Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=kubic&groupid=1&version=Tumbleweed&build=20201104 https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&component=Kubic&query_format=advanced&resolution=--- Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: bcache-tools chrony cilium (1.7.6 -> 1.8.5) container-selinux (2.145.0 -> 2.150.0) gcc10 (10.2.1+git583 -> 10.2.1+git872) glibc haproxy ima-evm-utils (1.3.1 -> 1.3.2) installation-images-MicroOS (16.25 -> 16.26) kernel-firmware (20201005 -> 20201023) libxml2 microos-tools (2.6 -> 2.7) nfs-utils openpgm pciutils perl (5.30.3 -> 5.32.0) python-cryptography (3.0 -> 3.2.1) selinux-policy (20201016 -> 20201029) systemd-default-settings (0.2 -> 0.4) timezone (2020a -> 2020d) transactional-update (2.28 -> 2.28.2) xen (4.14.0_08 -> 4.14.0_10) zypp-plugin === Details === ==== bcache-tools ==== - Remove dependence of smartcols bcache-tools.spec, bcache-tools code doesn't need it now. (jsc#SLE-9807) - Remove 1001-udev-do-not-rely-on-DRIVER-variable.patch because we have 0013-bcache-tools-Export-CACHED_UUID-and-CACHED_LABEL.patch to provide static UUIDs. (jsc#SLE-9807) - bcache-tools: add man page bcache-status.8 (jsc#SLE-9807) 0017-bcache-tools-add-man-page-bcache-status.8.patch - bcache-tools: add bcache-status (jsc#SLE-9807) 0016-bcache-tools-add-bcache-status.patch - bcache-tools: make: permit only one cache device to be specified (jsc#SLE-9807) 0015-bcache-tools-make-permit-only-one-cache-device-to-be.patch - bcache-tools: Remove the dependency on libsmartcols (jsc#SLE-9807) 0014-bcache-tools-Remove-the-dependency-on-libsmartcols.patch - bcache-tools: Export CACHED_UUID and CACHED_LABEL (jsc#SLE-9807) 0013-bcache-tools-Export-CACHED_UUID-and-CACHED_LABEL.patch - bcache-tools: Fix potential coredump issues (jsc#SLE-9807) 0012-bcache-tools-Fix-potential-coredump-issues.patch - bcache-tools: add print_cache_set_supported_feature_sets() in lib.c (jsc#SLE-9807) 0011-bcache-tools-add-print_cache_set_supported_feature_s.patch - bcache-tools: add large_bucket incompat feature (jsc#SLE-9807) 0010-bcache-tools-add-large_bucket-incompat-feature.patch - bcache-tools: upgrade super block versions for feature sets (jsc#SLE-9807) 0009-bcache-tools-upgrade-super-block-versions-for-featur.patch - bcache-tools: define separated super block for in-memory and on-disk format (jsc#SLE-9807) 0008-bcache-tools-define-separated-super-block-for-in-mem.patch - bcache-tools: add to_cache_sb() and to_cache_sb_disk() (jsc#SLE-9807) 0007-bcache-tools-add-to_cache_sb-and-to_cache_sb_disk.patch - bcache-tools: list.h: only define offsetof() when it is undefined (jsc#SLE-9807) 0006-bcache-tools-list.h-only-define-offsetof-when-it-is-.patch - bcache-tools: bitwise.h: more swap bitwise for different CPU endians (jsc#SLE-9807) 0005-bcache-tools-bitwise.h-more-swap-bitwise-for-differe.patch - bcache-tools: add struct cache_sb_disk into bcache.h (jsc#SLE-9807) 0004-bcache-tools-add-struct-cache_sb_disk-into-bcache.h.patch - bcache-tools: convert writeback to writethrough mode for zoned backing device (jsc#SLE-9807) 0003-bcache-tools-convert-writeback-to-writethrough-mode-.patch - bcache-tools: add is_zoned_device() (jsc#SLE-9807) 0002-bcache-tools-add-is_zoned_device.patch - bcache-tools: set zoned size aligned data_offset on backing device for zoned devive (jsc#SLE-9807) 0001-bcache-tools-set-zoned-size-aligned-data_offset-on-b.patch ==== chrony ==== Subpackages: chrony-pool-openSUSE - By default we don't write log files but log to journald, so only recommend logrotate. ==== cilium ==== Version update (1.7.6 -> 1.8.5) - Update to 1.8.5 * Release notes: https://github.com/cilium/cilium/releases/tag/v1.8.5 - Remove patches which were included upstream: * 0001-option-mark-keep-bpf-templates-as-deprecated.patch * 0002-make-remove-the-need-for-go-bindata.patch * 0003-bpf-don-t-use-fixed-size-integer-types-from-stdint.h.patch * 0005-bpf-re-add-a-proper-types.h-mapper.patch * 0006-build-Avoid-using-git-if-not-in-a-git-repo.patch * 0007-option-rename-PolicyMapMaxEntries-to-PolicyMapEntrie.patch * 0008-helm-allow-to-configure-bpf-nat-global-max-using-Hel.patch * 0009-option-reduce-default-number-for-TCP-CT-and-NAT-tabl.patch * 0010-daemon-add-option-to-dynamically-size-BPF-maps-based.patch - Remove downstream patch which is not needed anymore (now it's enough to just modify the Helm chart with sed to set out images): * 0004-helm-Allow-variables-for-compatibility-with-openSUSE.patch - Add upstream patch for installing the operator binary: * 0001-operator-make-Add-install-target.patch ==== container-selinux ==== Version update (2.145.0 -> 2.150.0) - Update to version 2.150.0 - Add additional allow rules for kvm based containers using virtiofsd. ==== gcc10 ==== Version update (10.2.1+git583 -> 10.2.1+git872) Subpackages: libgcc_s1 libgomp1 libstdc++6 - Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872. - Build complete set of multilibs for arm-none target [bsc#1106014] * Fixes inadvertant mixture of ARM and Thumb instructions in linker output ==== glibc ==== Subpackages: glibc-locale glibc-locale-base - Use --enable-cet on x86_64 to instrument glibc for indirect branch tracking and shadow stack use. Enable indirect branch tracking and shadow stack in the dynamic loader. [jsc#PM-2110] [bsc#1175154] ==== haproxy ==== - apparmor profile fixes: - include abstractions that give access to the openssl config, ssl certs and ssl keys - include local configs only with "if exists" so they do not have to exist. - move local files to %ghost ==== ima-evm-utils ==== Version update (1.3.1 -> 1.3.2) Subpackages: evmctl libimaevm2 - Update to version 1.3.2 * Bugfixes: importing keys * NEW: Docker based travis distro testing * Travis bugfixes, code cleanup, software version update, and script removal * Initial travis testing - Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch (patch from this release) - Add make check + dependencies (getfattr => attr, xxd => vim) ==== installation-images-MicroOS ==== Version update (16.25 -> 16.26) - merge gh#openSUSE/installation-images#435 - don't forget .lib*.hmac files (bsc#1178208) - 16.26 ==== kernel-firmware ==== Version update (20201005 -> 20201023) Subpackages: kernel-firmware-all kernel-firmware-amdgpu kernel-firmware-ath10k kernel-firmware-atheros kernel-firmware-bluetooth kernel-firmware-bnx2 kernel-firmware-brcm kernel-firmware-chelsio kernel-firmware-dpaa2 kernel-firmware-i915 kernel-firmware-intel kernel-firmware-iwlwifi kernel-firmware-liquidio kernel-firmware-marvell kernel-firmware-media kernel-firmware-mediatek kernel-firmware-mellanox kernel-firmware-mwifiex kernel-firmware-network kernel-firmware-nfp kernel-firmware-nvidia kernel-firmware-platform kernel-firmware-prestera kernel-firmware-qlogic kernel-firmware-radeon kernel-firmware-realtek kernel-firmware-serial kernel-firmware-sound kernel-firmware-ti kernel-firmware-ueagle kernel-firmware-usb-network ucode-amd - Update to version 20201023 (git commit dae4b4cd0841): * cypress: add Cypress firmware and clm_blob files * rtl_bt: Update RTL8821C BT FW to 0xAA6C_A99E * ath10k: add SDIO firmware for QCA9377 WiFi * ice: update package file to 1.3.16.0 * mediatek: separate venc service thread * QCA : Updated firmware file for WCN3991 * iwlwifi: update and add new FWs from core56-54 release * iwlwifi: update 3168, 7265D, 8000C and 8265 firmwares * i915: Add DG1 DMC v2.02 * qcom : updated venus firmware files for v5.4 - Add _constraints to fix the build error (bsc#1178242) ==== libxml2 ==== Subpackages: libxml2-2 libxml2-tools - Make python subpackage ready for multiple python3 flavors gh#openSUSE/python-rpm-macros#66 ==== microos-tools ==== Version update (2.6 -> 2.7) - Update to version 2.7 - Add workaround if /.autorelabel is used, don't ignore it - Rename tmp.conf to microos-tmp.conf on SUSE MicroOS - Fix building on SUSE MicroOS ==== nfs-utils ==== Subpackages: libnfsidmap1 nfs-client - Update to version 2.5.2 - fixed a couple memory leaks and other bug fixes, - a lot of clean up - Refresh nfs-utils-1.0.7-bind-syntax.patch - Use %autosetup -p1 ==== openpgm ==== - Always pretend we do not have ftime(3), function is deprecated and absent from next glibc release. ==== pciutils ==== - Add decode support for RCECs - added patches https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba2... + pciutils-add-decode-support-for-RCECs.patch ==== perl ==== Version update (5.30.3 -> 5.32.0) Subpackages: perl-base - update to perl-5.32.0 * new experimental infix "isa" operator * support of unicode 13.0 * chained comparisons capability - updated patches: * perl-HiRes.t-timeout.diff * posix-sigaction.patch * perl-fix2020.patch * perl-reproducible2.patch * perl_skip_flaky_tests_powerpc.patch ==== python-cryptography ==== Version update (3.0 -> 3.2.1) - update to 3.2.1: Disable blinding on RSA public keys to address an error with some versions of OpenSSL. - update to 3.2: * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time, to protect against Bleichenbacher vulnerabilities. Due to limitations imposed by our API, we cannot completely mitigate this vulnerability. * Support for OpenSSL 1.0.2 has been removed. * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder. - update to 3.1.1: * wheels compiled with OpenSSL 1.1.1h. - update to 3.1: * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based :term:`U-label` parsing in various X.509 classes. This support was originally deprecated in version 2.1 and moved to an extra in 2.5. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by the OpenSSL project. The next version of ``cryptography`` will drop support for it. * Deprecated support for Python 3.5. This version sees very little use and will be removed in the next release. * ``backend`` arguments to functions are no longer required and the default backend will automatically be selected if no ``backend`` is provided. * Added initial support for parsing certificates from PKCS7 files with :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` . * Calling ``update`` or ``update_into`` on :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data`` longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This also resolves the same issue in :doc:`/fernet`. ==== selinux-policy ==== Version update (20201016 -> 20201029) Subpackages: selinux-policy-targeted - wicked.fc: add libexec directories - Update to version 20201029 - update container policy ==== systemd-default-settings ==== Version update (0.2 -> 0.4) Subpackages: systemd-default-settings-branding-SLE systemd-default-settings-branding-openSUSE - rpm file lists are now generated from the spec file. - Make sure the release number between the main and the branding packages match - Import 0.3 d299248 List drop-in directories in SUSE.list exclusively e4651a7 Disable memory accounting by default for all distros (jsc#PM-2229 jsc#PM-2230) ==== timezone ==== Version update (2020a -> 2020d) - Add fat.patch to generate "fat" timezone files (was default before 2020b). - Adjust timezone-java.spec.in to avoid build failures when running pre_checkin.sh - timezone update 2020d * Palestine ends DST earlier than predicted, on 2020-10-24. - timezone update 2020c * Fiji starts DST later than usual, on 2020-12-20. - timezone update 2020b (bsc#1177460) * Revised predictions for Morocco's changes starting in 2023. * Canada's Yukon changes to -07 on 2020-11-01, not 2020-03-08. * Macquarie Island has stayed in sync with Tasmania since 2011. * Casey, Antarctica is at +08 in winter and +11 in summer. * zic no longer supports -y, nor the TYPE field of Rules. - Rebased timezone-2018f-bsc1112310.patch ==== transactional-update ==== Version update (2.28 -> 2.28.2) Subpackages: transactional-update-zypp-config - Version 2.28.2 - SELinux: Exclude security.selinux attribute from rsyncing (again) - Version 2.28.1 - SELinux: Fixed changing the wrong grub configuration file - SELinux: Move /.autorelabel file to writeable location ==== xen ==== Version update (4.14.0_08 -> 4.14.0_10) - Upstream bug fixes (bsc#1027519) 5f479d9e-x86-begin-to-support-MSR_ARCH_CAPS.patch 5f4cf06e-x86-Dom0-expose-MSR_ARCH_CAPS.patch 5f4cf96a-x86-PV-fix-SEGBASE_GS_USER_SEL.patch 5f560c42-x86-PV-rewrite-segment-ctxt-switch.patch 5f5b6b7a-hypfs-fix-custom-param-writes.patch 5f607915-x86-HVM-more-consistent-IO-completion.patch 5f6cfb5b-x86-PV-dont-GP-for-SYSENTER-with-NT-set.patch 5f6cfb5b-x86-PV-dont-clobber-NT-on-return-to-guest.patch 5f71a21e-x86-S3-fix-shadow-stack-resume.patch 5f76ca65-evtchn-Flask-prealloc-for-send.patch 5f76caaf-evtchn-FIFO-use-stable-fields.patch 5f897c25-x86-traps-fix-read_registers-for-DF.patch 5f897c7b-x86-smpboot-restrict-memguard_guard_stack.patch - Renamed patches 5f560c42-x86-PV-64bit-segbase-consistency.patch Replaces 5f5b6951-x86-PV-64bit-segbase-consistency.patch 5f6a002d-x86-PV-handle-MSR_MISC_ENABLE-correctly.patch Replaces 5f6a05a0-pv-Handle-the-Intel-specific-MSR_MISC_ENABLE-correctly.patch 5f6a0049-memory-dont-skip-RCU-unlock-in-acquire_resource.patch Replaces 5f6a05b7-xen-memory-Dont-skip-the-RCU-unlock-path-in-acquire_resource.patch 5f6a0067-x86-vPT-fix-race-when-migrating-timers.patch Replaces 5f6a05dd-vpt-fix-race-when-migrating-timers-between-vCPUs.patch 5f6a008e-x86-MSI-drop-read_msi_msg.patch Replaces 5f6a05fa-msi-get-rid-of-read_msi_msg.patch 5f6a00aa-x86-MSI-X-restrict-reading-of-PBA-bases.patch Replaces 5f6a061a-MSI-X-restrict-reading-of-table-PBA-bases-from-BARs.patch 5f6a00c4-evtchn-relax-port_is_valid.patch Replaces 5f6a062c-evtchn-relax-port_is_valid.patch 5f6a00df-x86-PV-avoid-double-exception-injection.patch Replaces 5f6a065c-pv-Avoid-double-exception-injection.patch 5f6a00f4-evtchn-add-missing-barriers.patch Replaces 5f6a0674-xen-evtchn-Add-missing-barriers-when-accessing-allocating-an-event-channel.patch 5f6a0111-evtchn-x86-enforce-correct-upper-limit.patch Replaces 5f6a068e-evtchn-x86-enforce-correct-upper-limit-for-32-bit-guests.patch 5f6a013f-evtchn_reset-shouldnt-succeed-with.patch Replaces 5f6a06be-evtchn-evtchn_reset-shouldnt-succeed-with-still-open-ports.patch 5f6a0160-evtchn-IRQ-safe-per-channel-lock.patch Replaces 5f6a06e0-evtchn-convert-per-channel-lock-to-be-IRQ-safe.patch 5f6a0178-evtchn-address-races-with-evtchn_reset.patch Replaces 5f6a06f2-evtchn-address-races-with-evtchn_reset.patch 5f6a01a4-evtchn-preempt-in-evtchn_destroy.patch Replaces 5f6a071f-evtchn-arrange-for-preemption-in-evtchn_destroy.patch 5f6a01c6-evtchn-preempt-in-evtchn_reset.patch Replaces 5f6a0754-evtchn-arrange-for-preemption-in-evtchn_reset.patch - bsc#1177409 - VUL-0: xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286) xsa286-1.patch xsa286-2.patch xsa286-3.patch xsa286-4.patch xsa286-5.patch xsa286-6.patch - bsc#1177412 - VUL-0: xen: Race condition in Xen mapping code (XSA-345) 5f8ed5d3-x86-mm-map_pages_to_xen-single-exit-path.patch 5f8ed5eb-x86-mm-modify_xen_mappings-one-exit-path.patch 5f8ed603-x86-mm-prevent-races-in-mapping-updates.patch - bsc#1177413 - VUL-0: xen: undue deferral of IOMMU TLB flushes (XSA-346) 5f8ed635-IOMMU-suppress-iommu_dont_flush_iotlb-when.patch 5f8ed64c-IOMMU-hold-page-ref-until-TLB-flush.patch - bsc#1177414 - VUL-0: xen: unsafe AMD IOMMU page table updates (XSA-347) 5f8ed682-AMD-IOMMU-convert-amd_iommu_pte.patch 5f8ed69c-AMD-IOMMU-update-live-PTEs-atomically.patch 5f8ed6b0-AMD-IOMMU-suitably-order-DTE-mods.patch - Update libxc.sr.superpage.patch set errno in x86_hvm_alloc_4k (bsc#1177112) ==== zypp-plugin ==== - singlespec in Tumbleweed must support multiple python3 flavors in the future gh#openSUSE/python-rpm-macros#66 -- To unsubscribe, e-mail: opensuse-kubic+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-kubic+owner@opensuse.org