Post Syndicated from jzb original https://lwn.net/Articles/972331/

In April, the Gentoo Linux project banned the use of
generative AI/ML tools due to copyright, ethical, and quality
concerns. This means contributors cannot use tools like ChatGPT or GitHub Copilot to
creating content for the distribution such as code, documentation,
bug reports, forum posts. A proposal for Debian to adopt a similar
policy revealed a distinct lack of love for those kinds of tools,
though it would also seem few contributors support
banning them outright.

Post Syndicated from jzb original https://lwn.net/Articles/972467/

The so-called software supply chain starts with source code. But most security measures and tooling
don’t kick in until source is turned into an artifact—a source
tarball, binary build, container image, or other method of delivering a
release to users. The gittuf project
is an attempt to provide a security layer for Git that can handle key management,
enforce security policies for repositories, and guard against attacks
at the version-control layer. At Open Source Summit North America (OSSNA), Aditya Sirish A
Yelgundhalli and Billy Lynch presented
an introduction to gittuf with an overview of its goals and
status.

Post Syndicated from jzb original https://lwn.net/Articles/972874/

Fedora Magazine reports
that the Fedora Asahi
Remix for Apple Arm hardware, based on Fedora
40, is now available:

Fedora Asahi Remix offers KDE Plasma 6 as our flagship desktop
experience. It also features a custom Calamares-based initial setup
wizard. A GNOME variant is also available, featuring GNOME 46, with
both desktop variants matching what Fedora Linux offers. Fedora Asahi
Remix also provides a Fedora Server variant for server workloads and
other types of headless deployments. Finally, we offer a Minimal image
for users that wish to build their own experience from the ground up.

See the installation
guide to get started with the Asahi Remix.

Post Syndicated from jzb original https://lwn.net/Articles/972861/

Security updates have been issued by Debian (glib2.0 and php7.3), Gentoo (Commons-BeanUtils, Epiphany, glibc, MariaDB, Node.js, NVIDIA Drivers, qtsvg, rsync, U-Boot tools, and ytnef), Oracle (kernel), Red Hat (git-lfs and kernel), SUSE (flatpak, less, python311, rpm, and sssd), and Ubuntu (libde265, libvirt, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp,
linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4,
linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi,
linux-raspi-5.4, linux-xilinx-zynqmp, linux, linux-azure, linux-azure-5.15, linux-azure-fde,
linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop,
linux-gkeop-5.15, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-oem-6.5, and nghttp2).

Post Syndicated from jzb original https://lwn.net/Articles/972596/

The Python Software
Foundation (PSF) has announced
its annual
impact report for 2023. The report includes updates from PSF staff
as well as summaries of the foundation’s activities, financials, and
infrastructure. The PSF celebrated the
20th anniversary of PyCon US, distributed more than $370,000 in grants, and
enjoyed impressive traffic on PyPI:

In 2023 PyPI saw a 45% growth in download counts and bandwidth alike,
serving 603,378,275 downloads for the 516,402 projects hosted there
requiring 747.4 Petabytes of data transfer, or 189.6 Gbps of bandwidth
24x7x365.

See the full report for a breakdown of grant disbursements and
trends, PSF expenses, and high-level plans for the rest of 2024.

Post Syndicated from jzb original https://lwn.net/Articles/971541/

In some aspects, such as in gaming, the Linux desktop has made
enormous strides in the past few years. In others, such as
accessibility, things have stagnated. At Open Source Summit North America (OSSNA), Matt Campbell spoke
about the need for, and an approach to, modernizing accessibility for
desktop Linux. This included a discussion of Newton, a fledgling
project that may greatly improve accessibility on the Linux desktop.

Post Syndicated from jzb original https://lwn.net/Articles/971980/

Version 8.0 of the terminal text editor GNU nano has been
released. This update includes several changes to keybindings to be
more newcomer-friendly, such as remapping Ctrl-F to forward-search and
adding an option for modern bindings:

Command-line option –modernbindings (-/) makes ^Q quit, ^X cut,
^C copy, ^V paste, ^Z undo, ^Y redo, ^O open a file, ^W write a
file, ^R replace, ^G find again, ^D find again backwards, ^A set
the mark, ^T jump to a line, ^P show the position, and ^E execute.

The release also provides access to 14 levels of gray scale in xterm (up
from four), as well as many bug fixes.

Post Syndicated from jzb original https://lwn.net/Articles/971143/

Ubuntu 24.04 LTS, code-named “Noble Numbat”, was released on April 25. This release includes GNOME 46, installer updates,
security enhancements, a lot of updated packages, and a new App Center
that puts a heavy emphasis on using Snaps to install software. It is not an ambitious release, but it brings enough to the table that it’s a worthwhile update.

Post Syndicated from jzb original https://lwn.net/Articles/972029/

Security updates have been issued by Debian (nghttp2 and qtbase-opensource-src), Mageia (cjson, freerdp, guava, krb5, libarchive, and mediawiki), Oracle (container-tools:4.0 and container-tools:ol8), Red Hat (bind, buildah, container-tools:3.0, container-tools:rhel8, expat, gnutls, golang, grafana, kernel, kernel-rt, libreswan, libvirt, linux-firmware, mod_http2, pcp, pcs, podman, python-jwcrypto, rhc-worker-script, shadow-utils, skopeo, sssd, tigervnc, unbound, and yajl), SUSE (kernel and python311), and Ubuntu (gerbv and node-json5).

Post Syndicated from jzb original https://lwn.net/Articles/970818/

When it comes to security, telling developers to do (or not do)
something can be ineffective. Helping them understand the why behind
instructions, by illustrating good and bad practices using stories, can be
much more effective. With several such stories Marta
Rybczyńska fashioned an interesting talk
about patterns and anti-patterns in embedded Linux security at the
Embedded
Open Source Summit (EOSS), co-located with Open
Source Summit North America (OSSNA), on April 16 in Seattle, Washington.

Post Syndicated from jzb original https://lwn.net/Articles/971004/

Security updates have been issued by Fedora (abseil-cpp, chromium, filezilla, libfilezilla, and xorg-x11-server-Xwayland), Oracle (firefox, gnutls, golang, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, kernel, libreswan, mod_http2, owO: thunderbird, and thunderbird), Red Hat (container-tools:rhel8, gnutls, grub2, kernel, kernel-rt, less, linux-firmware, opencryptoki, pcs, postgresql-jdbc, and thunderbird), Slackware (ruby), SUSE (kubernetes1.23, kubernetes1.24, and opensc), and Ubuntu (firefox, linux-azure, linux-lowlatency, linux-nvidia, and ruby-sanitize).

Post Syndicated from jzb original https://lwn.net/Articles/970293/

One of the mainstays of the the Linux Foundation’s Open Source Summit is the “fireside chat”
(sans fire) between Linus Torvalds and Dirk Hohndel to discuss open source and
Linux kernel topics of the day. On April 17, at Open Source Summit
North America (OSSNA) in Seattle, Washington, they held with tradition
and discussed a range of topics including proper whitespace parsing,
security, and the current AI craze.

Post Syndicated from jzb original https://lwn.net/Articles/970072/

Gentoo Council member Michał Górny posted
an RFC to the gentoo-dev mailing
list in late February about banning “‘AI’-backed (LLM/GPT/whatever)
contributions” to the Gentoo Linux project. Górny wrote that the spread of the
“AI bubble” indicated a need for Gentoo to formally take a stand on AI
tools. After a lengthy discussion, the Gentoo Council voted
unanimously this week to adopt his proposal and ban contributions generated with AI/ML tools.

Post Syndicated from jzb original https://lwn.net/Articles/969145/

Fedora 40 Beta was released
on March 26, and the final release is nearing completion. So far,
the release is coming together nicely with major
updates for GNOME, KDE Plasma, and the usual cavalcade of
smaller updates and enhancements. As part of the release, the project also scuttled Delta
RPMs and OpenSSL 1.1.

Post Syndicated from jzb original https://lwn.net/Articles/969373/

The Gentoo Linux project has announced
that it is now an Associated Project of Software in the Public Interest
(SPI), which will allow it to accept tax deductible donations in the
US and reduce its “non-technical workload“:

The current Gentoo Foundation has bylaws restricting its behavior
to that of a non-profit, is a recognized non-profit only in New
Mexico, but a for-profit entity at the US federal level. A direct
conversion to a federally recognized non-profit would be unlikely to
succeed without significant effort and cost.

[…] SPI is already now recognized at US federal level as a
full-[fledged] non-profit 501(c)(3). It also handles several projects of
similar type and size (e.g., Arch and Debian) and as such has exactly
the experience and background that Gentoo needs.

According to the announcement, the goal is to “eventually
transfer the existing assets to SPI and dissolve the Gentoo
Foundation“. How to do that is still under discussion. This will
not affect Förderverein
Gentoo e.V., which has public-benefit status in Germany and can
accept tax deductible donations in Europe.

Post Syndicated from jzb original https://lwn.net/Articles/969352/

Greg Kroah-Hartman has announced another round of stable kernel
updates: 6.8.5, 6.6.26, 6.1.85, and 5.15.154 have all been released; each
contains another set of important fixes, including the mitigations for the
recently disclosed branch history injection
hardware vulnerability.

Post Syndicated from jzb original https://lwn.net/Articles/969314/

Security updates have been issued by Debian (gtkwave), Fedora (dotnet7.0, dotnet8.0, and python-pillow), Mageia (apache, gstreamer1.0, libreoffice, perl-Data-UUID, and xen), Oracle (kernel, kernel-container, and varnish), Red Hat (edk2, kernel, rear, and unbound), SUSE (apache2-mod_jk, gnutls, less, and xfig), and Ubuntu (bind9, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4,
linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4,
linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4,
linux-raspi, linux-raspi-5.4, linux, linux-aws, linux-azure, linux-azure-6.5, linux-gcp, linux-gcp-6.5,
linux-hwe-6.5, linux-laptop, linux-lowlatency, linux-lowlatency-hwe-6.5,
linux-oem-6.5, linux-oracle, linux-oracle-6.5, linux-starfive,
linux-starfive-6.5, linux, linux-azure, linux-azure-5.15, linux-azure-fde,
linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop,
linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15,
linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15,
linux-raspi, linux-azure, and xorg-server, xwayland).

Post Syndicated from jzb original https://lwn.net/Articles/969046/

Version 4.2.0 of the Rivendell
radio automation system has been released. Changes include a new data
feed for ‘next’ data objects, improvements to its podcast system,
numerous bug fixes, and more.

Post Syndicated from jzb original https://lwn.net/Articles/969003/

Version 2.4.0 of the GNU Stow symbolic-link manager has been released.
This marks the first release for
GNU Stow since 2019. Maintainer
Adam Spires wrote:

I would like to sincerely apologise to all Stow users for this
incredibly overdue release, the cadence of which is perhaps vaguely
reminiscent of releases by the great Donald Knuth, except with none of
the grace and deliberate planning.

Spires notes that this release “makes considerable efforts to make the
internals more understandable and easy to maintain“, and has put out a
call for a co-maintainer.

Post Syndicated from jzb original https://lwn.net/Articles/968999/

Security updates have been issued by Debian (jetty9, libcaca, libgd2, tomcat9, and util-linux), Fedora (chromium, micropython, and upx), Mageia (chromium-browser-stable, dav1d, libreswan, libvirt, nodejs, texlive-20220321, and util-linux), Red Hat (less, nodejs:20, and varnish), Slackware (tigervnc), and SUSE (buildah, c-ares, cdi-apiserver-container, cdi-cloner-container, cdi- controller-container, cdi-importer-container, cdi-operator-container, cdi- uploadproxy-container, cdi-uploadserver-container, cont, curl, expat, go1.21, go1.22, guava, helm, indent, krb5, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, libcares2, libvirt, ncurses, nghttp2, podman, postfix, python-Django, python-Pillow, python310, qemu, rubygem-rack, thunderbird, ucode-intel, and xen).