Post Syndicated from jzb original https://lwn.net/Articles/966056/

The Python project has announced three security releases, 3.10.14,
3.9.19,
and 3.8.19.
In addition to the security fixes, these releases are notable for two reasons;
they are the first to make use of GitHub Actions to perform
public builds instead of building artifacts “on a local computer of one
of the release managers“, and the first since Python became a
CVE Numbering Authority (CNA).

Python release team member Łukasz Langa said
that being a CNA means Python is able to “ensure the quality of the vulnerability
reports is high, and that the severity estimates are accurate.” It also
allows Python to coordinate CVE announcements with the patched versions of
Python, as it has with two CVEs addressed in these releases. CVE-2023-6597
describes a flaw in CPython’s zipfile module that made it vulnerable to a zip-bomb exploit. CVE-2024-0450 is an
issue with Python’s tempfile.TemporaryDirectory class which could be
exploited to modify permissions of files referenced by symbolic links.
Users of affected versions should upgrade soon.

Post Syndicated from jzb original https://lwn.net/Articles/966053/

Security updates have been issued by Debian (fontforge and imagemagick), Fedora (firefox), Mageia (cherrytree, python-django, qpdf, and sqlite3), Red Hat (bind, cups, emacs, fwupd, gmp, kernel, libreoffice, libX11, nodejs, opencryptoki, postgresql-jdbc, postgresql:10, postgresql:13, and ruby:3.1), Slackware (gnutls and mozilla), and Ubuntu (firefox, linux, linux-bluefield, linux-gcp, linux-gkeop, linux-hwe-5.4, linux-ibm,
linux-ibm-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4, linux-aws, linux-aws-5.4, linux-aws, linux-aws-6.5, and linux-oracle, linux-oracle-5.15).

Post Syndicated from jzb original https://lwn.net/Articles/965584/

Zach Mitchell has announced the 1.0 release of Flox, a tool that lets its users install packages from nixpkgs inside portable virtual environments, and share those virtual environments with others as an alternative to Docker-style containers. Flox is based on Nix but allows users to skip learning how to work with the Nix language:

With Flox we’re providing a substantially better user experience. We provide the suite of package manager functionality with install, uninstall, etc, but we also provide an entire new suite of functionality with the ability to share environments via flox push, flox pull, and flox activate --remote.

Flox is GPLv2-licensed, and releases are available as RPMs and Debian packages for x86_64 and arm64 systems.

Post Syndicated from jzb original https://lwn.net/Articles/965603/

Sasha Levin has announced the release of the 6.8.1,
6.7.10, 6.6.22,
6.1.82, 5.15.152,
5.10.213, 5.4.272,
and 4.19.310 stable kernels. As always, they contain important fixes throughout the tree. Users of those kernels should upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/965576/

Security updates have been issued by Debian (composer and node-xml2js), Fedora (baresip), Mageia (fonttools, libgit2, mplayer, open-vm-tools, and packages), Red Hat (dnsmasq, gimp:2.8, and kernel-rt), and SUSE (389-ds, gdb, kernel, python-Django, python3, python36-pip, spectre-meltdown-checker, sudo, and thunderbird).

Post Syndicated from jzb original https://lwn.net/Articles/964739/

Kaitlyn Abdo of Fedora’s AI/ML
SIG opened an issue with the
Fedora Engineering Steering Committee (FESCo) recently that carried a few tricky
questions about packaging machine-learning (ML) models for Fedora.
Specifically, the SIG is looking for guidance on whether pre-trained weights for
PyTorch constitute code or content. And, if the models are released under a
license approved by the
Open Source Initiative (OSI),
does it matter what data the models were trained on? The issue was quickly
tossed over to Fedora’s legal
mailing list and sparked an interesting discussion about how to
handle these items, and a temporary path forward.

Post Syndicated from jzb original https://lwn.net/Articles/965278/

Security updates have been issued by Fedora (edk2, freeipa, kernel, and liblas), Oracle (kernel), Red Hat (docker, edk2, kernel, kernel-rt, and kpatch-patch), SUSE (axis, fontforge, gnutls, java-1_8_0-openjdk, kernel, python3, sudo, and zabbix), and Ubuntu (dotnet7, dotnet8, libgoogle-gson-java, openssl, and ovn).

Post Syndicated from jzb original https://lwn.net/Articles/964402/

Name collisions aren’t just a problem for software
development—organizations, projects, and software that have the
same or similar names can cause serious confusion. That was certainly
the case on February 28 when the Open Collective
Foundation (OCF) began to notify its hosted projects that it would
be shutting down by the end of 2024. The announcement surprised
projects hosted with OCF, as one might expect. It also worried and
confused users of the Open Collective software platform from Open Collective, Inc. (OCI), as
well as organizations hosted by the Open Source
Collective (OSC) and Open Collective
Europe (OC Europe). There is enough confusion about the names,
relationships between the organizations, and impact on projects like
Flatpak, Homebrew, and htop hosted by OCF, that a
deeper look is warranted.

Post Syndicated from jzb original https://lwn.net/Articles/960630/

The Fedora Project switched
to MariaDB as the default implementation of MySQL in Fedora 19 in 2013. Once a drop-in
replacement for MySQL, MariaDB has diverged enough that this is no longer
the case—and, despite concerns about Oracle
and optimism that MariaDB would supplant MySQL, the reality is that MySQL
and MariaDB seem to be here to stay. With that in mind, Fedora developer
Michal Schorm
proposed that the project revise the way MySQL and MariaDB
are packaged in Fedora starting with Fedora 40.

Post Syndicated from jzb original https://lwn.net/Articles/964574/

The postmarketOS project, which produces
a Linux distribution for phones and mobile devices,
has announced
that it is in the early stages of adding systemd to make it easier to support GNOME and KDE.

Users who prefer the OpenRC
init system are assured they will still have that option when building their own
images “as long as OpenRC is in Alpine Linux (on which postmarketOS is
based)“:

As with text editors, some people are really passionate about their favorite init
systems. When discussing this announcement, please keep a friendly tone. Remember
that we all share the love for free and open source software, and that our
communities work best if we focus on shared values instead of fighting over what
implementations to use.

Proof-of-concept images
are available now for a limited set of devices. Users are warned these images are “buggy,
unreliable, and NOT suitable for use on a device you rely on“. Those interested
in helping with testing and development are encouraged to follow along and report
bugs on the systemd
issue at GitLab.

Post Syndicated from jzb original https://lwn.net/Articles/964567/

Greg Kroah-Hartman has announced another round of stable kernel updates:
6.7.9, 6.6.21,
6.1.81, 5.15.151,
5.10.212, 5.4.271,
and 4.19.309 have all been
released. Each contains a set of important fixes.

Post Syndicated from jzb original https://lwn.net/Articles/964559/

Security updates have been issued by Debian (libapache2-mod-auth-openidc, libuv1, php-phpseclib, and phpseclib), Red Hat (buildah, cups, curl, device-mapper-multipath, emacs, fence-agents, frr, fwupd, gmp, gnutls, golang, haproxy, keylime, libfastjson, libmicrohttpd, linux-firmware, mysql, openssh, rear, skopeo, sqlite, squid, systemd, and tomcat), Slackware (mozilla), SUSE (kernel-firmware-nvidia-gspx-G06, nvidia-open- driver-G06-signed, postgresql-jdbc, python, python-cryptography, rubygem-rack, wpa_supplicant, and xmlgraphics-batik), and Ubuntu (c-ares, firefox, libde265, libgit2, and ruby-image-processing).

Post Syndicated from jzb original https://lwn.net/Articles/963986/

Tails 6.0 is now available. Based on Debian, Tails is a portable operating system designed to run from a USB stick and help users avoid surveillance and censorship. This release updates most Tails applications, and includes important security and usability improvements.

One major new feature in 6.0 is to provide warnings to users about
errors when reading or
writing to persistent storage. This release now ignores USB devices plugged in while the screen is locked, and removes some file and disk-wiping features from the Files application that are “not reliable enough” on USB sticks and SSDs to continue offering to users.

Users of Tails prior to 6.0~rc1 will need to do a manual
upgrade to retain persistent storage. New users can download Tails for
USB, or as
an ISO
to create a DVD or run Tails in a virtual machine.

Post Syndicated from jzb original https://lwn.net/Articles/963851/

It’s been nearly 10 years since
KDE Plasma 5,
which is the last major release of the desktop.
On February 28 the project announced its “mega release” of KDE
Plasma 6, KDE Frameworks 6, and KDE Gear 24.02 — all based on the Qt 6 development framework. This
release focuses heavily on migrating to Wayland, and aspires to be a seamless
upgrade for the user while improving performance, security, and support
for newer hardware. For developers, a lot of work has gone into removing
deprecated frameworks and decreasing dependencies to make it easier to write
applications targeting KDE.

Post Syndicated from jzb original https://lwn.net/Articles/963957/

Security updates have been issued by Debian (knot-resolver and wpa), Fedora (chromium, kernel, thunderbird, and yarnpkg), Mageia (c-ares), Oracle (firefox, kernel, opensc, postgresql:13, postgresql:15, and thunderbird), Red Hat (edk2, gimp:2.8, and kernel), SUSE (bind, bluez, container-suseconnect, dnsdist, freerdp, gcc12, gcc7, glib2, gnutls, kernel, kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t, libqt5-qtbase, libqt5-qtsvg, nodejs18, nodejs20, openssl, openssl-1_0_0, poppler, python-crcmod, python-cryptography, python-cryptography- vectors, python-pip, python-requests, python3-requests, python311, python39, rabbitmq-c, samba, sccache, shim, SUSE Manager 4.2, SUSE Manager Server 4.2, the Linux-RT Kernel, and thunderbird), and Ubuntu (less, openssl, php7.0, php7.2, php7.4, and tiff).

Post Syndicated from jzb original https://lwn.net/Articles/963730/

Version 0.6 of Incus, a fork of LXD, has been released. This release includes a number of changes, including a new storage driver called lvmcluster, improvements for Open Virtual Network (OVN) users, improvements to migration tooling, a number of new security features, and storage bucket backup and re-import. See the release announcement for detailed release notes and complete list of changes. The announcement notes that a Long Term Support (LTS) release of Incus is planned in a few months “to coincide with the LTS releases of LXC and LXCFS“.

Post Syndicated from jzb original https://lwn.net/Articles/963725/

Security updates have been issued by Debian (gnutls28, iwd, libjwt, and thunderbird), Fedora (chromium, expat, mingw-expat, mingw-openexr, mingw-python3, mingw-qt5-qt3d, mingw-qt5-qtactiveqt, mingw-qt5-qtbase, mingw-qt5-qtcharts, mingw-qt5-qtdeclarative, mingw-qt5-qtgraphicaleffects, mingw-qt5-qtimageformats, mingw-qt5-qtlocation, mingw-qt5-qtmultimedia, mingw-qt5-qtquickcontrols, mingw-qt5-qtquickcontrols2, mingw-qt5-qtscript, mingw-qt5-qtsensors, mingw-qt5-qtserialport, mingw-qt5-qtsvg, mingw-qt5-qttools, mingw-qt5-qttranslations, mingw-qt5-qtwebchannel, mingw-qt5-qtwebsockets, mingw-qt5-qtwinextras, mingw-qt5-qtxmlpatterns, and thunderbird), Gentoo (btrbk, Glances, and GNU Aspell), Mageia (clamav and xen, qemu and libvirt), Oracle (firefox and postgresql), Red Hat (firefox, opensc, postgresql:10, postgresql:12, postgresql:13, postgresql:15, thunderbird, and unbound), SUSE (firefox, java-1_8_0-ibm, libxml2, and thunderbird), and Ubuntu (binutils, linux, linux-aws, linux-gcp, linux-hwe-6.5, linux-laptop, linux-oracle,
linux-raspi, linux-starfive, linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-gcp,
linux-gcp-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm,
linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm,
linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15,
linux-raspi, linux-azure, linux-oem-6.1, and roundcube).

Post Syndicated from jzb original https://lwn.net/Articles/963095/

The world of open-source “forges” is becoming a little more fragmented. The Forgejo project is a software-development platform that started as a “soft” fork of Gitea in late 2022. On February 16, Forgejo announced its intent to become a “hard fork” of Gitea to help address its mission of community-controlled development and to “liberate software development from the shackles of proprietary tools“. In a world where proprietary tools cast a long shadow over open-source development that’s a welcome sentiment—if the project can deliver.

Post Syndicated from jzb original https://lwn.net/Articles/962787/

Qubes OS is a security-focused desktop Linux distribution built on Fedora Linux and the Xen hypervisor. Qubes uses virtualization to run applications, system services, and devices access via virtual machines called “qubes” that have varying levels of trust and persistence to provide an open-source “reasonably secure” operating system with “serious privacy“. The Qubes 4.2.0 release, from December 2023, brings a number of refinements to make Qubes OS easier to manage and use.

Post Syndicated from jzb original https://lwn.net/Articles/962553/

The openSUSE News blog looks at the roadmap for Agama (a new installer from the YaST development team) with releases planned for April and July:

The milestone in April is set to revolutionize Agama’s architecture. It will be moving away from its reliance on Cockpit toward a more autonomous framework that is coupled with a refined user interface that aims to streamline storage configurations.

The aim of the second milestone is to improve Agama’s flexibility and capabilities for unattended installations, which seeks to position Agama as a formidable alternative to AutoYaST.

The Agama page explains why YaST is due for replacement.