New Kubic snapshot 20220415 released!

18 Apr 2022


      Please note that this mail was generated by a script.
The described changes are computed based on the x86_64 DVD.
The full online repo contains too many changes to be listed here.

Please check the known defects of this snapshot before upgrading:
https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=Tumbleweed&build=20220415
https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&component=Kubic&query_format=advanced&resolution=---

Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org.
For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports
Packages changed:
  apparmor
  hwinfo (21.80 -> 21.81)
  icu (70.1 -> 71.1)
  installation-images-MicroOS (17.47 -> 17.48)
  kexec-tools
  keylime (6.3.1 -> 6.3.2)
  libapparmor
  libusb-1_0 (1.0.25 -> 1.0.26)
  patterns-microos
  socat
  vim (8.2.4602 -> 8.2.4745)
  wicked (0.6.68 -> 0.6.69)
  xen (4.16.0_08 -> 4.16.1_02)
  zchunk (1.1.16 -> 1.2.1)

=== Details ===

==== apparmor ====
Subpackages: apparmor-abstractions apparmor-parser apparmor-profiles apparmor-utils python3-apparmor

- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);
- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).

==== hwinfo ====
Version update (21.80 -> 21.81)

- merge gh#openSUSE/hwinfo#112
- fix bug in determining serial console device name (bsc#1198043)
- 21.81

==== icu ====
Version update (70.1 -> 71.1)

- update to 71.1:
  * updates to CLDR 41 locale data with various additions and corrections.
  * phrase-based line breaking for Japanese. Existing line breaking methods
    follow standards and conventions for body text but do not work well for
    short Japanese text, such as in titles and headings. This new feature is
    optimized for these use cases.
  * support for Hindi written in Latin letters (hi_Latn). The CLDR data for
    this increasingly popular locale has been significantly revised and
    expanded. Note that based on user expectations, hi_Latn incorporates a
    large amount of English, and can also be referred to as ?Hinglish?.
  * time zone data updated to version 2022a. Note that pre-1970 data for a
    number of time zones has been removed, as has been the case in the upstream
    tzdata release since 2021b.
- drop fix-ucptrietest-golden-diff.patch (upstream)

==== installation-images-MicroOS ====
Version update (17.47 -> 17.48)

- merge gh#openSUSE/installation-images#586
- add xrdb to inst-sys (bsc#1198294)
- 17.48

==== kexec-tools ====

- kexec-tools-print-error-if-kexec_file_load-fails.patch: print
  error if kexec_file_load fails (bsc#1197176).

==== keylime ====
Version update (6.3.1 -> 6.3.2)
Subpackages: keylime-agent keylime-config keylime-firewalld keylime-registrar keylime-tpm_cert_store keylime-verifier python38-keylime

- Update to version v6.3.2:
  * general: bump Keylime version to 6.3.2
  * tpm_main: flush transient objects
  * pypi: add notice that the Python API is unstable
  * installer: use OpenSSL by default
  * Avoid mounting secdir while unmounting it
  * remove TPM, VTPM and IMA stubbing support
  * archive: remove all archive files
  * Change GH reviewers to be from developer group
  * added suse / opensuse support with zypper
  * Fix tpm import in test_tpm.py
  * Fix cfssl configuration in run_tests.sh
  * tpm_emulator: improve TPM emulator installation
  * config: Add option to enable DB debugging via DEBUG_DB env var
  * Enable SQL query cache for JSONPickleType
  * tpm_emulator: move everything into systemd services
  * Implement broader key support for Keylime's signing mechanisms
  * tenant: Use exponential backoff on key verification retries
  * tenant: Move JSON parsing to capture possible exceptions
  * tenant: Move verifier stop from do_quote to do_verify
  * pylint: Fix issues related to W0602 global-variable-not-assigned
  * tenant: Handle 404 error from registrar gracefully
  * pylint: Fix remaining code with issue R1732 consider-using-with
  * pylint: Fix R1732 consider-using-with
  * pylint: Fix issue detected by pylint-2.13.0
  * pylint: Fix issue detected by pylint-2.13.0
  * tenant: verify agent quote before adding to verifier
  * README: remove tpm2-abrmd and OSX sections
  * pylint: Fix issues related to W0102 dangerous-default-value
  * pylint: Fix R0201 no-self-use
  * pylint: remove W1203 logging-format-interpolation from ignore list
  * pylint: remove R1729 use-a-generator from ignore list
  * pylint: remove E1120 no-value-for-parameter from ignore list
  * pylint: remove W1201 logging-not-lazy from ignore list
  * pylint: fix C0209 consider-using-f-string
  * pylint: fix C0201 consider-iterating-dictionary
  * pylint: fix W1509 subprocess-popen-preexec-fn
  * keylime_tenant non-zero exit code on error
  * Fix prepare step adjustments in packit-ci.fmf plan
  * failure: fix Pattern type hint
  * mypy: add initial Mypy configuration
  * ima_ast: add type hints
  * failure: add type hints
  * logging, config: add type hints for logging module
  * algorithms: add type hints
  * json: add type hints and add JSONType as custom type
  * Full allowlist processing when not adding host
  * provider, vTPM: remove vTPM manager and provider code
  * tpm: fix that the set of missing PCRs is not serializable in failure
  * Restores the option to use keylime agents without mTLS
  * services: make the services run as keylime user instead of root
  * State in --help that SHA-256 is used for --allowlist-checksum
  * config: change cacert.pem to cacert.crt
  * registrar_client: validate connections against registrar ca certificate
  * tenant: validate connections against verifier ca certificate
  * request_client: only add custom adapter if TLS is enabled
  * setup: add static assets for webapp
  * Add TESTING.md describing testing details
  * Fix some remaining log format strings
  * Fix for database_url parameter with sqlite
  * Enable test basic-attestation-with-unpriviledged-agent in Packit CI
  * Use lazy string formatting when logging (#535)
  * Make Packit CI plan more resource-saving
  * keylime.conf: Document setting ownership in WORK_DIR (/var/lib/keylime)
  * agent: Make sure tmpfs is empty even if not mounted or cannot unmount
  * agent: Drop privileges by switching to normal user and group
  * agent: Move mounting of tmpfs towards beginning of main()
  * agent: Read measured boot log near process start
  * agent: Open file for IMA log file near process start
  * ima: Refactor read_measurement_list() to take file as argument
  * Add the policy name to failure event
  * tpm_main: Check if tpm_cert_store exists (#553)
  * Remove tag input from container build workflow
  * Push container images to quay.io/keylime org
  * Enable code coverage measurement for e2e tests in Packit CI
  * config: fix config search order
  * Add defaults for ephemeral keys for agent records
  * Update outdated greetings Github messages
  * services: add keylime_agent_secure.mount service
  * installer.sh: updated tpm2-{tools, tss}, use system packages if possible
  * revocation_notifier: convert the data to str in the notifiers
  * revocation_notifier: mark webhook threads as daemon and add timeout
  * Fix Packit CI test plan Summary
  * Enable Packit CI testing on CentOS Stream 8
  * Enable Packit CI testing on Fedora Rawhide
  * Remove last trace of TPM 1.2 (hopefully)
  * verifier: remove start_tornado() function
  * verifier: wait for connections to be closed before stopping ioloop
  * revocation_notifier: kill ZeroMQ broker if it blocks more than 5s
  * Add more e2e tests to Packit CI
  * Enable EPEL repo on CentOS Stream in packit.yaml
- Drop already merged patches
  * drop_privileges_of_agent_process_after_startup.patch
  * config_fix_config_search_order.patch
  * services_add_keylime_agent_secure_mount_service.patch

==== libapparmor ====

- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);
- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).

==== libusb-1_0 ====
Version update (1.0.25 -> 1.0.26)

- Update to version 1.0.26
  * Fix regression with transfer free's after closing device
  * Fix regression with destroyed context if API is misused
  * Workaround for applications using missing default context
  * Fix hotplog enumeration regression
  * Build fixes for various platforms and configurations
  * Add interface bound checking for broken devices
  * Add umockdev tests on Linux

==== patterns-microos ====
Subpackages: patterns-microos-alt_onlyDVD patterns-microos-apparmor patterns-microos-base patterns-microos-base-microdnf patterns-microos-base-packagekit patterns-microos-base-zypper patterns-microos-basesystem patterns-microos-cloud patterns-microos-cockpit patterns-microos-defaults patterns-microos-hardware patterns-microos-ima_evm patterns-microos-onlyDVD patterns-microos-ra_agent patterns-microos-ra_verifier patterns-microos-selinux patterns-microos-sssd_ldap

- Revert "Remove requirement of pattern-bootloader". Containers
  should not be using pattern-microos-base. MicroOS needs pattern
  for having a branded bootloader
- Ensure bluez-auto-enable-devices is required for GNOME desktop
  (glgo#GNOME/gnome-bluetooth#110).

==== socat ====

- Use autosetup
- Add socat-fix-asan-error.patch that is offered to upstream
  and that fixes an ASAN error seen for 'test 313 NESTEDOVFL'.

==== vim ====
Version update (8.2.4602 -> 8.2.4745)
Subpackages: vim-data-common vim-small

- Updated to version 8.2.4745, fixes the following problems
  * Vim9: not enough test coverage for executing :def function.
  * Sourcing buffer lines is too complicated.
  * Error for redefining a script item may be confusing.
  * Error for arguments of remote_expr() even when the +clientserver feature
  is not included.
  * Test fails because of changed error message.
  * Sourcing buffer lines may lead to errors for conflicts.
  * getcompletion() does not work properly when 'wildoptions contains "fuzzy".
  * :unhide does not check for failing to close a window.
  * Some conditions are always true.
  * Typos in tests; one lua line not covered by test.
  * Vim9: cannot use a recursive call in a nested function. (Sergey Vlasov)
  * Return type of swapfile_unchanged() is wrong.
  * Redrawing too much when 'cursorline' is set and jumping around.
  * Mapping with escaped bar does not work in :def function. (Sergey Vlasov)
  * Vim9: Declarations in a {} block of a user command do not use Vim9 rules
  if defined in a legacy script. (Yegappan Lakshmanan)
  * No completion for :scriptnames.
  * Command line completion does not recognize single letter commands.
  * Mapping is cancelled when mouse moves and popup is visible.
  * Two letter substitute commands don't work. (Yegappan Lakshmanan)
  * Crash when using the tabline right-click menu.
  * Vim9: Crash with :execute and :finish. (Sergey Vlasov)
  * Coverity warns for using uninitialized field.
  * Old Coverity warning for resource leak.
  * Old Coverity warning for resource leak.
  * Visual area not fully updated when removing sign in Visual mode while
  scrolling.
  * flatten() does not use maxdepth correctly.
  * Not enough testing for 2/3 letter substitute commands.
  * flattennew() makes a deep copy unnecessarily.
  * 'cursorline' not always updated with 'cursorlineopt' is "screenline".
  * Crash when switching window in BufWipeout autocommand.
  * Using freed memory in flatten().
  * Visual range does not work before command modifiers.
  * Vim9: cannot initialize a variable to null_list.
  * Tests using null list or dict fail.
  * Not using Visual range.
  * Warning for using uninitialized variable. (Tony Mechelynck)
  * Superfluous check if a redraw is needed for 'cursorline'.
  * Not sufficient parenthesis in preprocessor macros.
  * Some boolean options use "long" instead of "int".
  * May mark the wrong window for redrawing.
  * Vim9: in :def function script var cannot be null.
  * Vim9: variable may be locked unintentionally.
  * Redrawing too often when 'relativenumber' is set.
  * 'shortmess' changed when session does not store options.
  * Using buffer line after it has been freed in old regexp engine.
  * "source" can read past end of copied line.
  * Handling LSP messages is a bit slow.
  * Various formatting problems.
  * "import autoload" only works with using 'runtimepath'.
  * Test fails because path differs.
  * Leaking memory if assignment fails.
  * "import autoload" does not check the file name.
  * Missing changes for import check.
  * Command line completion popup menu positioned wrong when using a terminal
  window.
  * Vim9: can't use items from "import autoload" with autoload directory name.
  * Errors for functions are sometimes hard to read.
  * Org-mode files are not recognized.
  * Invalid memory access when using printable function name.
  * Cursorcolumn is sometimes not correct.
  * Coverity warning for using uninitialized variable.
  * No error for using out of range list index.
  * Occasional crash when running the GUI tests.
  * Elvish files are not recognized.
  * Popup with "minwidth" and scrollbar not updated properly.
  * Vim9: assignment not recognized in skipped block.
  * expandcmd() fails on an error.
  * Buffer allocation failures insufficiently tested.
  * In compiled code len('string') is not inlined.
  * Memory allocation failures for new tab page not tested.
  * 'wildignorecase' is sometimes not used for glob().
  * Using :normal with Ex mode may make :substitute hang.
  * Redrawing a vertically split window is slow when using CTRL-F and CTRL-B.
  * Cannot force getting MouseMove events.
  * No error for missing expression after :elseif. (Ernie Rael)
  * Test fails with different error.
  * Vim9: not all code is tested.
  * Cannot have expandcmd() give an error message for mistakes.
  * Build failure without +postscript.
  * Build fails with a combination of features.
  * Vim9: can use :unlockvar for const variable. (Ernie Rael)
  * Verbose check with dict_find() to see if a key is present.
  * Cannot open a channel on a Unix domain socket.
  * When a swap file is found for a popup there is no dialog and the buffer
  is loaded anyway.
  * Configure doesn't find the Motif library with Cygwin.
  * "vimgrep /\%v/ *" may cause a crash.
  * New regexp engine does not give an error for "\%v".
  * Using <Cmd> in a mapping does not work for mouse keys in Insert
  mode. (Sergey Vlasov)
  * Channel tests fail on MS-Windows.
  * Solution for <Cmd> in a mapping causes trouble.
  * No test for what 8.2.4691 fixes.
  * new regexp does not accept pattern "\%>0v".
  * Avoidance of #elif causes more preproc nesting.
  * JSON encoding could be faster.
  * delete() with "rf" argument does not report a failure.
  * Vim9: crash when adding a duplicate key to a dictionary.
  * Vim9: script variable has no flag that it was set.
  * Hard to reproduce hang when reading from a channel.
  * Buffer remains active if a WinClosed event throws an exception.
  * Kuka Robot Language files not recognized.
  * C++ scope labels are hard-coded.
  * Memory leak in handling 'cinscopedecls'.
  * Using "else" after return or break increases indent.
  * Jump list marker disappears.
  * Buffer remains active if a WinClosed event throws an exception when
  there are multiple tabpages.
  * Redrawing could be a bit more efficient.
  * PHP test files are not recognized.
  * After :redraw the statusline highlight might be used.
  * Smart indenting does not work after completion.
  * When 'insermode' is set :edit from <Cmd> mapping misbehaves.
  * Only get profiling information after exiting.
  * Plugins cannot track text scrolling.
  * Using g:filetype_dat and g:filetype_src not tested.
  * Vagrantfile not recognized.
  * Memory allocation failure not tested when defining a function.
  * For TextYankPost v:event does not contain information about the operation
  being inclusive or not.
  * @@@ in the last line sometimes drawn in the wrong place.
  * ">" marker sometimes not displayed in the jumplist.
  * ABB Rapid files are not recognized properly.
  * Cooklang files are not recognized.
  * When a recording is ended with a mapped key that key is also recorded.
  * The ModeChanged autocmd event is inefficient.
  * Current instance of last search pattern not easily spotted.
  * Unused variable in tiny build.
  * Cannot use expand() to get the script name.
  * Unused code.
  * No test that v:event cannot be modified.
  * HEEx and Surface templates do not need a separate filetype.
  * The changelist index is not remembered per buffer.
  * Duplicate code to free fuzzy matches.
  * HEEx and Surface do need a separate filetype.
  * getcharpos() may change a mark position.
  * Quickfix tests can be a bit hard to read.
  * Build problem for Cygwin with Motif.
  * // in JavaScript string recognized as comment.
  * Esc on commandline executes command instead of abandoning it.
  * Accessing freed memory after WinScrolled autocmd event.
  * When expand() fails there is no error message.
  * Startup test fails.
  * There is no way to start logging very early in startup.
  * A terminal window can't use the bell.
  * Using wrong flag for using bell in the terminal.

==== wicked ====
Version update (0.6.68 -> 0.6.69)
Subpackages: wicked-service

- version 0.6.69
- redfish: decode smbios and setup host interface
  Add initial support to decode the SMBIOS Management Controller Host
  Interface (Type 42) structure and expose it as wicked `firmware:redfish`
  configuration to setup a Host Network Interface (to the BMC) using the
  `Redfish over IP` protocol allowing access to the Redfish Service (via
  redfish-localhost in /etc/hosts) used to manage the computer system.
  Tech Preview (jsc#SLE-17762).
- buffer: fix size_t length downcast to uint, add guards to init functions
- wireless: fix to not expect colons in 64byte long wpa-psk hex hash string
- xml-schema: reference counting fix to not crash at exit on schema errors
- compat-suse: match sysctl.d /etc vs. /run read order with systemd-sysctl,
  remove obsolete (sle11/sysconfig) lines about ifup-sysctl from ifsysctl.5.
- compat-suse: fix reading of sysctl addr_gen_mode to wrong variable
- auto6: fix to apply DNS from RA rdnss after ifdown/ifup (bsc#1181429)
- removed obsolete patch included in the master sources (bsc#1194392)
  [- 0001-fsm-fix-device-rename-via-yast-bsc-1194392.patch]

==== xen ====
Version update (4.16.0_08 -> 4.16.1_02)

- Update to Xen 4.16.1 bug fix release (bsc#1027519)
  xen-4.16.1-testing-src.tar.bz2
- Drop patches contained in new tarball
  61b31d5c-x86-restrict-all-but-self-IPI.patch
  61b88e78-x86-CPUID-TSXLDTRK-definition.patch
  61bc429f-revert-hvmloader-PA-range-should-be-UC.patch
  61d5687a-x86-spec-ctrl-opt_srb_lock-default.patch
  61d6ea2d-VT-d-split-domid-map-cleanup-check-into-a-function.patch
  61d6ea7b-VT-d-dont-leak-domid-mapping-on-error-path.patch
  61e0296a-x86-time-calibration-relative-counts.patch
  61e029c8-x86-time-TSC-freq-calibration-accuracy.patch
  61e02a1c-libxl-PCI-PV-hotplug-stubdom-coldplug.patch
  61e98e88-x86-introduce-get-set-reg-infra.patch
  61e98e89-x86-MSR-split-SPEC_CTRL-handling.patch
  61e98e8a-x86-spec-ctrl-drop-ENTRY-EXIT-HVM.patch
  61e98e8b-VT-x-SPEC_CTRL-NMI-race-condition.patch
  61eaaa23-x86-get-set-reg-infra-build.patch
  61efec1d-Arm-P2M-always-clear-entry-on-mapping-removal.patch
  61efec4d-gnttab-only-decrement-refcounter-on-final-unmap.patch
  61efec96-IOMMU-x86-stop-pirq-iteration-immediately-on-error.patch
  61f2d886-x86-CPUID-disentangle-new-leaves-logic.patch
  61f2d887-x86-CPUID-leaf-7-1-EBX-infra.patch
  61f2dd76-x86-SPEC_CTRL-migration-compatibility.patch
  61f7b2af-libxl-dont-touch-nr_vcpus_out-if-listing.patch
  61f933a4-x86-cpuid-advertise-SSB_NO.patch
  61f933a5-x86-drop-use_spec_ctrl-boolean.patch
  61f933a6-x86-new-has_spec_ctrl-boolean.patch
  61f933a7-x86-dont-use-spec_ctrl-enter-exit-for-S3.patch
  61f933a8-x86-SPEC_CTRL-record-last-write.patch
  61f933a9-x86-SPEC_CTRL-use-common-logic-for-AMD.patch
  61f933aa-SVM-SPEC_CTRL-entry-exit-logic.patch
  61f933ab-x86-AMD-SPEC_CTRL-infra.patch
  61f933ac-SVM-enable-MSR_SPEC_CTRL-for-guests.patch
  61f946a2-VMX-drop-SPEC_CTRL-load-on-VMEntry.patch
  6202afa3-x86-clean-up-MSR_MCU_OPT_CTRL-handling.patch
  6202afa4-x86-TSX-move-has_rtm_always_abort.patch
  6202afa5-x86-TSX-cope-with-deprecation-on-WHL-R-CFL-R.patch
  6202afa7-x86-CPUID-leaf-7-2-EDX-infra.patch
  6202afa8-x86-Intel-PSFD-for-guests.patch
  62278667-Arm-introduce-new-processors.patch
  62278668-Arm-move-errata-CSV2-check-earlier.patch
  62278669-Arm-add-ECBHB-and-CLEARBHB-ID-fields.patch
  6227866a-Arm-Spectre-BHB-handling.patch
  6227866b-Arm-allow-SMCCC_ARCH_WORKAROUND_3-use.patch
  6227866c-x86-AMD-cease-using-thunk-lfence.patch
  6229ba46-VT-d-drop-undue-address-of-from-check_cleanup_domid_map.patch
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch
  xsa397.patch
  xsa399.patch
  xsa400-01.patch
  xsa400-02.patch
  xsa400-03.patch
  xsa400-04.patch
  xsa400-05.patch
  xsa400-06.patch
  xsa400-07.patch
  xsa400-08.patch
  xsa400-09.patch
  xsa400-10.patch
  xsa400-11.patch
  xsa400-12.patch
- bsc#1197426 - VUL-0: CVE-2022-26358,CVE-2022-26359,
  CVE-2022-26360,CVE-2022-26361: xen: IOMMU: RMRR (VT-d) and unity
  map (AMD-Vi) handling issues (XSA-400)
  624ebcef-VT-d-dont-needlessly-look-up-DID.patch
  624ebd3b-VT-d-avoid-NULL-deref-on-dcmo-error-paths.patch
  624ebd74-VT-d-avoid-infinite-recursion-on-dcmo-error-path.patch

==== zchunk ====
Version update (1.1.16 -> 1.2.1)

- Update to version 1.2.1
  * Better error detection
  * Add support for specifying compression-format in zck
  * zck: add option to select chunk hash
  * Fix testsuite: Add expected sha256sums for zstd 1.5.1+
  * Fix memory leaks
  * Various bug fixes
- Drop upstream merged zstd-1.5.1.patch

New Kubic snapshot 20220415 released!

Richard Brown