Post Syndicated from jzb original https://lwn.net/Articles/998615/

The FreeBSD Foundation has announced
the release of a security
audit report conducted by security firm Synacktiv. The audit uncovered
a number of vulnerabilities:

Most of these vulnerabilities have been addressed through official FreeBSD
Project security advisories, which offer detailed information
about each vulnerability, its impact, and the measures implemented to
improve the security of FreeBSD systems. […]

The audit uncovered 27 vulnerabilities and issues within various
FreeBSD subsystems. 7 issues were not exploitable and were robustness
or code quality improvements rather than immediate security concerns.

Post Syndicated from jzb original https://lwn.net/Articles/997559/

The Fedora Project is set to welcome a second desktop edition to its
lineup after months (or years, depending when one starts the clock)
of discussions. The project recently decided to allow a new working group to
move forward with a KDE Plasma Desktop edition that will sit
alongside the existing GNOME-based Fedora Workstation
edition. This puts KDE on a more equal footing within the project,
which, it is hoped, will bring more contributors and users interested
in KDE to adopt Fedora as their Linux distribution of choice.

Post Syndicated from jzb original https://lwn.net/Articles/998215/

The Python Package Index (PyPI) has announced
that it has finalized support for PEP 740 (“Index support
for digital attestations”). Trail of Bits, which performed
much of the development work for the implementation, has an in-depth
blog post about the work and its adoption, as well as what is left
undone:

One thing is notably missing from all of this work:
downstream verification. […]

This isn’t an acceptable end state (cryptographic attestations have
defensive properties only insofar as they’re actually
verified), so we’re looking into ways to bring
verification to individual installing clients. In particular, we’re
currently working on a plugin architecture
for pip that will enable users to load
verification logic directly into their pip install
flows.

Post Syndicated from jzb original https://lwn.net/Articles/998044/

Security updates have been issued by AlmaLinux (expat), Fedora (chromium and golang-github-nvidia-container-toolkit), Mageia (curl, expat, mpg123, networkmanager-libreswan, openssl, php-tcpdf, qbittorrent, and x11-server, x11-server-xwayland, and tigervnc), Red Hat (kernel and libsoup), Slackware (mozilla), SUSE (firefox, kernel, python-PyPDF2, and xen), and Ubuntu (dotnet9, ghostscript, linux-aws, linux-oem-6.8, and pydantic).

Post Syndicated from jzb original https://lwn.net/Articles/997927/

Garrett LeSage has written an in-depth article
for Fedora Magazine about a new web-based user interface (UI) for Fedora’s
Anaconda
installer, planned to ship with Fedora 42. The article looks at
the rationale for moving from GTK 3 to a web-based UI, provides a
number of screenshots and demo screencasts, as well as instructions on
trying out the new installer with Fedora Rawhide.

Post Syndicated from jzb original https://lwn.net/Articles/995915/

Fedora Linux, as a rule, handles version upgrades reasonably
well. However, there are times when users may want to do a fresh
installation rather than an upgrade but preserve existing
users and data under /home. This is a scenario that the
Fedora installer, currently, does not address. Users can maintain a
separate /home partition, of course, but the installer does
not incorporate existing users into the new install—that is an
exercise left to the user to handle. One solution might be to use systemd-homed, a systemd
service for managing users and home directories. However, a discussion
proposing the use systemd-homed as part of Fedora installation
uncovered some hurdles, such as trying to blend its approach to
managing users with tools that centralize user management.

Post Syndicated from jzb original https://lwn.net/Articles/997182/

Security updates have been issued by AlmaLinux (libtiff), Debian (context, libheif, and thunderbird), Fedora (php-tcpdf, syncthing, and thunderbird), Gentoo (EditorConfig core C library, Flatpak, Neat VNC, and Ubiquiti UniFi), Oracle (bcc, bpftrace, grafana-pcp, haproxy, kernel, krb5, libtiff, python-gevent, python3.11-urllib3, python3.12-urllib3, and xmlrpc-c), Red Hat (python3.11-urllib3), SUSE (audacity, curl, govulncheck-vulndb, gradle, htmldoc, libgsf, python310, and qbittorrent), and Ubuntu (linux-aws-5.4, linux-oracle-5.4, mpg123, and python-werkzeug).

Post Syndicated from jzb original https://lwn.net/Articles/997034/

Version
2.1.0 of the LXQt
lightweight Qt desktop environment has been released. The highlight of
this release is support for multiple Wayland compositors:

Through its new component lxqt-wayland-session, LXQt 2.1.0
supports 7 Wayland sessions (with Labwc, KWin, Wayfire, Hyprland,
Sway, River and Niri), has two Wayland back-ends in
lxqt-panel (one for kwin_wayland and the other
general), and will add more later. All LXQt components that are not
limited to X11 — i.e., most components — work fine on Wayland. […]

Of course, the X11 session will be supported
indefinitely. Wayland is optional and rather experimental.

Post Syndicated from jzb original https://lwn.net/Articles/996356/

Members of the Open Source
Initiative (OSI) board sat down for a 45-minute “Ask Me Anything”
(AMA) session at All Things
Open in Raleigh, NC on October 29. Though the floor was open to
any topic the audience might want to ask of the OSI board. Many of the
questions were focused on the Open Source
AI Definition (OSAID), which was announced the day
before. The new definition has been somewhat controversial,
and the board spent a lot of time addressing concerns about it during
the session, as well as questions on open washing, and a need for more
education about open source in general.

Post Syndicated from jzb original https://lwn.net/Articles/996585/

The Rust blog has an update
on its progress on some of its project
goals. One of the project’s flagship
goals is to resolve
the biggest blockers to Linux building on stable Rust:

Finally, we have been finding an increasing number of stabilization
requests at the compiler level, and so @wesleywiser and @davidtwco
from the compiler team have started attending meetings to create a
faster response. One of the results of that collaboration is RFC #3716,
authored by Alice Ryhl, which proposes a method to manage compiler
flags that modify the target ABI. Our previous approach has been to
create distinct targets for each combination of flags, but the number
of flags needed by the kernel make that impractical. Authoring the RFC
revealed more such flags than previously recognized, including those
that modify LLVM behavior.

Post Syndicated from jzb original https://lwn.net/Articles/996337/

Timothée Ravier has written a
blog post about changes in the Fedora Atomic
Desktops for Fedora Linux 41. Some of the notable new
features for Atomic Desktops include bootloader updates enabled by
default for UEFI systems, first steps towards using bootable containers,
and more.

Post Syndicated from jzb original https://lwn.net/Articles/996332/

The Raspberry Pi project has announced
a new version of Raspberry Pi OS. It includes a number of
significant changes, the most notable of which is that the Raspberry
Pi Desktop now uses Wayland by default for all Pi models using the
labwc compositor:

For most of this year, we have been working on porting labwc to the
Raspberry Pi Desktop. This has very much been a collaborative process
with the developers of both labwc and wlroots: both have helped us
immensely with their support as we contribute features and
optimisations needed for our desktop.

This release also features Linux 6.6.51, improved touchscreen support, a new
screen configuration tool called raindrop, and more. See the
release
notes for a full list of changes.

Post Syndicated from jzb original https://lwn.net/Articles/996326/

The first stable release of the Thunderbird mail client for Android is now available:

Just over two years ago, we announced
our plans to bring Thunderbird to Android by taking K-9 Mail under
our wing. The journey took a little
longer than we had originally anticipated and there was a lot to
learn along the way, but the wait is finally over! For all of you who
have ever asked “when is Thunderbird for Android coming out?”, the
answer is – today!

It is immediately available on the Google
Play Store, via GitHub
Releases, or from the Thunderbird web site, and
it will be “coming soon” to the F-Droid repository for FOSS Android
applications. See the release
notes for detailed information about Thunderbird 8.0 for
Android.

Post Syndicated from jzb original https://lwn.net/Articles/996310/

Security updates have been issued by AlmaLinux (buildah), Debian (python-git, texlive-bin, and xorg-server), Mageia (chromium-browser-stable), Red Hat (kernel), SUSE (Botan, go1.22-openssl, go1.23-openssl, grafana, libgsf, pcp, pgadmin4, python310-pytest-html, python313, xorg-x11-server, and xwayland), and Ubuntu (nano, python-urllib3, and xorg-server, xwayland).

Post Syndicated from jzb original https://lwn.net/Articles/996214/

Fedora Linux 41 has been
released. See the “what’s new” pages for Fedora
Workstation and Fedora
KDE, to learn more about the latest in those editions. There is
also a new Fedora
Miracle Window Manager Spin that offers the Miracle tiling window manager for
Wayland.

Post Syndicated from jzb original https://lwn.net/Articles/996108/

Debian Developer Russell Coker has written
up an analysis of the remote exploit of CUPS
announced in September:

He seems to have a different experience to me of reporting bugs, I
have had plenty of success getting bugs fixed without hyping them. I
just report the bug, wait a while, and it gets fixed. […] I
was quite confident that my systems wouldn’t be at any risk.

When it was published my opinion was proven to be correct, it
turned out to be a series of CUPS bugs.

Post Syndicated from jzb original https://lwn.net/Articles/996104/

The Open Source Initiative
(OSI) has announced
the release of version
1.0 of the Open Source AI Definition:

The OSAID offers a standard by which community-led, open and public
evaluations will be conducted to validate whether or not an AI system
can be deemed Open Source AI. This first stable version of the OSAID
is the result of multiple years of research and collaboration, an
international roadshow of workshops, and a year-long co-design process
led by the Open Source Initiative (OSI).

LWN covered the
OSAID process, and final release candidate, on October 25.

Post Syndicated from jzb original https://lwn.net/Articles/995159/

The Open Source Initiative
(OSI) has been working on defining Open Source AI—that is what
constitutes an AI system that can be used, studied, modified, and
shared for any purpose—for almost two
years. Its board will
be voting on the Open Source AI Definition (OSAID) on Sunday,
October 27, with the 1.0 version slated to be published on
October 28. It is never possible to please everyone in
such an endeavor, and it would be folly to make that a goal. However,
a number of prominent figures in the open-source community have voiced
concerns that OSI is setting the bar too low with the OSAID—which
will undo decades of community work to cajole vendors into adhering to
or respecting the original Open Source
Definition (OSD).

Post Syndicated from jzb original https://lwn.net/Articles/995353/

Version
14.0 of the privacy-focused Tor browser has been released.

This is our first stable release based on Firefox
ESR 128, incorporating a year’s worth of changes shipped upstream
in Firefox. As part of this process we’ve also completed our annual
ESR transition audit, where we reviewed and addressed over 200 Bugzilla issues for changes in Firefox that
may negatively affect the privacy and security of Tor Browser
users. Our final reports from this audit are now available in the tor-browser-spec
repository on our Gitlab instance.

Post Syndicated from jzb original https://lwn.net/Articles/995337/

Jakub Kadlčík announced
on his blog that Fedora’s Copr build system will
be dropping support for building modules
(groups of RPM packages that are built, installed, and shipped
together) soon:

The Fedora Modularity project never really took off, and building
modules in Copr even less so. We’ve had only 14 builds in the last two
years. It’s not feasible to maintain the code for so few
users. Modularity has also been retired
since Fedora 39 and will die with RHEL 9.

Modularity features in Copr are now deprecated, and it will not be
possible to submit new module builds after April 2025. LWN covered some of the
problems with Fedora’s modularity initiative in 2019.