2024-25629, bsc#1220279) Features: * New function ares_queue_active_queries() to retrieve number of in-flight queries. PR #712 * New function ares_queue_wait_empty() to wait for the number of in-flight queries to reach zero. PR #710 * New ARES_FLAG_NO_DEFLT_SVR for ares_init_options() to return a failure if no DNS servers can be found rather than attempting to use 127.0.0.1. This also introduces a new ares status code of ARES_ENOSERVER. PR #713 Changes: * EDNS Packet size should be 1232 as per DNS Flag Day. PR #705 Bugfixes: * Fix warning due to ignoring return code of write(). PR #709 * CMake: don't override target output locations if not top-level. Issue #708 * Fix building c-ares without thread support. PR #700 ==== cdparanoia ==== Subpackages: libcdda_interface0 libcdda_paranoia0 - Use %patch -P N instead of deprecated %patchN. ==== chrony ==== Version update (4.4 -> 4.5) Subpackages: chrony-pool-openSUSE - Use %patch -P N instead of deprecated %patchN. - Update to version 4.5: * Add support for AES-GCM-SIV in GnuTLS * Add support for corrections from PTP transparent clocks * Add support for systemd socket activation * Fix presend in interleaved mode * Fix reloading of modified sources from sourcedir ==== cronie ==== Subpackages: cron - Use %patch -P N instead of deprecated %patchN. ==== ddskk ==== Subpackages: skkdic - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== delayacct-utils ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== dhcp ==== Subpackages: dhcp-relay dhcp-server - Use %patch -P N instead of deprecated %patchN. ==== dmidecode ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== docbook_4 ==== - Use %patch -P N instead of deprecated %patchN. ==== drbd ==== Subpackages: drbd-kmp-default - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== drbd-utils ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== dump ==== - Use %patch -P N instead of deprecated %patchN. ==== emacs-jinx ==== Version update (1.2 -> 1.3) - Depend on emacs-devel to make sure Emacs packaging macros are installed when not building with emacs-eln - Update to version 1.3: * jinx-mode: hack-local-variables - ignore mode variables * README: List packages needed on OpenSUSE * Fix interaction bug with the newest version of AUCTeX, where the major mode got changed unexpectedly. * No need to use hashed symbol as argument for derived-mode-p * Fix deadlock on macOS during Jinx startup (Fix #91, #113) * Revert "Simplify rescheduling" * timer-activate-when-idle: Pass DONT-WAIT=t ==== fcitx ==== Subpackages: fcitx-branding-openSUSE fcitx-gtk2 fcitx-gtk3 fcitx-pinyin fcitx-table fcitx-table-cn-wubi fcitx-table-cn-wubi-pinyin libfcitx-config4 libfcitx-core0 libfcitx-gclient1 libfcitx-utils0 - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== fcitx-chewing ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== fcitx-configtool ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== fcitx-zhuyin ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== fcoe-utils ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== fltk ==== - Use %patch -P N instead of deprecated %patchN. ==== gcin ==== Subpackages: gcin-gtk2 gcin-gtk3 gcin-qt5 libgcin-im-client1 - Use %autosetup macro. Allows to eliminate the usage of deprecated %patchN. ==== giflib ==== Version update (5.2.1 -> 5.2.2) - Update to version 5.2.2 * Fixes for CVE-2023-48161 (bsc#1217390), CVE-2022-28506 (bsc#1198880) * Address SF issue #138 Documentation for obsolete utilities still installed * Address SF issue #139: Typo in "LZW image data" page ("110_2 = 4_10") * Address SF issue #140: Typo in "LZW image data" page ("LWZ") * Address SF issue #141: Typo in "Bits and bytes" page ("filed") * Note as already fixed SF issue #143: cannot compile under mingw * Address SF issue #144: giflib-5.2.1 cannot be build on windows and other platforms using c89 * Address SF issue #145: Remove manual pages installation for binaries that are not installed too * Address SF issue #146: [PATCH] Limit installed man pages to binaries, move giflib to section 7 * Address SF issue #147 [PATCH] Fixes to doc/whatsinagif/ content * Address SF issue #148: heap Out of Bound Read in gif2rgb.c:298 DumpScreen2RGB * Declared no-info on SF issue #150: There is a denial of service vulnerability in GIFLIB 5.2.1 * Declared Won't-fix on SF issue 149: Out of source builds no longer possible * Address SF issue #151: A heap-buffer-overflow in gif2rgb.c:294:45 * Address SF issue #152: Fix some typos on the html documentation and man pages * Address SF issue #153: Fix segmentation faults due to non correct checking for args * Address SF issue #154: Recover the giffilter manual page * Address SF issue #155: Add gifsponge docs * Address SF issue #157: An OutofMemory-Exception or Memory Leak in gif2rgb * Address SF issue #158: There is a null pointer problem in gif2rgb * Address SF issue #159 A heap-buffer-overflow in GIFLIB5.2.1 DumpScreen2RGB() in gif2rgb.c:298:45 * Address SF issue #163: detected memory leaks in openbsd_reallocarray giflib/openbsd-reallocarray.c * Address SF issue #164: detected memory leaks in GifMakeMapObject giflib/gifalloc.c * Address SF issue #166: a read zero page leads segment fault in getarg.c and memory leaks in gif2rgb.c and gifmalloc.c * Address SF issue #167: Heap-Buffer Overflow during Image Saving in DumpScreen2RGB Function at Line 321 of gif2rgb.c - Added patch: * giflib-5.2.2-no-imagemagick.patch + do not use ImageMagick to resize one gif file. It creates a build cycle. * 0001-Clean-up-memory-better-at-end-of-run-CVE-2021-40633.patch + upstream fix for CVE-2021-40633 (bsc#1200551) - Modified patches: * PIE.patch * reproducible.patch + rediff to changed context ==== git ==== Version update (2.43.2 -> 2.44.0) Subpackages: git-core git-email git-web perl-Git - update to 2.44.0: * "git checkout -B <branch>" now longer allows switching to a branch that is in use on another worktree. The users need to use "--ignore-other-worktrees" option. * Faster server-side rebases with git replay * Faster pack generation with multi-pack reuse * rebase auto-squashing now works in non-interactive mode * pathspec now understands attr, e.g. ':(attr:~binary) for selecting non-binaries, or builtin_objectmode for selecting items by file mode or other properties * Many other cli UI and internal improvements and extensions ==== glyr ==== - Use %patch -P N instead of deprecated %patchN. ==== gnutls ==== Subpackages: libgnutls-dane0 libgnutls30 libgnutls30-32bit - Remove some if..endif that do not affect any result - Split documentation (some 1100 files) to separate subpackage ==== libksba ==== Version update (1.6.5 -> 1.6.6) - Update to 1.6.6: * Fix a possible wrong error return from the DER builder. [T6992] * Release-info: https://dev.gnupg.org/T7009 * Update upstream libksba.keyring ==== libunistring ==== Version update (1.1 -> 1.2) Subpackages: libunistring5 libunistring5-32bit - update to 1.2: * Support Unicode 15.1.0 * Improve UTF-8 decoder Unicode Standard compliance * The *printf functions no longer support the %n directive, for security reasons. * Fixed a bug in the *printf functions: In the %U, %lU, %llU directives, a negative width given as an argument did not trigger left-justification. * The functions u16_strstr and u32_strstr now operate in worst-case linear time. * Useful API function extensions ==== mokutil ==== - Use %patch -P N instead of deprecated %patchN. ==== mozilla-nss ==== Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-sysinit mozilla-nss-tools - Use %patch -P N instead of deprecated %patchN. ==== multipath-tools ==== Version update (0.9.8~1+82+suse.dcd98a3 -> 0.9.8+83+suse.bcae610) Subpackages: kpartx libmpath0 - Remove libmpathpersist-example-old.c, which has been obsolete since multipath-tools 0.8.6. - Update to version 0.9.8+83+suse.bcae610 (bsc#1220374) * multipath-tools: added NEWS.md ==== npth ==== Version update (1.6 -> 1.7) - Update to 1.7: * The npth-config command is not installed by default, because it is now replaced by use of pkg-config/gpgrt-config with npth.pc. Supply --enable-install-npth-config configure option, if needed. * Support for legacy systems w/o pthread_rwlock_t support. [T4306] * New functions npth_poll and npth_ppoll for Unix. [T5748] * Fixes to improve support for 64 bit Windows. * Fix declaration conflict using newer mingw versions. [T5889] * Fix build problems on Solaris 11. [T4491] * Fix detecting of the pthread library. [rPTH6629a4b801] * Clean up handling of unsafe semaphores on AIX. [T6947] * Link without -flat_namespace to support macOS 11. [T5610] * Release-info: https://dev.gnupg.org/T7010 * Update spec file * Update upstream npth.keyring ==== openssh ==== Version update (9.3p2 -> 9.6p1) Subpackages: openssh-clients openssh-common openssh-server - Update to openssh 9.6p1: = Security * ssh(1), sshd(8): implement protocol extensions to thwart the so-called "Terrapin attack" discovered by Fabian BÃ¤umer, Marcus Brinkmann and JÃ¶rg Schwenk. This attack allows a MITM to effect a limited break of the integrity of the early encrypted SSH transport protocol by sending extra messages prior to the commencement of encryption, and deleting an equal number of consecutive messages immediately after encryption starts. A peer SSH client/server would not be able to detect that messages were deleted. * ssh-agent(1): when adding PKCS#11-hosted private keys while specifying destination constraints, if the PKCS#11 token returned multiple keys then only the first key had the constraints applied. Use of regular private keys, FIDO tokens and unconstrained keys are unaffected. * ssh(1): if an invalid user or hostname that contained shell metacharacters was passed to ssh(1), and a ProxyCommand, LocalCommand directive or "match exec" predicate referenced the user or hostname via %u, %h or similar expansion token, then an attacker who could supply arbitrary user/hostnames to ssh(1) could potentially perform command injection depending on what quoting was present in the user-supplied ssh_config(5) directive. = Potentially incompatible changes * ssh(1), sshd(8): the RFC4254 connection/channels protocol provides a TCP-like window mechanism that limits the amount of data that can be sent without acceptance from the peer. In cases where this limit was exceeded by a non-conforming peer SSH implementation, ssh(1)/sshd(8) previously discarded the extra data. From OpenSSH 9.6, ssh(1)/sshd(8) will now terminate the connection if a peer exceeds the window limit by more than a small grace factor. This change should have no effect of SSH implementations that follow the specification. = New features * ssh(1): add a %j token that expands to the configured ProxyJump hostname (or the empty string if this option is not being used) that can be used in a number of ssh_config(5) keywords. bz3610 * ssh(1): add ChannelTimeout support to the client, mirroring the same option in the server and allowing ssh(1) to terminate quiescent channels. * ssh(1), sshd(8), ssh-add(1), ssh-keygen(1): add support for reading ED25519 private keys in PEM PKCS8 format. Previously only the OpenSSH private key format was supported. * ssh(1), sshd(8): introduce a protocol extension to allow renegotiation of acceptable signature algorithms for public key authentication after the server has learned the username being used for authentication. This allows varying sshd_config(5) PubkeyAcceptedAlgorithms in a "Match user" block. * ssh-add(1), ssh-agent(1): add an agent protocol extension to allow specifying certificates when loading PKCS#11 keys. This allows the use of certificates backed by PKCS#11 private keys in all OpenSSH tools that support ssh-agent(1). Previously only ssh(1) supported this use-case. = Bugfixes * ssh(1): when deciding whether to enable the keystroke timing obfuscation, enable it only if a channel with a TTY is active. * ssh(1): switch mainloop from poll(3) to ppoll(3) and mask signals before checking flags set in signal handler. Avoids potential race condition between signaling ssh to exit and polling. bz3531 * ssh(1): when connecting to a destination with both the AddressFamily and CanonicalizeHostname directives in use, the AddressFamily directive could be ignored. bz5326 * sftp(1): correct handling of the limits(a)openssh.com option when the server returned an unexpected message. * A number of fixes to the PuTTY and Dropbear regress/integration tests. * ssh(1): release GSS OIDs only at end of authentication, avoiding unnecessary init/cleanup cycles. bz2982 * ssh_config(5): mention "none" is a valid argument to IdentityFile in the manual. bz3080 * scp(1): improved debugging for paths from the server rejected for not matching the client's glob(3) pattern in old SCP/RCP protocol mode. * ssh-agent(1): refuse signing operations on destination-constrained keys if a previous session-bind operation has failed. This may prevent a fail-open situation in future if a user uses a mismatched ssh(1) client and ssh-agent(1) where the client supports a key type that the agent does not support. - Update to openssh 9.5p1: = Potentially incompatible changes * ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * sshd(8): the Subsystem directive now accurately preserves quoting of subsystem commands and arguments. This may change behaviour for exotic configurations, but the most common subsystem configuration (sftp-server) is unlikely to be affected. = New features * ssh(1): add keystroke timing obfuscation to the client. This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword. * ssh(1), sshd(8): Introduce a transport-level ping facility. This adds a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to implement a ping capability. These messages use numbers in the "local extensions" number space and are advertised using a "ping(a)openssh.com" ext-info message with a string version number of "0". ... changelog too long, skipping 104 lines ... * openssh-8.0p1-gssapi-keyex.patch ==== openssh-askpass-gnome ==== Version update (9.3p2 -> 9.6p1) - Update to openssh 9.6p1: * No changes for askpass, see main package changelog for details. ==== openvpn ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== python-PyYAML ==== - Switch to pyproject and autosetup macros. - Drop patch setuptools.patch, we can now cope. ==== rubygem-concurrent-ruby ==== Version update (1.2.2 -> 1.2.3) - ## Release v1.2.3 (16 Jan 2024) * See [the GitHub release](https://github.com/ruby-concurrency/concurrent-ruby/releases/tag/v… for details. ==== rubygem-excon ==== Version update (0.104.0 -> 0.109.0) - New upstream release 0.109.0, no changelog found ==== rubygem-google-protobuf ==== Version update (3.25.1 -> 3.25.2) - New upstream release 3.25.2, no changelog found ==== rubygem-googleapis-common-protos-types ==== Version update (1.10.0 -> 1.11.0) - ### 1.11.0 (2023-12-04) [#]### Features * Automated update of googleapis-common-protos-types ([#217](https://github.com/googleapis/common-protos-ruby/issues/217)) ==== rubygem-mime-types ==== Version update (3.5.1 -> 3.5.2) - New upstream release 3.5.2, see bundled History.md ==== rubygem-mime-types-data ==== Version update (3.2023.1003 -> 3.2023.1205) - New upstream release 3.2023.1205, see bundled History.md ==== rubygem-net-ssh ==== Version update (7.2.0 -> 7.2.1) - === 7.2.1 rc1 * feat: allow load of certkey from string [#926] * fix: fix for Socket#recv returning nil on ruby 3.3.0 [#928] ==== rubygem-parallel ==== Version update (1.23.0 -> 1.24.0) - New upstream release 1.24.0, no changelog found ==== rubygem-parallel_tests ==== Version update (4.3.0 -> 4.4.0) - New upstream release 4.4.0, no changelog found ==== rubygem-public_suffix ==== Version update (5.0.3 -> 5.0.4) - ## 5.0.4 [#]## Changed - Reduced .gem file size (GH-259). [Thanks @ybiquitous] - Updated definitions. ==== rubygem-rack-2.2 ==== Version update (2.2.8 -> 2.2.8.1) - update to version 2.2.8.1 * Fixed ReDoS in Accept header parsing [CVE-2024-26146] * Fixed ReDoS in Content Type header parsing [CVE-2024-25126] * Reject Range headers which are too large [CVE-2024-26141] ==== rubygem-rack ==== Version update (3.0.8 -> 3.0.9.1) - version update to 3.0.9.1 * Fixed ReDoS in Accept header parsing [CVE-2024-26146][bsc#1220248] * Fixed ReDoS in Content Type header parsing [CVE-2024-25126][bsc#1220239] * Reject Range headers which are too large [CVE-2024-26141][bsc#1220242] * Fix content-length calcuation in Rack:Response#write #2150 ==== salt ==== Subpackages: python3-salt salt-master salt-minion salt-transactional-update - Fix problematic tests and allow smooth tests executions on containers - Added: * fix-problematic-tests-and-allow-smooth-tests-executi.patch - Discover Ansible playbook files as "*.yml" or "*.yaml" files (bsc#1211888) - Added: * discover-both-.yml-and-.yaml-playbooks-bsc-1211888.patch - Extend dependencies for python3-salt-testsuite and python3-salt packages - Improve Salt and testsuite packages multibuild - Enable multibuilld and create test flavor - Additionally we require python-mock just for older Python versions. - Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed - Rename salt-tests to python3-salt-testsuite ==== sazanami-fonts ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== sbl ==== - Use %patch -P N instead of deprecated %patchN. ==== sendmail ==== Subpackages: libmilter1_0 - Use %patch -P N instead of deprecated %patchN. ==== sha1collisiondetection ==== - Use %patch -P N instead of deprecated %patchN. ==== sord ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== soundtouch ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== speex ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== splix ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== susepaste ==== Subpackages: susepaste-screenshot - Use %patch -P N instead of deprecated %patchN. ==== syslogd ==== Subpackages: klogd syslog-service - Use %patch -P N instead of deprecated %patchN. ==== system-config-printer ==== Subpackages: python3-cupshelpers system-config-printer-applet system-config-printer-common system-config-printer-common-lang system-config-printer-dbus-service udev-configure-printer - remove dependency on /usr/bin/python3 using %python3_fix_shebang_path macro, [bsc#1212476] ==== sysvinit ==== Subpackages: sysvinit-tools sysvinit-tools-doc - Use %patch -P N instead of deprecated %patchN. ==== thin-provisioning-tools ==== Version update (1.0.11 -> 1.0.12) - Update to version 1.0.12: * [thin_dump] Do not print error messages on BrokenPipe (EPIPE) * Bump version to 1.0.12 * [build] Update dependencies * [commands] Fix version string compatibility issue with LVM * [thin_dump] Do not print error messages on BrokenPipe (EPIPE) * [build] Update license to SPDX identifier ==== tigervnc ==== Subpackages: libXvnc1 xorg-x11-Xvnc xorg-x11-Xvnc-module - remove dependency on /usr/bin/python3 using %python3_fix_shebang macro, [bsc#1212476] ==== usbutils ==== - remove dependency on /usr/bin/python3 using %python3_fix_shebang macro, [bsc#1212476] ==== virtiofsd ==== - Spec: We don't want /usr/libexec to be namespaced like it is with /usr/lib (bsc#1220304) ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-lang vlc-noX vlc-qt vlc-vdpau - Add vlc-taglib-2.0.patch: Fix build against taglib 2.0 (based on upstream commit ec29dfca, d2663d6c, ac59d0ba, c404fdb2). - Use %patch -P N instead of deprecated %patchN. ==== xauth ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xdm ==== Subpackages: xdm-xsession - Use %patch -P N instead of deprecated %patchN. ==== xf86-input-evdev ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xf86-input-vmmouse ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xf86-input-wacom ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xf86-video-intel ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xf86-video-nouveau ==== - Use %patch -P N instead of deprecated %patchN. ==== xf86-video-nv ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xf86-video-vesa ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xinit ==== - Use %patch -P N instead of deprecated %patchN. - revert previous change; cpp is not needed for xinit, but only for xdm package - since xrdb no longer requires cpp, it needs to be reqired here now ==== xkeyboard-config ==== Subpackages: xkeyboard-config-lang - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== xorg-x11-server ==== Subpackages: xorg-x11-server-Xvfb xorg-x11-server-extra - Use %patch -P N instead of deprecated %patchN. ==== xrandr ==== - Use %autosetup macro. Allows to eliminate the usage of deprecated PatchN. ==== yast2-trans ==== Version update (84.87.20240219.f6e4117fe0 -> 84.87.20240224.f7ab2886c1) Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu - Update to version 84.87.20240224.f7ab2886c1: * Translated using Weblate (Ukrainian) * Translated using Weblate (Ukrainian) * Translated using Weblate (Ukrainian) * Translated using Weblate (Catalan) * Translated using Weblate (Catalan) * Translated using Weblate (Catalan) * Translated using Weblate (Finnish) * Translated using Weblate (Finnish) * Translated using Weblate (Finnish) * Translated using Weblate (Finnish) * Translated using Weblate (Finnish) * Translated using Weblate (Finnish) * Translated using Weblate (Spanish)

1 0

[opensuse-factory] reproducible builds status 2024-02
by Bernhard M. Wiedemann 28 Feb '24

28 Feb '24

Hi, Only did a few patches this month. But at least kept the build tests working. Here are the autogenerated bits: last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2024-01/ I uploaded https://rb.zq1.de/compare.factory-20240228/ today https://rb.zq1.de/spec/glossar.txt explains the meaning of below values: total-packages: 15256 (+44) build-tried: 15199 (+10) build-failed: 34 (-77) build-n-a: 233 (+3) build-succeeded: 14932 (+84) build-official-failed+na: 198 (+103) build-compare-failed: 179 (+13) build-compare-succeeded: 14753 (+71) verify-failed: 499 (+484) verified-semi-reproducible: 11102 (+11082) verified-bit-identical: 5 (+5) bit-by-bit-identical: 14267 (+185) not-bit-by-bit-identical: 666 (-102) not-bit-by-bit-identicalcheck: 665 (-101) https://rb.zq1.de/compare.factory-20240228/graph.png shows the change over time https://rb.zq1.de/compare.factory-20240228/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 5 were in ring0 31 were in ring1 That makes it 36/3868 => 0.93 % which is below the overall average of 179/14932 => 1.20 % 666/14932 => 4.46 % of packages are not perfectly reproducible patches: SR 1144993 grub2 filesys SR 1150775 latex2html drop latex log #https://github.com/OSGeo/grass/pull/3415 parallelism https://github.com/OSGeo/grass/pull/3417 date https://github.com/openSUSE/obs-build/issues/980 build-tool issue https://github.com/mfontanini/presenterm/pull/202 filesys (rust) https://bugreports.qt.io/browse/QTBUG-122722 qt6-quick3d parallelism package notes: ==> ./FlightGear/.rb.notes <== FTBFS-j1 make[2]: *** No rule to make target 'src/EmbeddedResources/FlightGear-resources.cxx', needed by 'src/Main/CMakeFiles/fgfs_autogen_timestamp_deps'. Stop. ==> ./R-base/.rb.notes <== embedded random tmp path in /usr/lib64/R/library/KernSmooth/help/paths.rds; many other ==> ./Setzer/.rb.notes <== filesys ==> ./aws-c-common/.rb.notes <== FTBFS-j1 osc build --noservice --vm-type=kvm -j1 standard ==> ./aws-sdk-java/.rb.notes <== strip-nd javadoc html+zip ==> ./binutils/.rb.notes <== no problem? ?parallelism+ASLR ==> ./cartridges/.rb.notes <== FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./chezscheme/.rb.notes <== scheme/lisp memory dump ==> ./cmake/.rb.notes <== sqlite /usr/share/doc/packages/cmake/CMake.qch ==> ./cockpit/.rb.notes <== filesys /usr/lib/python3.11/site-packages/cockpit/data/cockpit-bridge.beipack.xz ==> ./contrast/.rb.notes <== rust/llvm ==> ./form/.rb.notes <== FTBFS-j1 : osc build --vm-type=kvm -j1 --noservice standard date in html+pdf from doxygen / latex ==> ./gawk/.rb.notes <== date+PGO no-time / 1d granularity ==> ./grass/.rb.notes <== => https://github.com/OSGeo/grass/pull/3415 parallelism => https://github.com/OSGeo/grass/pull/3417 date ==> ./grub2/.rb.notes <== => SR 1144993 filesys in grub.efi ==> ./himmelblau/.rb.notes <== rust/llvm ==> ./identity/.rb.notes <== rust/llvm ==> ./impression/.rb.notes <== FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./jackson-annotations/.rb.notes <== minor javadoc, jar ==> ./jackson-core/.rb.notes <== javadoc filesys + minor java maven jar strip-nd +++ new//usr/share/java/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties 2019-11-01 00:36:26.518271564 +0000 ==> ./joker/.rb.notes <== = https://github.com/candid82/joker/issues/491 hash random order old: # https://github.com/candid82/joker/pull/490 sort, partial ==> ./kraft/.rb.notes <== #=> https://github.com/dragotin/kraft/pull/215 hostname ==> ./kryo/.rb.notes <== strip-nd javadoc html date+time ==> ./lapce/.rb.notes <== rust/LLVM14 ASLR?readdir? ==> ./latex2html/.rb.notes <== => SR 1150775 drop latex log => SR 733232 drop date in latex log ==> ./ldc/.rb.notes <== ASLR from llvm14? order issue ==> ./libcamera/.rb.notes <== = https://bugzilla.opensuse.org/show_bug.cgi?id=1217690 random: private key signatures of modules /usr/lib64/libcamera-suse.so.3 differs in ELF section .rodata ==> ./lightcouch/.rb.notes <== minor strip-nd javadoc-html #xmvn random uuid ==> ./llvm15/.rb.notes <== = https://bugzilla.opensuse.org/show_bug.cgi?id=1199076 order ==> ./loupe/.rb.notes <== rust/llvm ==> ./mumble/.rb.notes <== => SR 1141433 #=> https://github.com/mumble-voip/mumble/pull/6147 filesys (python listdir) ==> ./nodejs20/.rb.notes <== v8_snapshot_blob_data varies ==> ./nodejs21/.rb.notes <== v8_snapshot_blob_data varies ==> ./objectweb-asm/.rb.notes <== javadoc toolchain filesys readdir order ; strip-nd ==> ./ocaml-dune/.rb.notes <== = https://github.com/ocaml/dune/issues/9507 parallelism ? ==> ./openjfx/.rb.notes <== filesys + stripnd ; other? ==> ./openssl-1_0_0/.rb.notes <== ordering issues in obj_dat.h ==> ./parboiled/.rb.notes <== minor jar javadoc html ==> ./pgloader/.rb.notes <== from sbcl (lisp dump) ==> ./plasma5-workspace/.rb.notes <== parallelism ==> ./presenterm/.rb.notes <== => https://github.com/mfontanini/presenterm/pull/202 filesys (rust) ==> ./python-debugpy/.rb.notes <== filesys low-entropy ==> ./python-grpcio/.rb.notes <== #=> https://github.com/grpc/grpc/pull/35687 sort filesys filesys-FTBFS? ==> ./python-seaborn/.rb.notes <== python3.9 .pyc low-entropy filesys ==> ./python-tornado6/.rb.notes <== FTBFS-SSL ==> ./qt6-declarative/.rb.notes <== /usr/lib64/libQt6QuickDialogs2QuickImpl.so.6.4.2 differs in ELF sections order variation in qtdeclarative-everywhere-src-6.4.2/build/build.ninja , ColorDialog_qml.cpp from qmlcachegen ==> ./qt6-quick3d/.rb.notes <== = https://bugreports.qt.io/browse/QTBUG-122722 /usr/lib64/qt6/examples/quick3d/virtualassistant/QtVirtualAssistant asm diff ==> ./qt6-virtualkeyboard/.rb.notes <== = https://bugreports.qt.io/browse/QTBUG-121643 parallelism ==> ./replacer/.rb.notes <== javadoc html toolchain filesys ==> ./resteasy/.rb.notes <== javadoc toolchain filesys ==> ./scala/.rb.notes <== filesys in /usr/share/java/scala/scala-compiler.jar/scala/tools/nsc/fsc/CompileSocket.class ==> ./shadowsocks-rust/.rb.notes <== #=> https://github.com/AlephAlpha/build-time/pull/5 toolchain date+time +++ new /usr/bin/sslocal (objdump) ==> ./spamassassin/.rb.notes <== FTBFS-j1 osc build --noservice --vm-type=kvm -j1 standard x86_64 ==> ./sundials/.rb.notes <== => https://build.opensuse.org/request/show/1147937 = https://bugzilla.suse.com/show_bug.cgi?id=1201273 FTBFS-j1 ==> ./tbb/.rb.notes <== stuck tests FTBFS-j1 osc build --vm-type=kvm -j1 --noservice standard ==> ./tinyssh/.rb.notes <== FTBFS-j1 tests osc build --noservice --vm-type=kvm -j1 standard ==> ./woodstox-core/.rb.notes <== javadoc toolchain filesys ==> ./wpewebkit/.rb.notes <== copyright year ; varying JSCBytecodeCacheVersion

1 0

Announcing Agama 7
by Imobach Gonzalez Sosa 28 Feb '24

28 Feb '24

Hi all, We are pleased to announce the availability of Agama 7. Among other features, it brings: * Allow choosing localization settings for the installed system (language, keyboard and timezone). * Use zram to reduce memory consumption. * Add support to install MicroOS and MicroOS Desktop. Drop Leap 16.0 support. * Simplified software selection based on a curated list of patterns per product. * Registration support. It is enabled for Dolomite. * Allow to select the file system type selection and to choose a policy to make space. * Support for network bonding in the unattended scenario. If you are interested in the details, please check the announcement on our team's blog: https://yast.opensuse.org/blog/2023-12-22/agama7 Thanks! Regards, Imo

4 15

systemd-based FDE in MicroOS / Tumbleweed
by aplanas 28 Feb '24

28 Feb '24

Hi, Some months ago we announced the support of systemd-boot in MicroOS and in Tumbleweed, using a new tool named sdbootutil, that help us to synchronize the boot loader entries with available snapshots in the system. Today we announce that we supporting the full disk encryption (FDE) tools that systemd bring us via systemd-cryptenroll or cryptsetup. We extended the pcr-oracle to support new PCRs and the generation of authorized policies in JSON format for systemd With this we also propose a new architecture in the distribution that allows the enrollment of the TPM2 (with full measured boot attestation) and the FIDO2 key, using the already available systemd user tools. The MicroOS image[0] was also extended to show all this nice features working together. The long (sorry, maybe too long) explanation is in the news-o-o blog post[1], and the technical details are in the openSUSE Systemd-fde wiki page[2]. Feedback is more than welcome! ... also happy holidays, end of the year and beginning of 2024! [0] http://download.opensuse.org/tumbleweed/appliances/openSUSE-MicroOS.x86_64-… [1] https://news.opensuse.org/2023/12/20/systemd-fde/ [2] https://en.opensuse.org/Systemd-fde

5 11

please provide latest clamav
by mh＠mike.franken.de 27 Feb '24

27 Feb '24

Hi *, can you please provide latest version of clamav for Tumbleweed? 0.103 is really outdated, 1.3.0 would be the latest version. TIA. Bye. Michael.

2 2

After RPM is before RPM - Changes needed for RPM 4.20
by Dominique Leuenberger 27 Feb '24

27 Feb '24

Dear Tumbleweed hackers and packagers, It is just a few days ago that Factory was updated to RPM 4.19 (and we are still missing a few fixes for packages requiring user() symbols and not providing them) The next RPM version will come - for sure (if previous release cycles are any indication, RPM 4.20 should be out around September) So far we have come across one change that will impact a log of packages: RPM 4.20 will no longer support %patchN (e.g %patch0); RPM 4.19 has warned about this during the build already. The preferred way to apply patches are, in order: * %autosetup -p1 * %autosetup -N / %autopatch -p1 * %setup / %patch -P <N> -p 1 (upper case P denotes patch number, lower case is the usual patch -p>num> strip level) * If your package has no patches, best to be prepared for the future and use %autosetup over %setup. Technically, RPM preferred would be %setup / %patch N when not using %autosetup/%autopatch, BUT %patch 1 is only supported properly from RPM 4.18 on, Not behaving as expected on older RPMs, like in Leap 15.x. That's why we switched our packages to the backward compatible form %patch -P 1 I (and some others) have started to go through the openSUSE:Factory packages that apply patches using %patchN (found a total of 2066 packages). About 10% of those have been fixed today with SRs to the development projects. I would appreciate it if you'd take a look at your packages over the next few days/weeks/months and adjust them to use autosetup or, if patches are applied conditionally, use the %patch -P N format. Cheers, Dominique

7 12