New MicroOS snapshot 20221210 released!

Please note that this mail was generated by a script. The described changes are computed based on the x86_64 DVD. The full online repo contains too many changes to be listed here. Please check the known defects of this snapshot before upgrading: https://openqa.opensuse.org/tests/overview?distri=microos&groupid=1&version=Tumbleweed&build=20221210 https://bugzilla.opensuse.org/buglist.cgi?product=openSUSE%20Tumbleweed&component=MicroOS&query_format=advanced&resolution=--- Please do not reply to this email to report issues, rather file a bug on bugzilla.opensuse.org. For more information on filing bugs please see https://en.opensuse.org/openSUSE:Submitting_bug_reports Packages changed: cups kernel-source (6.0.10 -> 6.0.12) libpaper (2.0.3 -> 2.0.4) pam pam-full-src python-psutil python-pycairo (1.22.0 -> 1.23.0) python-pycares systemd (252.2 -> 252.3) tpm2.0-abrmd (2.4.1 -> 3.0.0) tpm2.0-tools (5.2 -> 5.4) vim (9.0.0978 -> 9.0.1040) wavpack (5.5.0 -> 5.6.0) xen (4.16.2_04 -> 4.17.0_02) xorg-x11-fonts xorg-x11-fonts-converted yast2-kdump (4.5.6 -> 4.5.7) === Details === ==== cups ==== Subpackages: cups-client cups-config libcups2 libcupsimage2 - Migration PAM settings to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. ==== kernel-source ==== Version update (6.0.10 -> 6.0.12) - Linux 6.0.12 (bsc#1012628). - btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit() (bsc#1012628). - drm/amdgpu: move setting the job resources (bsc#1012628). - drm/amdgpu: cleanup error handling in amdgpu_cs_parser_bos (bsc#1012628). - drm/amdgpu: fix userptr HMM range handling v2 (bsc#1012628). - drm/amd/pm: add smu_v13_0_10 driver if version (bsc#1012628). - drm/amd/pm: update driver-if header for smu_v13_0_10 (bsc#1012628). - drm/amd/pm: update driver if header for smu_13_0_7 (bsc#1012628). - clk: samsung: exynos7885: Correct "div4" clock parents (bsc#1012628). - clk: qcom: gdsc: add missing error handling (bsc#1012628). - clk: qcom: gdsc: Remove direct runtime PM calls (bsc#1012628). - iio: health: afe4403: Fix oob read in afe4403_read_raw (bsc#1012628). - iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw (bsc#1012628). - iio: light: rpr0521: add missing Kconfig dependencies (bsc#1012628). - libbpf: Use correct return pointer in attach_raw_tp (bsc#1012628). - bpf, perf: Use subprog name when reporting subprog ksymbol (bsc#1012628). - scripts/faddr2line: Fix regression in name resolution on ppc64le (bsc#1012628). - ARM: at91: rm9200: fix usb device clock id (bsc#1012628). - libbpf: Handle size overflow for ringbuf mmap (bsc#1012628). - hwmon: (ltc2947) fix temperature scaling (bsc#1012628). - hwmon: (ina3221) Fix shunt sum critical calculation (bsc#1012628). - hwmon: (i5500_temp) fix missing pci_disable_device() (bsc#1012628). - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (bsc#1012628). - clocksource/drivers/arm_arch_timer: Fix XGene-1 TVAL register math error (bsc#1012628). - bpf: Do not copy spin lock field from user in bpf_selem_alloc (bsc#1012628). - nvmem: rmem: Fix return value check in rmem_read() (bsc#1012628). - of: property: decrement node refcount in of_fwnode_get_reference_args() (bsc#1012628). - clk: qcom: gcc-sc8280xp: add cxo as parent for three ufs ref clks (bsc#1012628). - ixgbevf: Fix resource leak in ixgbevf_init_module() (bsc#1012628). - i40e: Fix error handling in i40e_init_module() (bsc#1012628). - fm10k: Fix error handling in fm10k_init_module() (bsc#1012628). - iavf: Fix error handling in iavf_init_module() (bsc#1012628). - e100: Fix possible use after free in e100_xmit_prepare (bsc#1012628). - net/mlx5: DR, Fix uninitialized var warning (bsc#1012628). - net/mlx5: E-switch, Destroy legacy fdb table when needed (bsc#1012628). - net/mlx5: E-switch, Fix duplicate lag creation (bsc#1012628). - net/mlx5: Fix uninitialized variable bug in outlen_write() (bsc#1012628). - net/mlx5e: Fix use-after-free when reverting termination table (bsc#1012628). - can: sja1000_isa: sja1000_isa_probe(): add missing free_sja1000dev() (bsc#1012628). - can: cc770: cc770_isa_probe(): add missing free_cc770dev() (bsc#1012628). - can: etas_es58x: es58x_init_netdev(): free netdev when register_candev() (bsc#1012628). - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods (bsc#1012628). - can: m_can: Add check for devm_clk_get (bsc#1012628). - vfs: fix copy_file_range() averts filesystem freeze protection (bsc#1012628). - qlcnic: fix sleep-in-atomic-context bugs caused by msleep (bsc#1012628). - aquantia: Do not purge addresses when setting the number of rings (bsc#1012628). - wifi: cfg80211: fix buffer overflow in elem comparison (bsc#1012628). - wifi: cfg80211: don't allow multi-BSSID in S1G (bsc#1012628). - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration (bsc#1012628). - net: phy: fix null-ptr-deref while probe() failed (bsc#1012628). - net: ethernet: ti: am65-cpsw: fix error handling in am65_cpsw_nuss_probe() (bsc#1012628). - net: net_netdev: Fix error handling in ntb_netdev_init_module() (bsc#1012628). - net/9p: Fix a potential socket leak in p9_socket_open (bsc#1012628). - net: ethernet: nixge: fix NULL dereference (bsc#1012628). - net: wwan: iosm: fix kernel test robot reported error (bsc#1012628). - net: wwan: iosm: fix dma_alloc_coherent incompatible pointer type (bsc#1012628). - net: wwan: iosm: fix crash in peek throughput test (bsc#1012628). - net: wwan: iosm: fix incorrect skb length (bsc#1012628). - dsa: lan9303: Correct stat name (bsc#1012628). - mptcp: don't orphan ssk in mptcp_close() (bsc#1012628). ... changelog too long, skipping 606 lines ... - commit e554413 ==== libpaper ==== Version update (2.0.3 -> 2.0.4) Subpackages: libpaper-tools libpaper2 - update to 2.0.4: * don't hardcode make binary name in tests ==== pam ==== Subpackages: pam_unix - pam_pwhistory-docu.patch, docbook5.patch: convert docu to docbook5 - pam-git.diff: update to current git - obsoletes pam-hostnames-in-access_conf.patch - obsoletes tst-pam_env-retval.c - pam_env_econf.patch refresh ==== pam-full-src ==== - pam_pwhistory-docu.patch, docbook5.patch: convert docu to docbook5 - pam-git.diff: update to current git - obsoletes pam-hostnames-in-access_conf.patch - obsoletes tst-pam_env-retval.c - pam_env_econf.patch refresh ==== python-psutil ==== - Require unittest2 only for python2: make this suitable for the 15.4_py39 target in devel:languages:python:backports. - Merge skip-obs.patch into skip_failing_tests.patch and add test_linux.py::test_cpu_affinity because it depends on the obs vm-type or worker CPU. ==== python-pycairo ==== Version update (1.22.0 -> 1.23.0) - Update to version 1.23.0 * Reminder to distro packagers: Building/installing pycairo using setup.py is deprecated, please use meson instead. * git: changed default branch from “master” to “main” * Windows: Update the cairo version included in the wheels from 1.17.2 to 1.17.6 #pr-243 * docs: Document how to look up pycairo headers without loading the module #pr-300 * tests: don’t error out if cairo wasn’t built with all features #pr-293 New APIs: * Status.DWRITE_ERROR #pr-294 * Format.RGB96F, Format.RGBA128F #pr-295 * PDFVersion.VERSION_1_6, PDFVersion.VERSION_1_7 #pr-296 * HAS_DWRITE_FONT #pr-297 * Context.set_hairline(), Context.get_hairline() #pr-298 * PDFSurface.set_custom_metadata() #pr-299 ==== python-pycares ==== - Add cleanup_tests.patch to make the test suite slightly more sane. - No, the test suite is just broken, and the upstream doesn't care. ==== systemd ==== Version update (252.2 -> 252.3) Subpackages: libsystemd0 libudev1 systemd-doc systemd-lang udev - Import commit bf3fef99886bd977a1c7a51d20087bc8977fff44 6372fb0cc4 btrfs-util: convert O_PATH if necessary, in btrfs quota call (bsc#1205560) 12e68eb0e5 blockdev-util: move O_PATH fd conversion into btrfs_get_block_device_fd() to shorten things bb2bafdc9d btrfs-util: convert to fd_reopen_condition() 1323232948 fd-util: add new helper fd_reopen_conditional() - Drop 6000-Revert-tmpfiles-whenever-creating-an-inode-immediate.patch It's no more needed as a fix for bsc#1205560 has been queued, see above. - Import commit 82898a14f5b0a965ba9c1efc1913fcdf29d446a8 (merge of v252.3) It includes the following fixes: 9410eb20eb cryptsetup: retry TPM2 unseal operation if it fails with TPM2_RC_PCR_CHANGED (bsc#1204944) For a complete list of changes, visit: https://github.com/openSUSE/systemd/compare/e7e931b07edd786dc6ca1dae6c23ff7b... Additionally, it also includes the following backports: - 17b2f9f196 utmp-wtmp: fix error in case isatty() fails - 8d5c487c87 sd-bus: handle -EINTR return from bus_poll() (bsc#1201982) - 2dd217c8b5 tree-wide: modernizations with RET_NERRNO() ==== tpm2.0-abrmd ==== Version update (2.4.1 -> 3.0.0) Subpackages: libtss2-tcti-tabrmd0 tpm2.0-abrmd-selinux - Version 3.0.0 + Fixed * A bug in special command processing in TPM2_GetCapability when an audit session is in use cuased tpm2-abrmd to abort. + Added * New SELinux interfaces for communication with keylime + Changed * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM, ie /dev/tpmrm0, permissions. Now users MUST be in the tss group to send to tpm2-abrmd over DBUS. - Drop dbus-access.patch (merged in PR#805) ==== tpm2.0-tools ==== Version update (5.2 -> 5.4) - Update to version 5.4 + Added: * tpm2_policyrestart: Added option --cphash to output the cpHash for the command PM2_CC_PolicyRestart. * tpm2_policynvwritten: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyNvWritten. * tpm2_policylocality: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyLocality. * tpm2_policycountertimer: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyCounterTimer. * tpm2_policycommandcode: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyCommandCode. * tpm2_policypassword: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyPassword. * tpm2_policyauthvalue: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyAuthValue. * tpm2_policyauthorize: Added option --cphash to output the cpHash for the command TPM2_CC_PolicyAuthorize. * tpm2_print: Support printing serialized ESYS_TR's * tpm2_create: Add a clarifying message to usage of -c when TPM2_CreateLoaded is not supported. * tpm2_getcap: Add support for vendor agnostic capabilites. Requires tpm2-tss version 4.0 and higher to enable. * Add a script, check_endorsement_cert.sh, to validate the endorsement certificate chain. It takes two inputs - A TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate specified in that order as arguments. - Update to version 5.3 + Features: * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to this change the tool parsed no-man as an unrecognized option and errored out. Now it lists all the available tool options. * tpm2_encodeobject: New tool to encode TPM2 object. It takes public and private portions of an object and encode them in a combined PEM form called tssprivkey used by tpm2-tss-engine and other applications. * Support alternative ECC curves for which default EK templates exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256). * tools/misc/tpm2_checkquote: add sm2 verification of signature. * crypto: support the TPM2_ECC_SM2_P256 curveID. * fapi: add new command to enable the use of fapi objects for tpm2 tools. The new command tss2_gettpm2object was added. With this command context files which can be used for tpm2 tool commands can be created. * Support for sign and verify with sm2 algorithms. * tools/tpm2_startauthsession: add sym-algorithm argument for supported symmetric algorithm. * Attestation (certify, command audit, sessionaudit and quote): add scheme argument for supported signature schemes. This also enable support for SM signing. * tpm2_flushcontext: support all options at a time. Support the - t/-l/-s options all at once so folks don't have to call it multiple times. * tools/tpm2_nvread: add human readable output for NV content Enable parsing and YAML-style output for the different NV index types. * New event types in tpm2_eventlog: EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2, EV_EFI_VARIABLE_BOOT2 * VERSION: add version file - Generate the version file with bootstrap and include in the DIST tarball so endusers can call autoreconf on a dist tarball which doesn't have git. This alleviates git describe errors on release tarballs in the autoreconf case. * import: support restricted parents - Support a restricted parent with an aes128cfb symmetric parameter. * tpm2_load - Added capability to load pem files in TSS2-Private-Key format for interoperability with tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and tpm2-pytss. * tpm2_print - Added capability to parse out and print the public portion of a TSS Private Key in the PEM format with the arg option TSSPRIVKEY_OBJ. * tpm2_loadexternal: Added support to tpm2_loadexternal for parsing and loading the public portion of a TSS2 Privkey PEM file. The path to the PEM file must be specified using the -r option while skipping the -G option for key type. * Support added for calculating cpHash, rpHash, sessions for parameter encryption and auditing in: tpm2_nvwrite, tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock, tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic. * Support added for calculating cpHash in: tpm2_clear, tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign, tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt, tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary, tpm2_quote, tpm2_policysecret, tpm2_policynv, tpm2_policyauthorizenv, tpm2_import, tpm2_hmac, tpm2_hierarchycontrol, tpm2_load, tpm2_gettime, tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest, tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen, tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext, tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread. * Support for using tcti=none for cpHash calculations to avoid invoking checks for active TPM in: tpm2_nvreadpublic, tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock, tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite. + Known issue: * FAPI tools will not work on 32bit user-static qemu on 64bit host because readdir returns NULL. Follow the issue on ... changelog too long, skipping 84 lines ... - Add echo_tcti_call_python3_binary.patch (upstreamed) ==== vim ==== Version update (9.0.0978 -> 9.0.1040) Subpackages: vim-data vim-data-common vim-small - Updated to version 9.0.1040, fixes the following problems * Build errors without the +channel feature. (John Marriott) * ch_log() text can be hard to find in the log file. * The keyboard state response may end up in a shell command. * Build error in tiny version. * 'cursorline' not drawn before virtual text below. * Stray characters displayed when starting the GUI. * GUI: remote_foreground() does not always work. (Ron Aaron) * When using kitty keyboard protocol function keys may not work. (Kovid Goyal) * Build failure with tiny version. * File missing from list of distributed files. * Using feedkeys() does not show up in a channel log. * Popupwin test is more flaky on MacOS. * Callback name argument is changed by setqflist(). * Crash when reading help index with various options set. (Marius Gedminas) * Vim9 script: get E1096 when comment follows return. * Display errors when adding or removing text property type. * Tests for empty prop type name fail. * Padding before virtual text below is highlighted when 'number' and 'nowrap' are set. * If 'keyprotocol' is empty "xterm" still uses modifyOtherKeys. * Coverity warns for dead code. * "gk" may reset skipcol when not needed. * Memory may leak. * With 'smoothscroll' skipcol may be reset unnecessarily. * Classes are not documented or implemented yet. * Command list test fails. * Tiny build fails. * Suspend test sometimes fails on MacOS. * A failed test may leave a swap file behind. * Suspend test still sometimes fails on MacOS. * There is no way to get a list of swap file names. * Test for swapfilelist() fails on MS-Windows. * Test for catch after interrupt is flaky on MS-Windows. * Stray warnings for existing swap files. * ml_get error when using screenpos(). * Tests may get stuck in buffer with swap file. * Suspend test often fails on Mac OS. * Zir files are not recognized. * Without /dev/urandom srand() seed is too predictable. * screenpos() does not count filler lines for diff mode. * 'smoothscroll' and virtual text above don't work together. (Yee Cheng Chin) * Tests call GetSwapFileList() before it is defined. * Test trips over g:name. * Suspend test fails on Mac OS when suspending Vim. * WinScrolled is not triggered when filler lines change. * type of w_last_topfill is wrong. * LGTM is soon shutting down. * Mouse shape test is flaky, especially on Mac OS. * Autoload directory missing from distribution. * Using freed memory with the cmdline popup menu. * Vim9 class is not implemented yet. * Test fails when terminal feature is missing. * Tiny build fails because of conflicting typedef. * Reporting swap file when windows are split. * Object members are not being marked as used, garbage collection may free them. * Undo misbehaves when writing from an insert mode mapping. * lalloc(0) error for a class without members. * Function name does not match what it is used for. * Using a <Cmd> mapping CmdlineChanged may be triggered twice. * Test for <Cmd> mapping with CmdlineChanged fails. ==== wavpack ==== Version update (5.5.0 -> 5.6.0) - update to 5.6.0: * added: AIFF file import/export support * added: WATCOM compiler and OS/2 support * added: cmake support for mingw, builds Cooledit + Winamp plugins * added: --force-even-byte-depth option for rounding up bit depths * fixed: detect and report PCM files having non-zero padding bits * fixed: possible crash when displaying long channel assignments * fixed: big-endian-sourced "raw" files gave big-endian "wav"s * fixed: numerous minor issues ==== xen ==== Version update (4.16.2_04 -> 4.17.0_02) - Update to Xen 4.17.0 FCS release (jsc#PED-1858) xen-4.17.0-testing-src.tar.bz2 * On x86 "vga=current" can now be used together with GrUB2's gfxpayload setting. Note that this requires use of "multiboot2" (and "module2") as the GrUB commands loading Xen. * The "gnttab" option now has a new command line sub-option for disabling the GNTTABOP_transfer functionality. * The x86 MCE command line option info is now updated. * Out-of-tree builds for the hypervisor now supported. * __ro_after_init support, for marking data as immutable after boot. * The project has officially adopted 4 directives and 24 rules of MISRA-C, added MISRA-C checker build integration, and defined how to document deviations. * IOMMU superpage support on x86, affecting PV guests as well as HVM/PVH ones when they don't share page tables with the CPU (HAP / EPT / NPT). * Support for VIRT_SSBD and MSR_SPEC_CTRL for HVM guests on AMD. * Improved TSC, CPU, and APIC clock frequency calibration on x86. * Support for Xen using x86 Control Flow Enforcement technology for its own protection. Both Shadow Stacks (ROP protection) and Indirect Branch Tracking (COP/JOP protection). * Add mwait-idle support for SPR and ADL on x86. * Extend security support for hosts to 12 TiB of memory on x86. * Add command line option to set cpuid parameters for dom0 at boot time on x86. * Improved static configuration options on Arm. * cpupools can be specified at boot using device tree on Arm. * It is possible to use PV drivers with dom0less guests, allowing statically booted dom0less guests with PV devices. * On Arm, p2m structures are now allocated out of a pool of memory set aside at domain creation. * Improved mitigations against Spectre-BHB on Arm. * Support VirtIO-MMIO devices device-tree binding creation in toolstack on Arm. * Allow setting the number of CPUs to activate at runtime from command line option on Arm. * Grant-table support on Arm was improved and hardened by implementing "simplified M2P-like approach for the xenheap pages" * Add Renesas R-Car Gen4 IPMMU-VMSA support on Arm. * Add i.MX lpuart and i.MX8QM support on Arm. * Improved toolstack build system. * Add Xue - console over USB 3 Debug Capability. * gitlab-ci automation: Fixes and improvements together with new tests. * dropped support for the (x86-only) "vesa-mtrr" and "vesa-remap" command line options - Drop patches contained in new tarball or invalid 62fde97e-tools-libxl-Replace-deprecated-soundhw-on-QEMU-command-line.patch xsa410-01.patch xsa410-02.patch xsa410-03.patch xsa410-04.patch xsa410-05.patch xsa410-06.patch xsa410-07.patch xsa410-08.patch xsa410-09.patch xsa410-10.patch xsa411.patch - bsc#1203806 - VUL-0: CVE-2022-33746: xen: P2M pool freeing may take excessively long (XSA-410) xsa410-01.patch xsa410-02.patch xsa410-03.patch xsa410-04.patch xsa410-05.patch xsa410-06.patch xsa410-07.patch xsa410-08.patch xsa410-09.patch xsa410-10.patch - bsc#1203807 - VUL-0: CVE-2022-33748: xen: lock order inversion in transitive grant copy handling (XSA-411) xsa411.patch ==== xorg-x11-fonts ==== Subpackages: xorg-x11-fonts-core xorg-x11-fonts-legacy - Do not ever use "%setup -n .": rpm 4.18 tries to be cleaner and remove stuff it extraced, which would lead to 'rm -rf .', which rm does not like. Use "%setup -c" instead, which creates the appropriate %{name}-%{version} directory expected. ==== xorg-x11-fonts-converted ==== - Do not ever use "%setup -n .": rpm 4.18 tries to be cleaner and remove stuff it extraced, which would lead to 'rm -rf .', which rm does not like. Use "%setup -c" instead, which creates the appropriate %{name}-%{version} directory expected. ==== yast2-kdump ==== Version update (4.5.6 -> 4.5.7) - Support fadump values in output of kdumptools calibrate (jsc#PED-1927) - drop support for older kdumptools - remove limits when kdumptools calibrate failed to allow user enter anything - 4.5.7