March 2024 - openSUSE Factory - openSUSE Mailing Lists

[opensuse-factory] acpid requires systemd?
by Felix Miata 25 Apr '24

25 Apr '24

Can this be true? If so, why? Zypper won't let me upgrade acpid without breakage unless systemd is installed too. I have systemd locked out, as I'd rather test things I can understand in Factory, not major overhaul stuff. -- "The wise are known for their understanding, and pleasant words are persuasive." Proverbs 16:21 (New Living Translation) Team OS/2 ** Reg. Linux User #211409 ** a11y rocks! Felix Miata *** http://fm.no-ip.com/ -- To unsubscribe, e-mail: opensuse-factory+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-factory+help(a)opensuse.org

4 3

FDE in MicroOS and Tumbleweed: pcrlock update
by aplanas 18 Apr '24

18 Apr '24

Hi, after the announcement of sdbootutil[1] and the support of full disk encryption (FDE)[2] using systemd-cryptenroll via pcr-oracle, we are releasing images for MicroOS and Tumbleweed that support the new systemd-pcrlock mechanism! In December we described[3] how we implemented in MicroOS (and later in Tumbleweed) a solution for FDE that uses the TPM2 or the FIDO2 key to unlock the LUKS2 root device, using only the systemd user space tools. To generate the predictions of the PCRs values, we used the in-house pcr-oracle application, that we extended to support the generation of signed policies in JSON format, that systemd-cryptenroll and systemd-cryptsetup use to seal and unseal the key that will open the encrypted LUK2 device in our system. Two weekends ago something changed: openSUSE released systemd v255, that now support the generation of policies using the new experimental tool systemd-pcrlock[4]. pcrlock proposes a different approach to the generation of TPM2 policies. Instead of signed policies (which requires the generation of a RSA key pair that is used to sign the PCR policy to make it independent of the sealed key), pcrlock uses NVIndex policies. Those are basically policies that are stored inside the non-volatile RAM that the TPM2 provides. The policy is now stored inside the TPM2, and the index can only be changed if the policy itself is meet. The new pcrlock tool is also quite handy. It can generate the predictions (some small .pcrlock files stored in /var) of each component (firmware, bootloader, kernel, raw files, etc), and also present all the extensions of the PCR registered in the event log in a very nice way! The architecture is sound, but there is a systemd-pcrlock bug[5] that fails when measuring large initrd files. This has an implication only on the first boot, as the initial initrd is for now ignored, discarding initially PCR9. This is automatically fixed in the next update, but can also be manually fixed if the user reboot using the new smaller initrd, and later call `sdbootutil update-predictions`. Anyway, we extended the tools to support the pcrlock mechanism now. For new installations, if pcrlock is supported it will be preferred instead of the signed policies. The team is still working on more interesting stuff for later: we are making good progress in turning the distribution independent of the boot loader. We can use exactly this same FDE mechanism (signed policies or NVIndex policies) using systemd-boot or GRUB2 (with BLS patches). More on that in the next announcement! [1] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/message… [2] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… [3] https://news.opensuse.org/2023/12/20/systemd-fde [4] https://www.freedesktop.org/software/systemd/man/latest/systemd-pcrlock.html [5] https://github.com/systemd/systemd/issues/31883

5 27

xz security alert and CVE-2024-3094
by Ana Guerrero Lopez 05 Apr '24

05 Apr '24

Hi, If you're using an up-to-date Tumbleweed, please make sure to update as soon as possible your system. The latest versions of "xz" (5.6.0 and 5.6.1) contained malicious code ( refer to CVE-2024-3094 ) and the package in Tumbleweed has been reverted back to version 5.4. After reading this mail, please update your system and ensure you're downgrading xz to the version *5.6.1.revertto5.4. *This version despite**itsname is version 5.4. Last step is reboot your system. Hopefully we'll have soon more detailed information about this CVE. Have a nice weekend! Ana from the openSUSE release team.

22 42

KDE Megarelease 6 in TW snapshot 20240311
by Charlie Chan 04 Apr '24

04 Apr '24

Zypper doesn’t fetch all the lang packs in Plasma 6. I have to detect which lang pack is missing, try to guess by file names, and install them one by one… Not an usual openSUSE experience :( Charlie

3 3

KDE Megarelease 6 in TW snapshot 20240311
by Fabian Vogt 04 Apr '24

04 Apr '24

Hi, the next TW snapshot 20240311 contains KDE Plasma 6.0.1, Gear 24.02.0 and Frameworks 6.0.0: https://kde.org/announcements/megarelease/6/ Plasma 5 will be replaced, it is no longer part of the repository. There are a few minor issues in this snapshot found by openQA but not considered severe enough to actually block the snapshot from getting published. They'll all be fixed with Plasma 6.0.2 in one of the next snapshots, also for those installing or upgrading now. 1. For fresh installs, the GTK theme is not set correctly: https://bugs.kde.org/show_bug.cgi?id=482763 Workaround is to either set it manually in systemsettings or run "kded5" once in a terminal or krunner. 2. For upgrades (any version), the launcher icon switches to the Plasma one: https://github.com/openSUSE/plasma-opensuse/pull/25 Workaround is to change the icon manually to "start-here-branding" for now. 3. Upgrades from very old systems fail due to "libksysguard5-helper": https://bugzilla.opensuse.org/show_bug.cgi?id=1221350 When upgrading from Leap <= 15.3, you might encounter Problem: libksysguard5-plugins-5.27.10-2.2.x86_64 requires libprocesscore.so.9()(64bit), but this requirement cannot be provided As workaround, select the "deinstallation of libksysguard5-helper" option. 4. Plasmashell takes 25s during start if bluetooth not available: https://bugs.kde.org/show_bug.cgi?id=481870 If kdeconnect-kde is installed on a system without bluetooth HW, it delays Plasma start by 25s. Workaround is to disable the KDE Connect systray icon. 5. The etesync resource is broken in kdepim-runtime 24.02.0. It will be back in one of the next snapshots. The Wayland session isn't default yet, that will have to be switched in a separate step later. This also makes it possible to differentiate whether bugs are more likely caused by Plasma 6 itself or the Wayland session. Have a lot of fun, the openSUSE KDE packaging team

27 65

zypper dup wants to update all packages ?
by Michael Pujos 01 Apr '24

01 Apr '24

A zypper dup on my install wants to update all packages (4900). Is that normal ? From what I can tell there is no glibc update with a full distro rebuild...

10 9

[opensuse-factory] reproducible builds status 2024-03
by Bernhard M. Wiedemann 31 Mar '24

31 Mar '24

Hi, This month, we enabled macros to allow for bit-reproducible verification of rpms. Thanks Jan Zerebecki + mls. Finally I was able to bit-reproduce OBS-made rpms when workarounding https://github.com/rpm-software-management/rpm/issues/2965 So we finally have a number above zero in the "verified-bit-identical" value. It will rise further when running more tests next month. Also got one step closer to reproducible java-21 packages. And I started to test with --nocheck which found packages that misused the %check section to change %install results. Here are the autogenerated bits: last month's status: https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/… Last months' reproducible builds project updates (including my work): https://reproducible-builds.org/reports/2024-02/ I uploaded https://rb.zq1.de/compare.factory-20240331/ today https://rb.zq1.de/spec/glossar.txt explains the meaning of below values: total-packages: 15400 (+144) build-tried: 15344 (+145) build-failed: 39 (+5) build-n-a: 212 (-21) build-succeeded: 15093 (+161) build-official-failed+na: 133 (-65) build-compare-failed: 161 (-18) build-compare-succeeded: 14932 (+179) verify-failed: 318 (-181) verified-semi-reproducible: 11474 (+372) verified-bit-identical: 1012 (+1007) bit-by-bit-identical: 14342 (+75) not-bit-by-bit-identical: 745 (+79) not-bit-by-bit-identicalcheck: 751 (+86) https://rb.zq1.de/compare.factory-20240331/graph.png shows the change over time https://rb.zq1.de/compare.factory-20240331/unreproduciblerings.txt lists very unreproducible core packages (bootstrap+DVD) Of the badly unreproducible packages, 4 were in ring0 31 were in ring1 That makes it 35/4043 => 0.87 % which is below the overall average of 161/15093 => 1.07 % 745/15093 => 4.94 % of packages are not perfectly reproducible package notes: ==> ./FlightGear/.rb.notes <== FTBFS-j1 make[2]: *** No rule to make target 'src/EmbeddedResources/FlightGear-resources.cxx', needed by 'src/Main/CMakeFiles/fgfs_autogen_timestamp_deps'. Stop. ==> ./arpack-ng/.rb.notes <== FTBFS-j1 ==> ./bmap-tools/.rb.notes <== = https://bugzilla.opensuse.org/show_bug.cgi?id=1221108 FTBFS-2024-06-12 = https://github.com/intel/bmap-tools/issues/116 FTBFS-2024-06-12 ==> ./ca-certificates-mozilla/.rb.notes <== TODO /usr/share/factory/var/lib/ca-certificates/java-cacerts differs at offset '30' (Java KeyStore) ==> ./caddy/.rb.notes <== => SR 1163784 FTBFS-nocheck ==> ./eww/.rb.notes <== rust1.76/llvm ==> ./glfw/.rb.notes <== => https://github.com/geany/geany/pull/3785 toolchain ==> ./helm/.rb.notes <== = helm https://github.com/helm/helm/issues/12880 SSL FTBFS-2024-06-07 FTBFS-2032 ==> ./himmelblau/.rb.notes <== rust/llvm ==> ./igrep/.rb.notes <== rust/llvm low-entropy ==> ./jackson-core/.rb.notes <== javadoc filesys + minor java maven jar strip-nd +++ new//usr/share/java/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.properties 2019-11-01 00:36:26.518271564 +0000 ==> ./java-21-openj9/.rb.notes <== date+time+username ; mailed to fstrba --- old /usr/lib64/jvm/java-21-openj9-21/lib/default/libj9jit29.so (objdump) ==> ./java-21-openjdk/.rb.notes <== = https://bugzilla.opensuse.org/show_bug.cgi?id=1221224 java-21-openjdk parallelism +?ASLR? ==> ./kf6-qqc2-desktop-style/.rb.notes <== qt6-declarative toolchain issue? parallelism? +++ /var/tmp/build-root.2b/.mount/home/abuild/rpmbuild/BUILD/qqc2-desktop-style-6.0.0/build/.rcc/qmlcache/org_kde_desktop_private_org.kde.desktop/private/CheckIndicator_qml.cpp 2040-04-14 03:00:38.066666668 +0000 ==> ./kubefirst/.rb.notes <== = https://bugzilla.opensuse.org/show_bug.cgi?id=1221680 kubefirst bug ==> ./latex2html/.rb.notes <== => SR 1150775 drop latex log => SR 733232 drop date in latex log ==> ./libressl/.rb.notes <== = https://github.com/libressl/portable/issues/1018 SSL FTBFS-2024-04-01 found range 1711981509 -> 1711983313 ==> ./med-tools/.rb.notes <== => SR 1156899 %check fdupes issue --- old-PROVIDES ==> ./mhvtl/.rb.notes <== => https://github.com/markh794/mhvtl/pull/128 tar/gz /usr/lib/firmware/mhvtl/mhvtl_kernel.tgz ==> ./musique/.rb.notes <== => SR 1163266 date -DEFINES = -DAPP_VERSION=1.12 -DAPP_NAME=Musique -DAPP_UNIX_NAME=musique -DBUILD_YEAR=2024 ... ==> ./nautilus/.rb.notes <== date from data/org.gnome.Nautilus.metainfo.xml.in.in: <release version="@release-version@" date="@build-date@"/> ==> ./nfdump/.rb.notes <== => SR 1163778 ==> ./ollama/.rb.notes <== => https://github.com/ollama/ollama/pull/2836 gzip mtime - 76ed00 1f8b0808 a18be065 02036c69 62657874 .......e..libext ==> ./openssl-3/.rb.notes <== FTBFS

1 0

New Tumbleweed snapshot 20240329 released!
by Dominique Leuenberger 30 Mar '24

30 Mar '24

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=opensuse&groupid=1&versio… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: gnome-control-center (46.0 -> 46.0.1) myspell-dictionaries (20221012 -> 20240321) open-vm-tools openSUSE-release (20240328 -> 20240329) publicsuffix (20240306 -> 20240326) python-pyasn1-modules (0.3.0 -> 0.4.0) systemd-default-settings (0.8 -> 0.9) tracker (3.7.0 -> 3.7.1) tracker-miners (3.7.0 -> 3.7.1) virtualbox virtualbox-kmp === Details === ==== gnome-control-center ==== Version update (46.0 -> 46.0.1) Subpackages: gnome-control-center-color gnome-control-center-goa gnome-control-center-lang gnome-control-center-user-faces gnome-control-center-users - Update to version 46.0.1: + Handle legacy panel arguments + Accessibility: Allow launching subpages directly. + Privacy: Fix Thunderbolt panel not launching. + System: - Avoid setting auto time sync when it isn't needed. - Improve startup time by loading subpages on demand. + Updated translations. ==== myspell-dictionaries ==== Version update (20221012 -> 20240321) Subpackages: myspell-cs_CZ myspell-da_DK myspell-de myspell-de_DE myspell-el_GR myspell-en myspell-en_GB myspell-en_US myspell-es myspell-es_ES myspell-fr_FR myspell-hu_HU myspell-it_IT myspell-lightproof-en myspell-lightproof-hu_HU myspell-lightproof-pt_BR myspell-lightproof-ru_RU myspell-pl_PL myspell-pt_BR myspell-ru_RU - version update to 20240321 * use general label for Turkish dictionary * Updated Afrikaans dictionary * tdf#159164 Update the English dictionaries: GB+ZA+AU+CA+US * update hunspell dictionaries for Turkish language * Updated Slovenian thesaurus * tdf#156723 False positives in pt-BR lightproof * Belarusian hunspell dictionary update * Update the Korean Dictionaries: ko-KR * Updated the English dictionaries: GB * Update Danish dictionaries (v2.8.001) * Fix path of logo for Spanish dictionary * Fixes issue #156669: Updates Catalan dictionaries (spelling, hyphenation, and thesaurus) with latest releases. * Add Indonesian hyphenation library to dictionary package * Updating RLA-ES Spanish spellcheker to v2.8. * Updated Slovak dictionaries (v2.4.7 2023-08-29) * Update of Occitan spellchecker (more words and up-to-date licence * tdf#156723 Remove false pleonasms for pt-BR * tdf#156101 add en-IL alongside the other English locales * On Linux dictionaries are packaged separately * Update Hungarian dictionary * Updated the English dictionaries: GB+ZA * tdf#154459 Improve grammar for hlp_ellipsis * Add .gitreview used by git-review tool * id: sync dictionaries to version v2.3.0 (2022.09.21) * Updated Slovenian thesaurus * tdf#148876 Adding Thai hyphenation patterns * Update Italian hyphenation and dictionary * Update Mongolian dictionary * Fix typos in Thesaurus - modified sources % update.sh - deleted patches - es-remove-duplicate-locales.diff (upstreamed) ==== open-vm-tools ==== Subpackages: libvmtools0 open-vm-tools-desktop - Remove protobuf < 22 dependency from spec file (bsc#1217478) Required linking with additional absl libraries for sle_version > 150400. - Use (boo#1222089) for updating open-vm-tools to version 12.4.0. ==== openSUSE-release ==== Version update (20240328 -> 20240329) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== publicsuffix ==== Version update (20240306 -> 20240326) - Update to version 20240326: * Add `*.ir.md` (#1625) * Update name for info.cx (#1616) * add `nftstorage.link` (#1548) * GD - graphic.design (#1940) * Removing wildcard for cloudapp.azure.com (#1944) ==== python-pyasn1-modules ==== Version update (0.3.0 -> 0.4.0) - update to 0.4.0: * Added support for Python 3.11, 3.12 * Removed support for EOL Pythons 2.7, 3.6, 3.7 ==== systemd-default-settings ==== Version update (0.8 -> 0.9) Subpackages: systemd-default-settings-branding-SLE systemd-default-settings-branding-openSUSE - Import 0.9 bb859bf user@.service: Disable controllers by default (jsc#PED-2276) ==== tracker ==== Version update (3.7.0 -> 3.7.1) Subpackages: libtracker-sparql-3_0-0 tracker-data-files tracker-lang typelib-1_0-Tracker-3_0 - Update to version 3.7.1: + Fix possible stalls in D-Bus endpoint batch updates. + Better API documentation around handling of corrupted databases. + Test improvements. ==== tracker-miners ==== Version update (3.7.0 -> 3.7.1) Subpackages: tracker-miner-files tracker-miners-lang - Update to version 3.7.1: + Improvements to the handling of corrupted databases. + Further syscall rules in the seccomp sandbox. + Fix some possible warnings during tracker-extract-3 startup. + Fixes to extraction of dc:source fields from XMP data. + Avoid SIGABRT on missing Landlock. ==== virtualbox ==== - The location of vboxconfig is wrong. Add file fixes_for_vboxconfig.patch to fix. Some errors in vboxdrv.sh are fixed. - Further fixes for builds on Leap 15.6. Fixes boo#1221496. Adds file fixes_for_leap15.6.patch ==== virtualbox-kmp ==== - The location of vboxconfig is wrong. Add file fixes_for_vboxconfig.patch to fix. Some errors in vboxdrv.sh are fixed. - Further fixes for builds on Leap 15.6. Fixes boo#1221496. Adds file fixes_for_leap15.6.patch

1 0

Tumbleweed - Review of the week 2024/13
by Dominique Leuenberger 30 Mar '24

30 Mar '24

Dear Tumbleweed users and hackers, What a week! We all were looking forward to a short week just before the Easter weekend and a long break. Things just never are, as they are expected to be, right? You have “only” received 4 snapshots this week (0325, 0326, 0327, and 0328) – and, as happens very rarely, some updates in the update channel (this should indicate to you it is important enough for us to side-track the already fast release process). The most relevant changes this week were: * Mesa 24.0.3 * KDE Gear 24.02.1 * emacs 20.3 * Shadow 4.15.1 * Mozilla Firefox 124.0.1 * KDE Plasma 6.0.3 * LibreOffice 24.2.2 * TeXLive 2024 * Qt 6.6.3 * cURL 8.7.1 !!! xz 5.6.1.revertto5.4 (version 5.4, but with a version tag > 5.6.1 for users that wrongly would not use zypper dup – we wanted to be sure). Please see https://news.opensuse.org/2024/03/29/xz-backdoor/ and upgrade SOON (at least liblzma5, then reboot) For some regions, there is a long weekend ahead – so expect no / few snapshots until early next week. For snapshot 0328, Ring0 has been completely bootstrapped (as the attack vectors for xz were not fully known, we went the safest route) and for 0329 all of Tumbleweed rebuilt against that new base; Ezpect that snapshot to appear ‘large’ (even though many packages will not be different). The relevant changes to come to you during the next days/week include: * Python 3.9 module removal (the bootstrap rebuild was a good excuse, as that removal would have required OBS internal rebuild strategy anyway – so instead of doing it twice, we pulled that change forward into 0329 – I mentioned that removed for a few weeks already) * Linux kernel 6.8.2 * Linux LTS Kernel 6.6.23 * dbus-broker: no progress this week * libxml 2.12.x: slow/no progress * GCC 14: phase 2: use gcc14 as the default compiler Cheers, Dominique

2 1

Plasma6 styles / themes / "breeze light" - I need to change the colors
by rs.opensuse＠spitzenpfeil.org 30 Mar '24

30 Mar '24

For the life of me I cannot find where to change the colors of the application launcher. Some themes change it though. On plasma5 the "openSUSE" theme had a very plain looking app launcher (I dig it), with very recent plasma6 the frame (with search box, shutdown ... ) is a light grey, fine, and the inside box with all the application icons is a very ugly greenish gray - I must change it - but where? Window decorations and so forth are fine, it's just the application launcher that badky hurts my eyes. I've tried messing with "/usr/share/plasma/desktopthemes/breeze-light/colors" and got all sorts of ugly colors, but the grey background always stayed :-( Some help please Robert

2 1