February 2020 - openSUSE Kubic - openSUSE Mailing Lists

[opensuse-kubic] New MicroOS snapshot 20200214 released!
by Richard Brown 16 Feb '20

16 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=1&version… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: c-ares (1.15.0+20191108 -> 1.15.0+20200117) grub2 iproute2 (5.4 -> 5.5.0) mozilla-nss (3.48 -> 3.49.2) nano (4.7 -> 4.8) python-decorator (4.4.0 -> 4.4.1) python-packaging (19.2 -> 20.1) python-pyparsing (2.4.5 -> 2.4.6) python-urllib3 (1.25.6 -> 1.25.8) === Details === ==== c-ares ==== Version update (1.15.0+20191108 -> 1.15.0+20200117) - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Switch to cmake-based build. Some packages need the cmake build files. ==== grub2 ==== Subpackages: grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi - From Stefan Seyfried <seife(a)novell.slipkontur.de> : Fix grub2-install fails with "not a directory" error (boo#1161641, bsc#1162403) * grub2-install-fix-not-a-directory-error.patch ==== iproute2 ==== Version update (5.4 -> 5.5.0) - Update to new upstream version 5.5 * bridge: support fdb get * devlink: command line option to switch netns * devlink: all changing netns on reload * devlink: new timestamp format for health report dump * ip: support for alternative device names * ip link: support to get SR-IOV VF node GUID and port GUID * ip neigh: support get * rdma: relax requirement to have PID for HW objects * rdma: stat show mr * ss: allow dumping kTLS info * tc: support action flags * tc flower: support masked port destination and source match * tc pie: add dq_rate_estimator option * tipc: new commands to set TIPC AEAD key * more json support - drop patches obsoleted by version upgrade: * ss-fix-end-of-line-printing-in-misc-ss.c.patch * no-double-definitions.patch * Revert-emp-fix-warning-on-deprecated-bison-directive.patch * Revert-tc-ematch-fix-deprecated-yacc-warning.patch - refresh * split-link-and-compile-steps-for-binaries.patch ==== mozilla-nss ==== Version update (3.48 -> 3.49.2) - update to NSS 3.49.2 Fixed bugs: * Fix compilation problems with NEON-specific code in freebl (bmo#1608327) * Fix a taskcluster issue with Python 2 / Python 3 (bmo#1608895) - update to NSS 3.49.1 3.49.1 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49.1_re… * Cache the most recent PBKDF2 password hash, to speed up repeated SDR operations, important with the increased KDF iteration counts (bmo#1606992) 3.49 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_rele… * The legacy DBM database, libnssdbm, is no longer built by default when using gyp builds (bmo#1594933) * several bugfixes ==== nano ==== Version update (4.7 -> 4.8) - update to 4.8: * When something is pasted into nano, suppress auto-indentation * paste can be undone as a whole with a single M-U * Improve handling of lock files on start-up * Shift+Meta+letter key combos can be bound with 'bind Sh-M-letter' * A custom nanorc file can be specified on the command line, with - f filename or --rcfile=filename ==== python-decorator ==== Version update (4.4.0 -> 4.4.1) - update to 4.4.1: Changed the description to "Decorators for Humans" are requested by several users. Fixed a .rst bug in the description as seen in PyPI. ==== python-packaging ==== Version update (19.2 -> 20.1) - add issue_254.patch to fix tests under non-x86_64 pplatforms - Update to 20.1 * Fix a bug caused by reuse of an exhausted iterator. * Add type hints * Add proper trove classifiers for PyPy support * Scale back depending on ctypes for manylinux support detection * Use sys.implementation.name where appropriate for packaging.tags * Expand upon the API provded by packaging.tags * Officially support Python 3.8 * Add major, minor, and micro aliases to packaging.version.Version * Properly mark packaging has being fully typed by adding a py.typed file ==== python-pyparsing ==== Version update (2.4.5 -> 2.4.6) - update to 2.4.6 * Fixed typos in White mapping of whitespace characters, to use correct "\u" prefix instead of "u". * fix bug in left-associative ternary operators defined using infixNotation. First reported on StackOverflow by user Jeronimo. * Backport of pyparsing_test namespace from 3.0.0, including TestParseResultsAsserts mixin class defining unittest-helper methods: . def assertParseResultsEquals( self, result, expected_list=None, expected_dict=None, msg=None) . def assertParseAndCheckList( self, expr, test_string, expected_list, msg=None, verbose=True) . def assertParseAndCheckDict( self, expr, test_string, expected_dict, msg=None, verbose=True) . def assertRunTestResults( self, run_tests_report, expected_parse_results=None, msg=None) . def assertRaisesParseException(self, exc_type=ParseException, msg=None) ==== python-urllib3 ==== Version update (1.25.6 -> 1.25.8) - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New Kubic snapshot 20200214 released!
by Richard Brown 16 Feb '20

16 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=T… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: c-ares (1.15.0+20191108 -> 1.15.0+20200117) etcd (3.3.15 -> 3.4.3) grub2 iproute2 (5.4 -> 5.5.0) mozilla-nss (3.48 -> 3.49.2) nano (4.7 -> 4.8) python-decorator (4.4.0 -> 4.4.1) python-packaging (19.2 -> 20.1) python-pyparsing (2.4.5 -> 2.4.6) python-urllib3 (1.25.6 -> 1.25.8) === Details === ==== c-ares ==== Version update (1.15.0+20191108 -> 1.15.0+20200117) - Upgrade to latest snapshot from 2020-01-17 - disable-live-tests.patch: refreshed - regression.patch: fix a regression in DNS results that contain both A and AAAA answers. - Add netcfg as the build requirement and runtime requirement. ares_getaddrinfo function uses the getservbyport_r function which requires the /etc/services file to function properly. That config file is provided by the netcfg package. Unit tests rely on it too, hence it has to be a build dependency as well. - Switch to cmake-based build. Some packages need the cmake build files. ==== etcd ==== Version update (3.3.15 -> 3.4.3) - Update to version 3.4.3: * version: 3.4.3 * *: use Go 1.12.12 * rafthttp: add 3.4 stream type * etcdserver: strip patch version in metrics * etcdserver: strip patch version in cluster version * etcdserver: unset old cluster version in metrics * Add version, tag and branch checks to release script * scripts: fix read failure prompt in release; use https for git clone. * version: 3.4.2 * etcdserver: trace compaction request; add return parameter 'trace' to applierV3.Compaction() mvcc: trace compaction request; add input parameter 'trace' to KV.Compact() * etcdserver: trace raft requests. * etcdserver: add put request steps. mvcc: add put request steps; add trace to KV.Write() as input parameter. * pkg: use zap logger to format the structure log output. * pkg: add field to record additional detail of trace; add stepThreshold to reduce log volume. * pkg: create package traceutil for tracing. mvcc: add tracing steps:range from the in-memory index tree; range from boltdb. etcdserver: add tracing steps: agreement among raft nodes before linerized reading; authentication; filter and sort kv pairs; assemble the response. * clientv3: Replace endpoint.ParseHostPort with net.SplitHostPort to fix IPv6 client endpoints * clientv3: Set authority used in cert checks to host of endpoint * tests/e2e: fix metrics tests * etcdctl: fix member add command * scripts/build-binary: fix darwin tar commands * scripts/release: fix SHA256SUMS command * version: 3.4.1 * scripts/release: fix docker push command * integration: fix bug in for loop, make it break properly * embed: expose ZapLoggerBuilder * vendor: upgrade to gRPC v1.23.1 ==== grub2 ==== Subpackages: grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi - From Stefan Seyfried <seife(a)novell.slipkontur.de> : Fix grub2-install fails with "not a directory" error (boo#1161641, bsc#1162403) * grub2-install-fix-not-a-directory-error.patch ==== iproute2 ==== Version update (5.4 -> 5.5.0) - Update to new upstream version 5.5 * bridge: support fdb get * devlink: command line option to switch netns * devlink: all changing netns on reload * devlink: new timestamp format for health report dump * ip: support for alternative device names * ip link: support to get SR-IOV VF node GUID and port GUID * ip neigh: support get * rdma: relax requirement to have PID for HW objects * rdma: stat show mr * ss: allow dumping kTLS info * tc: support action flags * tc flower: support masked port destination and source match * tc pie: add dq_rate_estimator option * tipc: new commands to set TIPC AEAD key * more json support - drop patches obsoleted by version upgrade: * ss-fix-end-of-line-printing-in-misc-ss.c.patch * no-double-definitions.patch * Revert-emp-fix-warning-on-deprecated-bison-directive.patch * Revert-tc-ematch-fix-deprecated-yacc-warning.patch - refresh * split-link-and-compile-steps-for-binaries.patch ==== mozilla-nss ==== Version update (3.48 -> 3.49.2) - update to NSS 3.49.2 Fixed bugs: * Fix compilation problems with NEON-specific code in freebl (bmo#1608327) * Fix a taskcluster issue with Python 2 / Python 3 (bmo#1608895) - update to NSS 3.49.1 3.49.1 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49.1_re… * Cache the most recent PBKDF2 password hash, to speed up repeated SDR operations, important with the increased KDF iteration counts (bmo#1606992) 3.49 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.49_rele… * The legacy DBM database, libnssdbm, is no longer built by default when using gyp builds (bmo#1594933) * several bugfixes ==== nano ==== Version update (4.7 -> 4.8) - update to 4.8: * When something is pasted into nano, suppress auto-indentation * paste can be undone as a whole with a single M-U * Improve handling of lock files on start-up * Shift+Meta+letter key combos can be bound with 'bind Sh-M-letter' * A custom nanorc file can be specified on the command line, with - f filename or --rcfile=filename ==== python-decorator ==== Version update (4.4.0 -> 4.4.1) - update to 4.4.1: Changed the description to "Decorators for Humans" are requested by several users. Fixed a .rst bug in the description as seen in PyPI. ==== python-packaging ==== Version update (19.2 -> 20.1) - add issue_254.patch to fix tests under non-x86_64 pplatforms - Update to 20.1 * Fix a bug caused by reuse of an exhausted iterator. * Add type hints * Add proper trove classifiers for PyPy support * Scale back depending on ctypes for manylinux support detection * Use sys.implementation.name where appropriate for packaging.tags * Expand upon the API provded by packaging.tags * Officially support Python 3.8 * Add major, minor, and micro aliases to packaging.version.Version * Properly mark packaging has being fully typed by adding a py.typed file ==== python-pyparsing ==== Version update (2.4.5 -> 2.4.6) - update to 2.4.6 * Fixed typos in White mapping of whitespace characters, to use correct "\u" prefix instead of "u". * fix bug in left-associative ternary operators defined using infixNotation. First reported on StackOverflow by user Jeronimo. * Backport of pyparsing_test namespace from 3.0.0, including TestParseResultsAsserts mixin class defining unittest-helper methods: . def assertParseResultsEquals( self, result, expected_list=None, expected_dict=None, msg=None) . def assertParseAndCheckList( self, expr, test_string, expected_list, msg=None, verbose=True) . def assertParseAndCheckDict( self, expr, test_string, expected_dict, msg=None, verbose=True) . def assertRunTestResults( self, run_tests_report, expected_parse_results=None, msg=None) . def assertRaisesParseException(self, exc_type=ParseException, msg=None) ==== python-urllib3 ==== Version update (1.25.6 -> 1.25.8) - update to 1.25.8 * Drop support for EOL Python 3.4 * Optimize _encode_invalid_chars * Preserve chunked parameter on retries * Allow unset SERVER_SOFTWARE in App Engine * Fix issue where URL fragment was sent within the request target. * Fix issue where an empty query section in a URL would fail to parse. * Remove TLS 1.3 support in SecureTransport due to Apple removing support. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New MicroOS snapshot 20200213 released!
by Richard Brown 14 Feb '20

14 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=1&version… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: coreutils elfutils (0.177 -> 0.178) permissions (1550_20191205 -> 1550_20200204) === Details === ==== coreutils ==== - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - minor: remove obsolete comment in spec file. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays ==== elfutils ==== Version update (0.177 -> 0.178) Subpackages: libasm1 libdw1 libelf1 - Re-add libelf1 to baselibs.conf: we still generate a libelf-devel-32bit, which is only installable if libelf1-21bit also exists. - Exclude debuginfod sub-packages and move them to elfutils-debuginfod. - Avoid double-shipping libdebuginfo.so.1 in two different subpackages. Fixup RPM group. - Split libdebuginfod1 into libdebuginfod1 and debuginfod-client. Add Requires for these packages. - Rename debuginfod-client package to libdebuginfod1 in order to fulfil SLPP violation. - Fix variable references in specfile - Use %fillupdir macros for proper sysconfig export. - Update to version 0.178: debuginfod: New server, client tool and library to index and fetch ELF/DWARF files addressed by build-id through HTTP. doc: There are now some manual pages for functions and tools. backends: The libebl libraries are no longer dynamically loaded through dlopen, but are now compiled into libdw.so directly. readelf: -n, --notes now takes an optional "SECTION" argument. - p and -x now also handle section numbers. New option --dyn-sym to show just the dynamic symbol table. libcpu: Add RISC-V disassembler. libdw: Abbrevs and DIEs can now be read concurrently by multiple threads through the same Dwarf handle. libdwfl: Will try to use debuginfod when installed as fallback to retrieve ELF and DWARF debug data files by build-id. - remove dwelf_elf_e_machine_string.patch. - remove unused libebl-plugins and libebl-devel subpackages - new subpackages debuginfod-client, debuginfod-client-devel and debuginfod added - main package binaries are explicitely listed and man pages for the binaries are included - Add remove-run-large-elf-file.sh.patch in order to remove running run-large-elf-file.sh (it hit OOM). ==== permissions ==== Version update (1550_20191205 -> 1550_20200204) Subpackages: chkstat permissions-config - Update to version 20200204: * mariadb: settings for new auth_pam_tool (bsc#1160285) * chkstat: - add read-only fallback when /proc is not mounted (bsc#1160764) - capability handling fixes (bsc#1161779) - better error message when refusing to fix dir perms (#32) - Update to version 20200127: * fix paths of ksysguard whitelisting * fix zero-termination of error message for overly long paths -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New Kubic snapshot 20200213 released!
by Richard Brown 14 Feb '20

14 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=T… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: coreutils elfutils (0.177 -> 0.178) permissions (1550_20191205 -> 1550_20200204) === Details === ==== coreutils ==== - disable single and testsuite builds in rings/staging - remove duplicate "coreutils" in flavor to make it look nicer in OBS - minor: remove obsolete comment in spec file. - switch to multibuild - add coreutils-single subpackage that contains a single binary coreutils tool similar to busybox - package LC_CTIME directories also in lang package - split off doc package - remove info macros, handled by file trigger nowadays ==== elfutils ==== Version update (0.177 -> 0.178) Subpackages: libasm1 libdw1 libelf1 - Re-add libelf1 to baselibs.conf: we still generate a libelf-devel-32bit, which is only installable if libelf1-21bit also exists. - Exclude debuginfod sub-packages and move them to elfutils-debuginfod. - Avoid double-shipping libdebuginfo.so.1 in two different subpackages. Fixup RPM group. - Split libdebuginfod1 into libdebuginfod1 and debuginfod-client. Add Requires for these packages. - Rename debuginfod-client package to libdebuginfod1 in order to fulfil SLPP violation. - Fix variable references in specfile - Use %fillupdir macros for proper sysconfig export. - Update to version 0.178: debuginfod: New server, client tool and library to index and fetch ELF/DWARF files addressed by build-id through HTTP. doc: There are now some manual pages for functions and tools. backends: The libebl libraries are no longer dynamically loaded through dlopen, but are now compiled into libdw.so directly. readelf: -n, --notes now takes an optional "SECTION" argument. - p and -x now also handle section numbers. New option --dyn-sym to show just the dynamic symbol table. libcpu: Add RISC-V disassembler. libdw: Abbrevs and DIEs can now be read concurrently by multiple threads through the same Dwarf handle. libdwfl: Will try to use debuginfod when installed as fallback to retrieve ELF and DWARF debug data files by build-id. - remove dwelf_elf_e_machine_string.patch. - remove unused libebl-plugins and libebl-devel subpackages - new subpackages debuginfod-client, debuginfod-client-devel and debuginfod added - main package binaries are explicitely listed and man pages for the binaries are included - Add remove-run-large-elf-file.sh.patch in order to remove running run-large-elf-file.sh (it hit OOM). ==== permissions ==== Version update (1550_20191205 -> 1550_20200204) Subpackages: chkstat permissions-config - Update to version 20200204: * mariadb: settings for new auth_pam_tool (bsc#1160285) * chkstat: - add read-only fallback when /proc is not mounted (bsc#1160764) - capability handling fixes (bsc#1161779) - better error message when refusing to fix dir perms (#32) - Update to version 20200127: * fix paths of ksysguard whitelisting * fix zero-termination of error message for overly long paths -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] Re: MicroOS and (Silverblue) toolbox
by Dario Faggioli 14 Feb '20

14 Feb '20

On Fri, 2020-02-14 at 11:13 +0100, Richard Brown wrote: > On Thu, 2020-02-13 at 20:25 +0100, Dario Faggioli wrote: > > Hi Dario, > Hi! > I've got a few questions from your dockerfile :) > Sure... However, I feel like I did not really made it clear what I've been doing and what I have in mind. So, if you allow me, I'll try to fix this first, by adding some more info and context. Sorry for the confusion. :-/ So, in my daily development work I deal with several projects. Some examples are the Linux kernel, Xen or QEMU. It happens that I make changes to the sources of these project which I then may want to (at least) build test locally. Well, as you can imagine, for building such projects I need their build dependencies installed on my workstation. And the list of required packages is quite long. They kind of all need stuff like gcc, make flex, bison, etc. Plus, the kernel needs `bc` (yeah, I know! :-P), Xen needs libyajl-devel, QEMU needs libSDL2-devel and so on and so forth. Now, if my workstation would be a, MicroOS based, immutable rootfs desktop system, I definitely would not want to have all those packages installed on the main OS, for obvious reasons. The idea would be to build and test my work in containers, and that is similar to what toolbox does already. However: - I'd need a container inside which the home directory of my main OS user, where I presumably keep the sources, is there and is easily accessible at its standard path (e.g., in /home/dario, in case build time paths matter for either building or testing, etc); - I'd prefer to be a regular user inside such container, even if I know how our toolbox maps root in the container. E.g., although I can't name one out of the top of my head, I've definitely seen projects that complain if you try to build or run them as root; - I may want to build each project (or maybe a specific set of project, with similar scope and/or dependency) in their own container. In order to achiev these goals that I think we have a couple of options: 1) adopting Silverblue's toolbox which pretty much gives you all the things I mentioned above already. It actually does a lot more than that, up to a point that I'd call it overkill for my usecase, at least right now. And, for using it, there are requirements on the container image. Also, although they did a good job at making it generic, there are a couple of things that are either specific of Silverblue/Fedora or that, in general, do not integrate perfectly well with our environment (I mean, in addition to the changes to the container image). Therefore, some adjustment here and there would be necessary. 2) Modifying our toolbox in such a way that it gains the feature I need. As said, this email was meant at starting a discussion here about what it takes to achieve 1) and whether or not we want to try going that way. In these days, I also have worked toward 2), the result of which you can see it here: https://github.com/dfaggioli/microos-toolbox/tree/user-mode But even if we go for 2) --and I'm actively suggesting we should, and in fact I'm sending the pull request to Thorsten-- I figured it could be interesting, for our users, to be able to use that Silverblue's toolbox, if they want. Now, hoping to have clarified things at least a little, off to your questions. :-D > > --- > > FROM registry.opensuse.org/opensuse/toolbox:latest > > > > ENV NAME=opensuse-toolbox-test VERSION=tumbleweed > > LABEL com.github.containers.toolbox="true" \ > > com.github.debarshiray.toolbox="true" \ > > These labels don't seem to be correct given the openSUSE toolbox > container isn't related to the github.com/containers or > github.com/debarshiray projects.. > Indeed. It's a requirement for a containers/toolbox image, though. Or at least that's what I read in their doc, here: https://github.com/containers/toolbox#image-requirements But I totally agree with you here... This was one of the main reasons why I wasn't sure about using just one image for both tools. > > # We need: > > # - sudo and the wheel group (sudo, system-group-wheel) > > # - mount (util-linux) > > Why do we need util-linux mount when busybox mount already works in > our > current toolbox? > Mmm... I can double check again, but I've seen bind mount failing (inside the container), until I installed it. > > # - /etc/machine-id (systemd) > > Why do we need the machine-id? Even if we do need a machine-id > readable > from within the container, wouldn't it make more sense to volume > mount > /etc/machine-id from the host to the toolbox - the toolbox is not > it's > own machine, so shouldn't have it's own machine-id. > That's actually what the tool does. But it does it with a bind-mount once inside the container, and this fails for me if /etc/machine-id does not exist inside the container itself, before the mount. That being said, I can see how to work this around (e.g., by creating one from the Dockerfile). > > # - capsh (libcap-progs) > > RUN zypper install -y --no-recommends \ > > libcap-progs \ > > sudo \ > > system-group-wheel \ > > systemd \ > > util-linux > > RUN zypper clean > > > > # We need sudo configured for users in group `wheel` > > RUN echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/wheel > > Why do we need wheel/sudo & this sudo configuration when our toolbox > only has a root user already? > containers/toolbox tries to do the thing that I described at the beginning, i.e., setup a toolbox with a regular user (the same one than on the host). And if you do this, you want it to have sudo access, e.g., for installing packages... As I'm proposing doing in our toolbox as well. :-) Thanks and Regards -- Dario Faggioli, Ph.D http://about.me/dario.faggioli Virtualization Software Engineer SUSE Labs, SUSE https://www.suse.com/ ------------------------------------------------------------------- <<This happens because _I_ choose it to happen!>> (Raistlin Majere)

2 2

[opensuse-kubic] New MicroOS snapshot 20200211 released!
by Richard Brown 13 Feb '20

13 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=1&version… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: aaa_base (84.87+git20200206.ed897a1 -> 84.87+git20200207.27e2c61) kernel-source (5.5.1 -> 5.5.2) libtirpc systemd === Details === ==== aaa_base ==== Version update (84.87+git20200206.ed897a1 -> 84.87+git20200207.27e2c61) - Update to version 84.87+git20200207.27e2c61: * change rp_filter to 2 to follow the current default (bsc#1160735) ==== kernel-source ==== Version update (5.5.1 -> 5.5.2) - config.conf: enable armv6 and armv7 configs - commit d355d69 - series.conf: cleanup - update upstream reference (in mainline now) and move to "almost mainline" section: patches.suse/btrfs-do-not-zero-f_bavail-if-we-have-available-spac.patch - commit d386a7a - Linux 5.5.2 (bnc#1012628). - vfs: fix do_last() regression (bnc#1012628). - cifs: fix soft mounts hanging in the reconnect code (bnc#1012628). - x86/resctrl: Fix a deadlock due to inaccurate reference (bnc#1012628). - x86/resctrl: Fix use-after-free when deleting resource groups (bnc#1012628). - x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup (bnc#1012628). - KVM: PPC: Book3S PR: Fix -Werror=return-type build failure (bnc#1012628). - gfs2: Another gfs2_find_jhead fix (bnc#1012628). - lib/test_bitmap: correct test data offsets for 32-bit (bnc#1012628). - perf c2c: Fix return type for histogram sorting comparision functions (bnc#1012628). - PM / devfreq: Add new name attribute for sysfs (bnc#1012628). - tools lib: Fix builds when glibc contains strlcpy() (bnc#1012628). - arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' (bnc#1012628). - mm/mempolicy.c: fix out of bounds write in mpol_parse_str() (bnc#1012628). - reiserfs: Fix memory leak of journal device string (bnc#1012628). - media: digitv: don't continue if remote control state can't be read (bnc#1012628). - media: af9005: uninitialized variable printked (bnc#1012628). - media: vp7045: do not read uninitialized values if usb transfer fails (bnc#1012628). - media: gspca: zero usb_buf (bnc#1012628). - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 (bnc#1012628). - tomoyo: Use atomic_t for statistics counter (bnc#1012628). - ttyprintk: fix a potential deadlock in interrupt context issue (bnc#1012628). - Bluetooth: Fix race condition in hci_release_sock() (bnc#1012628). - cgroup: Prevent double killing of css when enabling threaded cgroup (bnc#1012628). - commit c2619d7 ==== libtirpc ==== Subpackages: libtirpc-netconfig libtirpc3 - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) ==== systemd ==== Subpackages: libsystemd0 libudev1 systemd-logger systemd-sysvinit udev - Import commit f8adabc2b1f3e3ad150e7a3bfa88341eda5a8a57 (merge v244.2) 77c04ce5c2 hwdb: update to v245-rc1 b4eb884824 Fix typo in function name e2d4cb9843 polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it 83bfc0d8dd sd-bus: introduce API for re-enqueuing incoming messages 5926f9f172 polkit: use structured initialization 0697d0d972 polkit: on async pk requests, re-validate action/details 2589995acd polkit: reuse some common bus message appending code 5b2442d5c3 bus-polkit: rename return error parameter to ret_error 0a19ff7004 shared: split out polkit stuff from bus-util.c ? bus-polkit.c 1325dfb577 test: adapt to the new capsh format 3538fafb47 meson: update efi path detection to gnu-efi-3.0.11 3034855a5b presets: "disable" all passive targets by default c2e3046819 shared/sysctl-util: normalize repeated slashes or dots to a single value 6f4364046f dhcp6: do not use T1 and T2 longer than one provided by the lease 0ed6cda28d network: fix implicit type conversion warning by GCC-10 f6a5c02d26 bootspec: parse random-seed-mode line in loader.conf ddc5dca8a7 sd-boot: fix typo 2bbbe9ae41 test: Synchronize journal before reading from it 072485d661 sd-bus: fix introspection bug in signal parameter names 80af3cf5e3 efi: fix build. [...] - Use suse.pool.ntp.org server pool on SLE (jsc#SLE-7683) - Drop scripts-udev-convert-lib-udev-path.sh Nobody should need it these days. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New Kubic snapshot 20200211 released!
by Richard Brown 13 Feb '20

13 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=T… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: aaa_base (84.87+git20200206.ed897a1 -> 84.87+git20200207.27e2c61) kernel-source (5.5.1 -> 5.5.2) libtirpc systemd === Details === ==== aaa_base ==== Version update (84.87+git20200206.ed897a1 -> 84.87+git20200207.27e2c61) - Update to version 84.87+git20200207.27e2c61: * change rp_filter to 2 to follow the current default (bsc#1160735) ==== kernel-source ==== Version update (5.5.1 -> 5.5.2) - config.conf: enable armv6 and armv7 configs - commit d355d69 - series.conf: cleanup - update upstream reference (in mainline now) and move to "almost mainline" section: patches.suse/btrfs-do-not-zero-f_bavail-if-we-have-available-spac.patch - commit d386a7a - Linux 5.5.2 (bnc#1012628). - vfs: fix do_last() regression (bnc#1012628). - cifs: fix soft mounts hanging in the reconnect code (bnc#1012628). - x86/resctrl: Fix a deadlock due to inaccurate reference (bnc#1012628). - x86/resctrl: Fix use-after-free when deleting resource groups (bnc#1012628). - x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup (bnc#1012628). - KVM: PPC: Book3S PR: Fix -Werror=return-type build failure (bnc#1012628). - gfs2: Another gfs2_find_jhead fix (bnc#1012628). - lib/test_bitmap: correct test data offsets for 32-bit (bnc#1012628). - perf c2c: Fix return type for histogram sorting comparision functions (bnc#1012628). - PM / devfreq: Add new name attribute for sysfs (bnc#1012628). - tools lib: Fix builds when glibc contains strlcpy() (bnc#1012628). - arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' (bnc#1012628). - mm/mempolicy.c: fix out of bounds write in mpol_parse_str() (bnc#1012628). - reiserfs: Fix memory leak of journal device string (bnc#1012628). - media: digitv: don't continue if remote control state can't be read (bnc#1012628). - media: af9005: uninitialized variable printked (bnc#1012628). - media: vp7045: do not read uninitialized values if usb transfer fails (bnc#1012628). - media: gspca: zero usb_buf (bnc#1012628). - media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 (bnc#1012628). - tomoyo: Use atomic_t for statistics counter (bnc#1012628). - ttyprintk: fix a potential deadlock in interrupt context issue (bnc#1012628). - Bluetooth: Fix race condition in hci_release_sock() (bnc#1012628). - cgroup: Prevent double killing of css when enabling threaded cgroup (bnc#1012628). - commit c2619d7 ==== libtirpc ==== Subpackages: libtirpc-netconfig libtirpc3 - Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common") to fix build error with gcc flag -fno-common (bsc#1160875). Tested on gcc-9 and gcc-10. 0001-Avoid-multiple-definiton-with-gcc-fno-common.patch - Skip unneeded autogen.sh run (configure is up-to-date), drop dependencies: libtool, autoconf - Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5) ==== systemd ==== Subpackages: libsystemd0 libudev1 systemd-logger systemd-sysvinit udev - Import commit f8adabc2b1f3e3ad150e7a3bfa88341eda5a8a57 (merge v244.2) 77c04ce5c2 hwdb: update to v245-rc1 b4eb884824 Fix typo in function name e2d4cb9843 polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it 83bfc0d8dd sd-bus: introduce API for re-enqueuing incoming messages 5926f9f172 polkit: use structured initialization 0697d0d972 polkit: on async pk requests, re-validate action/details 2589995acd polkit: reuse some common bus message appending code 5b2442d5c3 bus-polkit: rename return error parameter to ret_error 0a19ff7004 shared: split out polkit stuff from bus-util.c ? bus-polkit.c 1325dfb577 test: adapt to the new capsh format 3538fafb47 meson: update efi path detection to gnu-efi-3.0.11 3034855a5b presets: "disable" all passive targets by default c2e3046819 shared/sysctl-util: normalize repeated slashes or dots to a single value 6f4364046f dhcp6: do not use T1 and T2 longer than one provided by the lease 0ed6cda28d network: fix implicit type conversion warning by GCC-10 f6a5c02d26 bootspec: parse random-seed-mode line in loader.conf ddc5dca8a7 sd-boot: fix typo 2bbbe9ae41 test: Synchronize journal before reading from it 072485d661 sd-bus: fix introspection bug in signal parameter names 80af3cf5e3 efi: fix build. [...] - Use suse.pool.ntp.org server pool on SLE (jsc#SLE-7683) - Drop scripts-udev-convert-lib-udev-path.sh Nobody should need it these days. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New MicroOS snapshot 20200209 released!
by Richard Brown 11 Feb '20

11 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=1&version… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: cryptsetup (2.1.0 -> 2.3.0) installation-images-MicroOS (14.454 -> 14.456) kexec-tools rpm-config-SUSE (0.g45 -> 0.g52) system-users tar === Details === ==== cryptsetup ==== Version update (2.1.0 -> 2.3.0) Subpackages: libcryptsetup12 - Update to 2.3.0 (include release notes for 2.2.0) * BITLK (Windows BitLocker compatible) device access * Veritysetup now supports activation with additional PKCS7 signature of root hash through --root-hash-signature option. * Integritysetup now calculates hash integrity size according to algorithm instead of requiring an explicit tag size. * Integritysetup now supports fixed padding for dm-integrity devices. * A lot of fixes to online LUKS2 reecryption. * Add crypt_resume_by_volume_key() function to libcryptsetup. If a user has a volume key available, the LUKS device can be resumed directly using the provided volume key. No keyslot derivation is needed, only the key digest is checked. * Implement active device suspend info. Add CRYPT_ACTIVATE_SUSPENDED bit to crypt_get_active_device() flags that informs the caller that device is suspended (luksSuspend). * Allow --test-passphrase for a detached header. Before this fix, we required a data device specified on the command line even though it was not necessary for the passphrase check. * Allow --key-file option in legacy offline encryption. The option was ignored for LUKS1 encryption initialization. * Export memory safe functions. To make developing of some extensions simpler, we now export functions to handle memory with proper wipe on deallocation. * Fail crypt_keyslot_get_pbkdf for inactive LUKS1 keyslot. * Add optional global serialization lock for memory hard PBKDF. * Abort conversion to LUKS1 with incompatible sector size that is not supported in LUKS1. * Report error (-ENOENT) if no LUKS keyslots are available. User can now distinguish between a wrong passphrase and no keyslot available. * Fix a possible segfault in detached header handling (double free). * Add integritysetup support for bitmap mode introduced in Linux kernel 5.2. * The libcryptsetup now keeps all file descriptors to underlying device open during the whole lifetime of crypt device context to avoid excessive scanning in udev (udev run scan on every descriptor close). * The luksDump command now prints more info for reencryption keyslot (when a device is in-reencryption). * New --device-size parameter is supported for LUKS2 reencryption. * New --resume-only parameter is supported for LUKS2 reencryption. * The repair command now tries LUKS2 reencryption recovery if needed. * If reencryption device is a file image, an interactive dialog now asks if reencryption should be run safely in offline mode (if autodetection of active devices failed). * Fix activation through a token where dm-crypt volume key was not set through keyring (but using old device-mapper table parameter mode). * Online reencryption can now retain all keyslots (if all passphrases are provided). Note that keyslot numbers will change in this case. * Allow volume key file to be used if no LUKS2 keyslots are present. * Print a warning if online reencrypt is called over LUKS1 (not supported). * Fix TCRYPT KDF failure in FIPS mode. * Remove FIPS mode restriction for crypt_volume_key_get. * Reduce keyslots area size in luksFormat when the header device is too small. * Make resize action accept --device-size parameter (supports units suffix). ==== installation-images-MicroOS ==== Version update (14.454 -> 14.456) - merge gh#openSUSE/installation-images#357 - move gconv files into initrd (bsc#1161701) - netcfg has moved files to /usr/etc - 14.456 - merge gh#openSUSE/installation-images#356 - remove explicit dependency on openssl package - mount /proc in chroot environment during image build (bsc#1160594) - fix package version comparing - 14.455 ==== kexec-tools ==== - Fix build errors on old distributions * kexec-tools-video-capability.patch * kexec-tools-SYS_getrandom.patch ==== rpm-config-SUSE ==== Version update (0.g45 -> 0.g52) - Update to version 0.g52: * Make deprecated %install_info not fail when used within if/fi construct - Update to version 0.g50: * Add missing changelog entries and fix authors * Add ldconfig_scriptlets macros for RH/Fedora compatibility * move %install_info to file triggers (boo#1152105) ==== system-users ==== Subpackages: system-group-hardware system-group-wheel system-user-nobody - Add tss user for TPM tools (boo#1162360). ==== tar ==== - No longer recommend -lang: supplements are in use. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New Kubic snapshot 20200209 released!
by Richard Brown 11 Feb '20

11 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=T… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: cryptsetup (2.1.0 -> 2.3.0) installation-images-MicroOS (14.454 -> 14.456) kexec-tools kubernetes (1.17.0 -> 1.17.2) rpm-config-SUSE (0.g45 -> 0.g52) system-users tar === Details === ==== cryptsetup ==== Version update (2.1.0 -> 2.3.0) Subpackages: libcryptsetup12 - Update to 2.3.0 (include release notes for 2.2.0) * BITLK (Windows BitLocker compatible) device access * Veritysetup now supports activation with additional PKCS7 signature of root hash through --root-hash-signature option. * Integritysetup now calculates hash integrity size according to algorithm instead of requiring an explicit tag size. * Integritysetup now supports fixed padding for dm-integrity devices. * A lot of fixes to online LUKS2 reecryption. * Add crypt_resume_by_volume_key() function to libcryptsetup. If a user has a volume key available, the LUKS device can be resumed directly using the provided volume key. No keyslot derivation is needed, only the key digest is checked. * Implement active device suspend info. Add CRYPT_ACTIVATE_SUSPENDED bit to crypt_get_active_device() flags that informs the caller that device is suspended (luksSuspend). * Allow --test-passphrase for a detached header. Before this fix, we required a data device specified on the command line even though it was not necessary for the passphrase check. * Allow --key-file option in legacy offline encryption. The option was ignored for LUKS1 encryption initialization. * Export memory safe functions. To make developing of some extensions simpler, we now export functions to handle memory with proper wipe on deallocation. * Fail crypt_keyslot_get_pbkdf for inactive LUKS1 keyslot. * Add optional global serialization lock for memory hard PBKDF. * Abort conversion to LUKS1 with incompatible sector size that is not supported in LUKS1. * Report error (-ENOENT) if no LUKS keyslots are available. User can now distinguish between a wrong passphrase and no keyslot available. * Fix a possible segfault in detached header handling (double free). * Add integritysetup support for bitmap mode introduced in Linux kernel 5.2. * The libcryptsetup now keeps all file descriptors to underlying device open during the whole lifetime of crypt device context to avoid excessive scanning in udev (udev run scan on every descriptor close). * The luksDump command now prints more info for reencryption keyslot (when a device is in-reencryption). * New --device-size parameter is supported for LUKS2 reencryption. * New --resume-only parameter is supported for LUKS2 reencryption. * The repair command now tries LUKS2 reencryption recovery if needed. * If reencryption device is a file image, an interactive dialog now asks if reencryption should be run safely in offline mode (if autodetection of active devices failed). * Fix activation through a token where dm-crypt volume key was not set through keyring (but using old device-mapper table parameter mode). * Online reencryption can now retain all keyslots (if all passphrases are provided). Note that keyslot numbers will change in this case. * Allow volume key file to be used if no LUKS2 keyslots are present. * Print a warning if online reencrypt is called over LUKS1 (not supported). * Fix TCRYPT KDF failure in FIPS mode. * Remove FIPS mode restriction for crypt_volume_key_get. * Reduce keyslots area size in luksFormat when the header device is too small. * Make resize action accept --device-size parameter (supports units suffix). ==== installation-images-MicroOS ==== Version update (14.454 -> 14.456) - merge gh#openSUSE/installation-images#357 - move gconv files into initrd (bsc#1161701) - netcfg has moved files to /usr/etc - 14.456 - merge gh#openSUSE/installation-images#356 - remove explicit dependency on openssl package - mount /proc in chroot environment during image build (bsc#1160594) - fix package version comparing - 14.455 ==== kexec-tools ==== - Fix build errors on old distributions * kexec-tools-video-capability.patch * kexec-tools-SYS_getrandom.patch ==== kubernetes ==== Version update (1.17.0 -> 1.17.2) Subpackages: kubernetes-client kubernetes-kubeadm kubernetes-kubelet - Update to version 1.17.2: * [1.17] No-op whitespace fix to CHANGELOG-1.17 to trigger a new 1.17 build * Add/Update CHANGELOG-1.17.md for v1.17.1. * Drop version from static openapi json file * Update to golang(a)1.13.5 * Revert reflector changes from PR #83520 from 1.17 * Fix IPv6 addresses lost issue in pure ipv6 vsphere environment * Fix unit test to run in non-gce environments * fix: azure disk could not mounted on Standard_DC4s/DC2s instances * Use legacyscheme's types rather than testapi ones * Fix nil pointer dereference in the azure provider * Add unit test for extended ipv4 service IP range * Revert "remove ipallocator in favor of k/utils net package" * It fixes a bug where AAD token obtained by kubectl is incompatible with on-behalf-of flow and oidc. * Allocate map when out points to nil map * fix: azure data disk should use same key as os disk by default * Check FileInfo against nil during walk of container dir path * Add UID precondition to kubelet pod status patch updates * Add cache for VMSS. * Fix build break - Hyperkube image needs kubelet/kubectl * Include cloud/gcp in e2e.test * Do not swallow timeout in manageReplicas * Sync the status of static Pods * Increase Burst limit for discovery client * Update v1.17.0 CHANGELOG to match final draft * Fix LoadBalancer rule checking so that no unexpected LoadBalancer updates are made * Fix broken SELinux detection * Add/Update CHANGELOG-1.17.md for v1.17.0. * Kubernetes version v1.17.1-beta.0 openapi-spec file updates * Deflake kubectl custom printing test * Move hostdns.conf out of cni directory. ==== rpm-config-SUSE ==== Version update (0.g45 -> 0.g52) - Update to version 0.g52: * Make deprecated %install_info not fail when used within if/fi construct - Update to version 0.g50: * Add missing changelog entries and fix authors * Add ldconfig_scriptlets macros for RH/Fedora compatibility * move %install_info to file triggers (boo#1152105) ==== system-users ==== Subpackages: system-group-hardware system-group-wheel system-user-bin system-user-daemon system-user-nobody - Add tss user for TPM tools (boo#1162360). ==== tar ==== - No longer recommend -lang: supplements are in use. -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0

[opensuse-kubic] New ARM MicroOS snapshot 20200207 released!
by Guillaume Gardet 10 Feb '20

10 Feb '20

Please note that this mail was generated by a script. The described changes are computed based on the aarch64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=3&version… https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&com… Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: aaa_base (84.87+git20200116.59482ba -> 84.87+git20200206.ed897a1) conmon (2.0.9 -> 2.0.10) dracut (049+git118.a6090e2f -> 049.1+git120.dbfbfcb8) fuse-overlayfs (0.7.5 -> 0.7.6) gcc9 (9.2.1+r280037 -> 9.2.1+git1022) gettext-runtime gmp gnutls (3.6.11.1 -> 3.6.12) health-checker (1.3 -> 1.3.1) hwdata (0.331 -> 0.332) kdump libsepol libtasn1 (4.15.0 -> 4.16.0) makedumpfile (1.6.6 -> 1.6.7) nano (4.6 -> 4.7) netcfg open-iscsi openldap2 (2.4.48 -> 2.4.49) openssl-1_1 python-setuptools (41.6.0 -> 44.0.0) rebootmgr shadow (4.8 -> 4.8.1) sqlite3 === Details === ==== aaa_base ==== Version update (84.87+git20200116.59482ba -> 84.87+git20200206.ed897a1) - Update to version 84.87+git20200206.ed897a1: * get_kernel_version: fix for current kernel on s390x (from azouhr) - Update to version 84.87+git20200206.8d74b0b: * Fix services entry in /etc/nsswitch.conf [bsc#1162916] - Make sure glibc is recent enough else nsswitch.conf update will fail - Adjust Requires/Requires(pre)/Requires(post) - Update to version 84.87+git20200128.8a17290: * Move chkconfig to insserv-compat, as most functionality isn't supported anymore since we have different solutions with systemd. * Remove /usr/bin/mkinfodir, not used anywhere anymore ==== conmon ==== Version update (2.0.9 -> 2.0.10) - Update to v2.0.10: - journal logging: write to /dev/null instead of -1 ==== dracut ==== Version update (049+git118.a6090e2f -> 049.1+git120.dbfbfcb8) Subpackages: dracut-ima - Update to version 049.1+git120.dbfbfcb8: * 95zfcp_rules/parse-zfcp.sh: remove rule existence check (bsc#1008352) - Update to version 049.1+git119.abf1a408: * 30convertfs: adopt for SUSE (boo#1158777) ==== fuse-overlayfs ==== Version update (0.7.5 -> 0.7.6) - Update to v0.7.6 - do not look in lower layers for the ino if there is no origin xattr set - attempt to use the file path if the operation on the fd fails with ENXIO ==== gcc9 ==== Version update (9.2.1+r280037 -> 9.2.1+git1022) Subpackages: libgcc_s1 libstdc++6 - Update to releases/gcc-9 head (83f65674e78d97d27537361de1a9d74067ff228d). * Includes fix for [gcc#92692] ==== gettext-runtime ==== Subpackages: libtextstyle0 - Don't disable openmp with qemu, the emulation works now ==== gmp ==== - Remove broken packaged libgmp.a just containing LTO bytecode. ==== gnutls ==== Version update (3.6.11.1 -> 3.6.12) - gnutls 3.6.12 * libgnutls: Introduced TLS session flag (gnutls_session_get_flags()) to identify sessions that client request OCSP status request (#829). * libgnutls: Added support for X448 key exchange (RFC 7748) and Ed448 signature algorithm (RFC 8032) under TLS (#86). * libgnutls: Added the default-priority-string option to system configuration; it allows overriding the compiled-in default-priority-string. * libgnutls: Added support for GOST CNT_IMIT ciphersuite (as defined by draft-smyshlyaev-tls12-gost-suites-07). By default this ciphersuite is disabled. It can be enabled by adding +GOST to priority string. In the future this priority string may enable other GOST ciphersuites as well. Note, that server will fail to negotiate GOST ciphersuites if TLS 1.3 is enabled both on a server and a client. It is recommended for now to disable TLS 1.3 in setups where GOST ciphersuites are enabled on GnuTLS-based servers. * libgnutls: added priority shortcuts for different GOST categories like CIPHER-GOST-ALL, MAC-GOST-ALL, KX-GOST-ALL, SIGN-GOST-ALL, GROUP-GOST-ALL. * libgnutls: Reject certificates with invalid time fields. That is we reject certificates with invalid characters in Time fields, or invalid time formatting To continue accepting the invalid form compile with --disable-strict-der-time * libgnutls: Reject certificates which contain duplicate extensions. We were previously printing warnings when printing such a certificate, but that is not always sufficient to flag such certificates as invalid. Instead we now refuse to import them (#887). * libgnutls: If a CA is found in the trusted list, check in addition to time validity, whether the algorithms comply to the expected level prior to accepting it. This addresses the problem of accepting CAs which would have been marked as insecure otherwise (#877). * libgnutls: The min-verification-profile from system configuration applies for all certificate verifications, not only under TLS. The configuration can be overriden using the GNUTLS_SYSTEM_PRIORITY_FILE environment variable. * libgnutls: The stapled OCSP certificate verification adheres to the convention used throughout the library of setting the 'GNUTLS_CERT_INVALID' flag. * libgnutls: On client side only send OCSP staples if they have been requested by the server, and on server side always advertise that we support OCSP stapling * libgnutls: Introduced the gnutls_ocsp_req_const_t which is compatible with gnutls_ocsp_req_t but const. * certtool: Added the --verify-profile option to set a certificate verification profile. Use '--verify-profile low' for certificate verification to apply the 'NORMAL' verification profile. * certtool: The add_extension template option is considered even when generating a certificate from a certificate request. ==== health-checker ==== Version update (1.3 -> 1.3.1) Subpackages: health-checker-plugins-MicroOS - Update to version 1.3.1 * Support multiple menuentries in GRUB configuration [gh#kubic-project/health-checker#5] ==== hwdata ==== Version update (0.331 -> 0.332) - Update to version 0.322: * Updated pci, usb and vendor ids. ==== kdump ==== - kdump-activate-udev-rules-late-during-boot.patch: Activate kdump udev rules late during boot (bsc#1154837) ==== libsepol ==== - Add fnocommon.patch to prevent build failures on gcc10 and remove_cil_mem_error_handler.patch to prevent build failures due to leftovers from the removal of cil_mem_error_handler (bsc#1160874) ==== libtasn1 ==== Version update (4.15.0 -> 4.16.0) Subpackages: libtasn1-6 - libtasn1 4.16.0: * asn1_decode_simple_ber: added support for constructed definite octet strings * asn1_get_object_id_der: enhance the range of decoded OIDs * asn1_object_id_der: New function ==== makedumpfile ==== Version update (1.6.6 -> 1.6.7) - makedumpfile-PN_XNUM.patch: Define PN_XNUM if missing. - Update to version 1.6.7: + Makefile: remove -lebl from LIBS when no libebl.a. + Fix compilation warnings on 32-bit system. + Support newer kernels up to v5.4. - Drop makedumpfile-Increase-SECTION_MAP_LAST_BIT-to-4.patch: fixed upstream. - Drop libebl-devel BuildRequires: ebl is being absorbed by libdw. ==== nano ==== Version update (4.6 -> 4.7) - update to 4.7: * A <Tab> will indent a marked region only when mark/cursor diff * Two indentations are considered the same when they look the same * When using ^J, a line will nver be broken in leading whitespace ==== netcfg ==== - Require libnss_usrfiles2 for /usr/etc [bnc#1162666] ==== open-iscsi ==== Subpackages: iscsiuio libopeniscsiusr0_2_0 - Bug fixes, including addig support for "-fno-common" compiler option, 586 bug fixes, a bug fix for SHA1 handling, and other needed but small fixes (bsc#1160287), updating: * open-iscsi-SUSE-latest.diff.bz2 ==== openldap2 ==== Version update (2.4.48 -> 2.4.49) - updated to 2.4.49 - removed obsolete back-port patches: * 0013_openldap-its9124_fix_crash_with_cancel_exop.patch - removed obsolete source file DB_CONFIG OpenLDAP 2.4.49 Release (2020/01/30) Added slapd-monitor database entry count for slapd-mdb (ITS#9154) Fixed client tools to not add controls on cancel/abandon (ITS#9145) Fixed client tools SyncInfo message to be LDIF compliant (ITS#8116) Fixed libldap to correctly free sb (ITS#9081, ITS#8755) Fixed libldap descriptor leak if ldaps fails (ITS#9147) Fixed libldap remove unnecessary global mutex for GnuTLS (ITS#9069) Fixed slapd syntax evaluation of preferredDeliveryMethod (ITS#9067) Fixed slapd to relax domainScope control check (ITS#9100) Fixed slapd to have cleaner error handling during connection setup (ITS#9112) Fixed slapd data check when processing cancel exop (ITS#9124) Fixed slapd attribute description processing (ITS#9128) Fixed slapd-ldap to set oldctrls correctly (ITS#9076) Fixed slapd-mdb to honor unchecked limit with alias deref (ITS#7657) Fixed slapd-mdb missing final commit with slapindex (ITS#9095) Fixed slapd-mdb drop attr mappings added in an aborted txn (ITS#9091) Fixed slapd-mdb nosync FLAG configuration handling (ITS#9150) Fixed slapd-monitor global operation counter reporting (ITS#9119) Fixed slapo-ppolicy when used with slapauth (ITS#8629) Fixed slapo-ppolicy to add a missed normalised copy of pwdChangedTime (ITS#9126) Fixed slapo-syncprov fix sessionlog init (ITS#9146) Fixed slapo-unique loop termination (ITS#9077) Build Environment Fix mkdep to honor TMPDIR if set (ITS#9062) Remove ICU library detection (ITS#9144) Update config.guess and config.sub to support newer architectures (ITS#7855) Disable ITS8521 regression test as it is no longer valid (ITS#9015) Documentation admin24 - Fix inconsistent whitespace in replication section (ITS#9153) slapd-config(5)/slapd.conf(5) - Fix missing bold tag for keyword (ITS#9063) slapd-ldap(5) - Document "tls none" option (ITS#9071) slapo-ppolicy(5) - Correctly document pwdGraceAuthnLimit (ITS#9065) ==== openssl-1_1 ==== Subpackages: libopenssl1_1 - Support for CPACF enhancements - part 2 (crypto) [jsc#SLE-7575] - Add patches: * openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch * openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch - Temporarily ignore broken OPENSSL_INIT_NO_ATEXIT due to our layered FIPS initialization (bsc#1161789) * openssl-fips-ignore_broken_atexit_test.patch - Import FIPS patches from SLE-15 * openssl-fips-dont_run_FIPS_module_installed.patch * openssl-fips_mode.patch * openssl-ship_fips_standalone_hmac.patch * openssl-fips-clearerror.patch * openssl-fips-selftests_in_nonfips_mode.patch - Don't run FIPS power-up self-tests when the checksum files aren't installed (bsc#1042392) * add openssl-fips-run_selftests_only_when_module_is_complete.patch - Import FIPS patches from Fedora (bsc#1157702, jsc#SLE-9553) * openssl-1.1.1-fips-crng-test.patch * openssl-1.1.1-fips-post-rand.patch * openssl-1.1.1-fips.patch * openssl-1.1.0-issuer-hash.patch * openssl-1.1.1-evp-kdf.patch * openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch - keep EVP_KDF functions at version 1.1.1d for backward compatibility * add openssl-keep_EVP_KDF_functions_version.patch - Support for CPACF enhancements - part 1 (crypto) [bsc#1152695, jsc#SLE-7861] - Add patches: * openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch * openssl-s390x-assembly-pack-add-support-for-pcc-and-kma-inst.patch * openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch * openssl-s390x-assembly-pack-update-OPENSSL_s390xcap-3.patch * openssl-s390xcpuid.pl-fix-comment.patch * openssl-assembly-pack-accelerate-scalar-multiplication.patch * openssl-Enable-curve-spefific-ECDSA-implementations-via-EC_M.patch * openssl-s390x-assembly-pack-accelerate-ECDSA.patch * openssl-OPENSSL_s390xcap.pod-list-msa9-facility-bit-155.patch * openssl-s390x-assembly-pack-cleanse-only-sensitive-fields.patch * openssl-s390x-assembly-pack-fix-OPENSSL_s390xcap-z15-cpu-mas.patch * openssl-s390x-assembly-pack-fix-msa3-stfle-bit-detection.patch * openssl-Fix-9bf682f-which-broke-nistp224_method.patch ==== python-setuptools ==== Version update (41.6.0 -> 44.0.0) - update to 44.0.0 - last version with python2 support - add testdata.tar.gz -> missing data for testsuite * Drop support for Python 3.4. * include pyproject.toml in source distribution by default. Projects relying on the previous behavior where pyproject.toml * Setuptools once again declares 'setuptools' in the build-system.requires and adds PEP 517 build support by declaring itself as the build-backend * Fix support for easy_install's find-links option in setup.cfg * Build dependencies (setup_requires and tests_require) now install transitive dependencies indicated by extras. * Mark the easy_install script and setuptools command as deprecated, and use pip when available to fetch/build wheels for missing setup_requires/tests_require requirements, with the following differences in behavior: + support for python_requires + better support for wheels (proper handling of priority with respect to PEP 425 tags) + PEP 517/518 support + eggs are not supported + no support for the allow_hosts easy_install option (index_url/find_links are still honored) + pip environment variables are honored (and take precedence over easy_install options) * Removed the "upload" and "register" commands in favor of twine. * Add support for the license_files option in setup.cfg to automatically include multiple license files in a source distribution. * Update handling of wheels compatibility tags: * add support for manylinux2010 * fix use of removed 'm' ABI flag in Python 3.8 on Windows * Fix empty namespace package installation from wheel. * Setuptools now exposes a new entry point hook "setuptools.finalize_distribution_options", enabling plugins like setuptools_scm to configure options on the distribution at finalization time. ==== rebootmgr ==== - Disable ectd support (no current etcd C-library available) ==== shadow ==== Version update (4.8 -> 4.8.1) - Update to 4.8.1: * selinux: include stdio * man: don't suggest making groupmems user-writeable * Makefile: bail out on error in for loops * Adding logging of SSH_ORIGINAL_COMMAND to nologin * add new HOME_MODE login.defs option * Add tty logging to useradd * Useradd: make non-executable shell check only a warning * Update Dutch translation * user_busy: Do not mistake a regular user process for a namespaced one * Revert "Honor --sbindir and --bindir for binary installation" - Remove shadow-4.8-shell-check.patch: included - Remove shadow-4.8-selinux-include.patch: upstreamed ==== sqlite3 ==== - Fix a regression on ppc64be and s390x, found by the fuzzing tests, add 04885763c4cd00cb-s390-compatibility.patch. - Adapt some FTS tests to work on big endian archs: b20503aaf5b6595a-adapt-FTS-tests-for-big-endian.patch -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kubic+owner(a)opensuse.org

1 0