Hírolvasó

Debian's proposed tag2upload service would be worthy of an article even if it wasn't so contentious; tag2upload promises a streamlined way for Debian developers using Git to upload packages to the Debian Archive. But tag2upload has been in limbo for years due to disagreement and a communication breakdown between the team behind tag2upload and the ftpmasters team. It took the threat of a General Resolution (GR), weeks of discussion, and more than 1,000 emails to finally move forward.

The Universal Blue project, which produces operating system images based on Fedora's Atomic Desktops, has issued an announcement that manual steps are required to continue receiving updates. Jorge Castro wrote:

If you use Bazzite, Bluefin, Aurora, or any other Universal Blue image (including our toolboxes) then you need to follow the instructions in this announcement in order to ensure that your device is getting updates. We were rotating our cosign keypairs this morning, which is the method that we use to sign our images.

During this process I made a critical error which has resulted in forcing you to take manual steps to migrate to our newly signed images.

This applies to all Universal Blue images released before July 2, 2024. See the full announcement for instructions. LWN covered Bluefin in December, 2023.

In 2016, Oliver Smith reached a point of frustration with the short lifespan of updates for his Android phone. Taking matters into his own hands, he began developing postmarketOS, a Linux distribution for mobile phones. Eight years later, the core team and trusted contributors have grown to twenty individuals, while the latest release, v24.06, now shows support for over 250 devices. Although postmarketOS isn't usable as a day-to-day phone operating system on all of them, it can also enable repurposing devices into compact servers or kiosk machines.

Version 4.10.0 of GNU findutils has been released. Notable changes include allowing find -name / as a valid pattern, and accepting larger UIDs/GIDs for find -user and find -group. It is also once again possible to build findutils on systems with musl-libc.

David Rosenthal looks back at 40 years of the X Window System:

A major reason for Sun's early success was that they in effect open-sourced the Network File System. X11 was open source under the MIT license. I, and some of the other Sun engineers, understood that NeWS could not displace X11 as the Unix standard window system without being equally open source. But Sun's management looked at NeWS and saw superior technology, an extension of the PostScript that Adobe was selling, and couldn't bring themselves to give it away.

Security updates have been issued by AlmaLinux (golang and kernel), Fedora (ghostscript and openssh), Mageia (espeak-ng), Red Hat (389-ds, c-ares, container-tools, cups, fontforge, go-toolset, iperf3, less, libreoffice, libuv, linux-firmware, nghttp2, openldap, pki-core, python-idna, python-jinja2, python-pillow, python3, python3.11-PyMySQL, qemu-kvm, and xmlrpc-c), SUSE (ghostscript, git, libndp, libxml2, openssh, pgadmin4, podman, podofo, postgresql14, postgresql15, postgresql16, python39, squid, and wireshark), and Ubuntu (firefox and openvpn).

While we were busy with other things, Theo de Raadt (deraadt@) is continuing the work on bringing the clang option to clean return addresses off the stack, as reported upon earlier, to OpenBSD/arm64.

Theo posted an early version of the code to tech@, saying

List: openbsd-tech Subject: arm64 -fret-clean attempt From: "Theo de Raadt" <deraadt () openbsd ! org> Date: 2024-07-02 5:50:45 I've been trying to write -fret-clean for arm64. On a return-stack architecture like amd64, the callee has to clean up the word on the stack upon return. arm64, like some other risc architectures, is a link-register architecture. In this case, the return address is saved in some temporary location by the caller, who loads it into the link register before returning. Before that moment, the caller has to clean it up.

Read more…

Új termékkategóriával bővíti portfólióját a legfontosabb kínai dróngyártó.

Egyre magabiztosabban bővíti termékkínálatát az egykor levelezőjéről ismertté vált Proton.

Az AI technológiákat támogató energiafaló adatközpontok jelentősen nehezíthetik a keresőóriás karbonsemlegesség felé vezető útját.

Dacára a szigorúbb szabályoknak még sokat kell fejlődniük a gyártóknak, ha az eszközeik javíthatóságáról van szó.

Like many kernel subsystems, the Linux security module (LSM) subsystem makes extensive use of indirect function calls. Those calls, however, are increasingly problematic, and the pressure to remove them has been growing. The good news is that there is a patch series from KP Singh that accomplishes that goal. Its progress into the mainline has been slow — this change was first proposed by Brendan Jackman and Paul Renauld in 2020 — and this work has been caught up in some wider controversies along the way, but it should be close to being ready.

Security updates have been issued by AlmaLinux (httpd:2.4/httpd), Arch Linux (openssh), Fedora (cups, emacs, and python-urllib3), Gentoo (OpenSSH), Mageia (ffmpeg, gdb, openssl, python-idna, and python-imageio), Red Hat (golang and kernel), SUSE (booth, libreoffice, openssl-1_1-livepatches, podman, python-arcomplete, python-Fabric, python-PyGithub, python- antlr4-python3-runtime, python-avro, python-chardet, python-distro, python- docker, python-fakeredis, python-fixedint, pyth, python-Js2Py, python310, python39, and squid), and Ubuntu (cups and netplan.io).

A francia versenyhatóság körmére nézne az Nvidiának, versenyellenes gyakorlatokkal vádolja meg a céget.

Közel egy évtizeden át hagyta sebezhetően a CocoaPods-on tárolt könyvtárakat használó appokat egy fel nem fedett sérülékenység.

A díjkorrekció tavalyi bevezetése láthatóan nem érte el teljes mértékben azt az eredményt, amit a szolgáltatók vártak tőle.

A videómegosztó 48 órát ad a készítőknek arra, hogy reagáljanak az esetleges panaszokra.

While the end of support for CentOS 7, which happened on June 30, is significant, it is also worth taking a moment to reflect on the end of Scientific Linux 7, which has also just occurred. Scientific Linux was once a popular RHEL rebuild supported by Fermilab, CERN, DESY, and ETH Zurich. Development of Scientific Linux stopped with SL7, with the labs switching to CentOS thereafter, but the SL7 release was supported through to the bitter end. Thanks are due to all who built and supported Scientific Linux; you provided a useful and stable platform for many years.

On May 7, Kees Cook sent a proposal to the linux-kernel mailing list, asking for the kernel developers to start working on a way to mitigate unintentional arithmetic overflow, which has been a source of many bugs. This is not the first time Cook has made a request along these lines; he sent a related patch set in January 2024. Several core developers objected to the plan for different reasons. After receiving their feedback, Cook modified his approach to tackle the problem in a series of smaller steps.