Post Syndicated from jzb original https://lwn.net/Articles/1001783/

Since we last looked
at the WordPress
dispute, WP Engine has sought
a preliminary injunction against Automattic and its founder Matt Mullenweg to
restore its access to WordPress.org, and more. The judge
in the case granted a preliminary injunction on December 10. The case
is, of course, of interest to users and developers working with
WordPress—but it may also have implications for other
open-source projects well beyond the WordPress community.

Post Syndicated from jzb original https://lwn.net/Articles/1002411/

The Sequoia PGP project has announced
version 1.0 of the sq command-line tool for managing OpenPGP
encryption and signatures. It also provides a decentralized public
key infrastructure (PKI), and key management facilities. This is
the first stable release since development began on the project in
2017.

sq‘s PKI is probably its most notable feature, and the one we invested
the most time in. The PKI is used to authenticate certificates, and
messages. Authentication is necessary to ensure that you are
encrypting to the person you think you are, and to identify who really
authored a message; without authentication, encryption and
verification are much weaker.

Post Syndicated from jzb original https://lwn.net/Articles/1002044/

The CentOS Project has announced
the general availability of CentOS Stream 10. See the release notes for information
on new features, changes, and removed software. The Extra Packages for
Enterprise Linux (EPEL) 10 repository is also available,
and will be adding minor version repositories:

For the EPEL 9 release, we started building packages about six months
before the RHEL 9 release by using CentOS Stream 9 as the initial
build environment. For EPEL 10, we’re expanding on that approach and
doing the same thing for each minor version of RHEL 10. We will have
separate DNF repositories for each minor version of RHEL 10, including
CentOS Stream 10 as the leading minor version. Packages built for one
minor version will carry forward to the next minor version. You can
find more details about this structure in our branching documentation.

LWN covered
Stream 10 and EPEL 10 on December 11.

Post Syndicated from jzb original https://lwn.net/Articles/1001930/

Version
1.32 (dubbed “Penelope”) of Kubernetes has been released with 13
major features graduating to Stable status, 12 entering Beta, and 19
entering Alpha.

If Kubernetes is Ancient Greek for “pilot”, in this release we start
from that origin and reflect on the last 10 years of Kubernetes and
our accomplishments: each release cycle is a journey, and just like
Penelope, in “The Odyssey”, weaved for 10 years — each night removing
parts of what she had done during the day — so does each release add
new features and removes others, albeit here with a much clearer
purpose of constantly improving Kubernetes.

Post Syndicated from jzb original https://lwn.net/Articles/1001909/

The Python Package Index (PyPI) Blog has an analysis
of the compromise of
the ultralytics
project, and what PyPI has learned from this event:

PyPI staff and volunteers do their best to remove malware, but
because the service is open to anyone looking to publish software
there is an unfortunately high amount of abuse. Thankfully most of
this abuse does not have the same widespread impact as a targeted
attack on an already widely-used project.

Mike Fiedler, the PyPI Safety and Security Engineer is working on
new systems for reducing the time that malware is available to be
installed on PyPI, through APIs
that security researchers can automatically send reports to and
new “quarantine”
release status to prevent harm while a human investigates the
situation. Expect more in this space in 2025!

Post Syndicated from jzb original https://lwn.net/Articles/986792/

The Red
Hat Enterprise Linux (RHEL) 10 beta was released in mid-November
and, if all goes according to plan, CentOS Stream 10
should be released before the end of the year. While nothing is etched
in stone just yet, it is a good time for anyone using or targeting
RHEL (and its clones) to start taking a look at how Stream 10,
and the corresponding EPEL
repository, is shaping up. This is not only important to RHEL and
Stream users, but anyone deploying and supporting software on
enterprise Linux (EL) derivatives like AlmaLinux, Oracle Linux,
and Rocky Linux as well.

Post Syndicated from jzb original https://lwn.net/Articles/1001732/

Greg Kroah-Hartman has released version 6.6.65 of the kernel:

This release only fixes a build regression for openrisc, and a runtime
regression for domU guests. If you don’t have problems with them, no
need to upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1001728/

Security updates have been issued by Debian (proftpd-dfsg and smarty3), Fedora (python3.14), Gentoo (Distrobox, eza, idna, libvirt, and OpenSC), Red Hat (container-tools:rhel8 and edk2), SUSE (avahi, curl, libsoup2, lxd, nodejs20, python-Django, python310-Django4, python312, squid, and webkit2gtk3), and Ubuntu (expat, intel-microcode, linux, linux-aws, linux-kvm, linux-lts-xenial, and shiro).

Post Syndicated from jzb original https://lwn.net/Articles/1001634/

Fedora Project Leader (FPL) Matthew Miller writes that he will soon be hanging up the FPL hat:

Stay tuned for a job posting from Red Hat, and details about all
that. I’m hoping we can hire someone awesome early in 2025, and make
the official handover on the release of auspiciously-numbered Fedora
Linux 42.

I’m not going to leave Fedora, though. As I said above, although it
might not always feel like it from the outside, Red Hat support for
Fedora is stronger than ever, and I plan on helping that grow even
more. I’m stepping into a full-time management role in the Community
Linux Engineering organization, so Fedora will still be part of my day
job, just in a different way.

Post Syndicated from jzb original https://lwn.net/Articles/1000941/

In July, Let’s Encrypt announced it was ending
support “as soon as possible” for the Online
Certificate Status Protocol (OCSP) in favor of Certificate
Revocation Lists (CRLs) due to privacy concerns. The organization
has now announced
that it has set a timeline, and will be turning off its OCSP
responders on August 6, 2025. There is additional action required
for Let’s Encrypt users who use the OCSP Must Staple Extension:

As of January 30, 2025, issuance requests that include the OCSP
Must Staple extension will fail, unless the requesting account has
previously issued a certificate containing the OCSP Must Staple
extension.

As of May 7, all issuance requests that include the OCSP Must
Staple extension will fail, including renewals. Please change your
ACME client configuration to not request the extension.

Post Syndicated from jzb original https://lwn.net/Articles/1000927/

System76 has announced the
fourth alpha release of its Rust-based COSMIC desktop. New features
in this version include the ability to set default applications,
region and language settings, a new Accessibility applet, as well as
support for
variable refresh rate (VRR) in the cosmic-comp compositor and the
display settings tool. See the blog post for a full list of fixes and
performance improvements. LWN covered the first alpha
release in August.

Post Syndicated from jzb original https://lwn.net/Articles/1000485/

It has long been said that naming things
is one of the hard things to do in computer science. That may be
so, but it pales in comparison to the challenge of handling
usernames properly in applications. This is especially true when multiple
applications are involved, and they are all supposed to agree on what
characters are, and are not, allowed. The Debian project is facing
that problem right now, as two user-creation utilities disagreed about
which names are allowable. A plan is in place to sort this out
before the release of Debian 13 (“trixie”) sometime next year.

Post Syndicated from jzb original https://lwn.net/Articles/1000751/

Fedora Project Leader Matthew Miller reports
that the project’s search to replace Pagure as its git forge is
almost complete, with the Fedora Council strongly in favor of Forgejo:

The Council, currently, has a clear preference for Forgejo. This is a
big decision and we don’t want it to feel rushed. Therefore, we’re
opening this up one last time to everyone’s comments. After two weeks,
we’ll take our formal vote — and then get on with the work!

LWN looked at
Forgejo in February.

Post Syndicated from jzb original https://lwn.net/Articles/1000726/

Version
6.0.0 of the Hurl command-line tool has been released. Hurl is
curl-powered utility that runs HTTP requests and tests defined in a
plain-text Hurl
file. Notable features in this release include the ability to
generate dynamic values with functions, shorter syntax, and an option
to export Hurl files to a list of curl commands. See the release
notes for a full list of changes and downloads.

Post Syndicated from jzb original https://lwn.net/Articles/1000721/

Security updates have been issued by Red Hat (go-toolset:rhel8, grafana, kernel, kernel-rt, kernel:4.18.0, pam, pam:1.5.1, pcs, postgresql:12, postgresql:15, postgresql:16, python3:3.6.8, qemu-kvm, rhc, rhc-worker-playbook, and virt:rhel and virt-devel:rhel) and SUSE (ansible-10, ansible-core, avahi, bpftool, python, python3, python36, webkit2gtk3, and xen).

Post Syndicated from jzb original https://lwn.net/Articles/999910/

Version
8 of the Ubuntu-based elementary OS has been released. This
release includes a rewritten Dock, new window-management features,
improvements in the installation and initial setup procedures for
visually impaired users, as well as a new Secure Session mode:

In the Secure Session, apps will be more restricted and will require
your consent for access to system features. When an app wants to
listen in the background for your keystrokes, take a screenshot,
record the screen, or even pick up the color from a single pixel, you
will be asked first to make sure that it’s okay. The Secure Session
also comes with other modern features like support for Mixed DPI
modes—A hotly requested feature for folks using a HiDPI notebook or
tablet with a LoDPI external display—and improved support for
multi-touch gestures on touch screens and tablets.

Post Syndicated from jzb original https://lwn.net/Articles/999897/

Security updates have been issued by Debian (mpg123 and php8.2), Fedora (libsndfile, mingw-glib2, mingw-libsoup, mingw-python3, and qbittorrent), Oracle (pam:1.5.1 and perl-App-cpanminus), Red Hat (firefox, thunderbird, and webkit2gtk3), Slackware (mozilla), SUSE (firefox, rclone, tomcat, tomcat10, and xen), and Ubuntu (gh, libsoup2.4, libsoup3, pygments, TinyGLTF, and twisted).

Post Syndicated from jzb original https://lwn.net/Articles/998778/

Arch Linux is popular as a base
for other Linux distributions; examples of Arch-derivatives include EndeavourOS, Manjaro, Parabola, and SteamOS.
There’s one small problem: the control files used to describe how to build
packages for Arch Linux have no stated license. That creates a bit of
uncertainty about the rights and responsibilities for the downstream
derivatives. So far, that doesn’t seem to have been a problem, nor has
it stopped other projects from assuming that reuse is
allowed. However, the Arch project is looking to add some clarity by
explicitly assigning a liberal license to its package
sources. Currently the project is in the process of reaching out to
contributors to see if they have any objections.

Post Syndicated from jzb original https://lwn.net/Articles/999767/

Mozilla has announced
the release of Firefox 133.0. Notable in this release is the addition
of a new anti-tracking feature, Bounce Tracking Protection, which
detects trackers based on redirect
behavior and automatically purges their cookies and site data to
thwart tracking. The release also includes various
security fixes and more.

Post Syndicated from jzb original https://lwn.net/Articles/998153/

The most common piece of advice given to users who ask about
running their own mail server is don’t. Setting up
and securing a mail server in 2024 is not for the faint of heart, nor
for anyone without copious spare time. Spammers want to flood inboxes
with ads for questionable supplements, attackers want to abuse servers
to send spam (or worse), and getting the big providers to accept mail
from small servers is a constant uphill battle. Michael W. Lucas,
however, encourages users to thumb their nose at the “Email
Empire“, and declare email independence. His self-published book,
Run Your Own Mail
Server, provides a manual (and manifesto) for users who are
interested in the challenge.