Kadlčík: Copr Modularity, the End of an Era

Jakub Kadlčík announced
on his blog that Fedora's https://copr.fedorainfracloud.org/
 build system will
be dropping support for building https://docs.fedoraproject.org/en-US/modularity/core-concepts/module-stream/

(groups of RPM packages that are built, installed, and shipped
together) soon:

The Fedora Modularity project never really took off, and building
modules in Copr even less so. We've had only 14 builds in the last two
years. It's not feasible to maintain the code for so few
users. Modularity has also been retired
since Fedora 39 and will die with RHEL 9.

Modularity features in Copr are now deprecated, and it will not be
possible to submit new module builds after April 2025. LWN https://lwn.net/Articles/805180/
 some of the
problems with Fedora's https://docs.pagure.org/modularity/
 in 2019.

https://lwn.net/Articles/995337/


[$] Free-software foundations face fundraising problems

In July, at the GNOME https://lwn.net/Articles/983203/
 (AGM),
held at GUADEC
2024,
the message from the GNOME Foundation board was that all was well,
financially speaking. Not great, but the foundation was on a
break-even budget and expected to go into its next fiscal year with a
similar budget and headcount. On October 7, however, the board https://foundation.gnome.org/2024/10/07/update-from-the-board-2024-10/

that it had had to make some cuts, including reducing its staff by
two people. This is not, however, strictly a GNOME problem: similar
organizations, such as the Python Software Foundation (PSF), KDE e.V.,
and the Free Software Foundation Europe (FSFE) are seeing declines in
fundraising while also being affected by inflation.

https://lwn.net/Articles/993665/


Security updates for Wednesday

Security updates have been issued by Debian (dmitry, libheif, and python-sql), Fedora (suricata and wireshark), SUSE (cargo-c, libeverest, protobuf, and qemu), and Ubuntu (golang-1.22, libheif, unbound, and webkit2gtk).

https://lwn.net/Articles/995293/


Several Russian developers lose kernel maintainership status

Perhaps one of the more surprising changes in the 6.12-rc4 development
kernel was the removal
of several entries from the kernel's MAINTAINERS file.  The https://lore.kernel.org/all/2024101835-tiptop-blip-09ed@gregkh/

performing the removal was sent (by Greg Kroah-Hartman) only to the
patches@lists.linux.dev mailing list; the change was included in a char-misc drivers
pull request with no particular mention.

The explanation for the removal is simply "various compliance
requirements".  Given that the developers involved all appear to be of
Russian origin, it is not too hard to imagine what sort of compliance is
involved here.  There has, however, been no public posting of the policy
that required the removal of these entries.

https://lwn.net/Articles/995186/


[$] A report from the 2024 Image-Based Linux Summit

The Image-Based Linux Summit has by now established itself as a yearly event.
Following on from https://lwn.net/Articles/946526/
,
the third edition was held in Berlin on September 24, the
day before

All Systems Go! 2024 (ASG). The purpose of this event is to gather
stakeholders from various engineering groups and hold friendly but lively
discussions around the topic of image-based Linux — that is, Linux distributions
based around immutable images, instead of mutable root filesystems.

https://lwn.net/Articles/994704/


Introducing AlmaLinux OS Kitten (AlmaLinux Blog)

The https://almalinux.org/
 a new edition called "Kitten",
which will serve as "the direct upstream for AlmaLinux OS and is
the primary point for the AlmaLinux community to engage and influence
the future of AlmaLinux OS". Not intended for production use, the
first release is based on CentOS Stream 10 source, which
will eventually be the basis for Red Hat Enterprise Linux (RHEL)
10:

Because we anticipated many changes in 10, we wanted to get a head
start on building AlmaLinux OS 10. Earlier this year we started
setting up infrastructure and the build pipeline for AlmaLinux OS 10,
and started testing using CentOS Stream 10's code. Based on this
preparation work, we are excited to share that we have successfully
built a preview of AlmaLinux OS 10 that we are calling AlmaLinux OS
Kitten 10.

The first Kitten release previews a number of ways that AlmaLinux will
diverge from RHEL 10, including re-enabling frame pointers,
including Simple Protocol for Independent Computing Environments
(SPICE), and adding packages for Firefox and Thunderbird, which have
been dropped from CentOS Stream 10 in favor of Flatpak versions. New
installation images for Kitten will be built quarterly. See the release
notes for download links, installation instructions, and more
information.

https://lwn.net/Articles/995140/


Another five stable kernels

The
https://lwn.net/Articles/995131/
,
https://lwn.net/Articles/995132/
,
https://lwn.net/Articles/995133/
,
https://lwn.net/Articles/995134/
, and
https://lwn.net/Articles/995135/

stable kernels have all been released; each contains another set of
important fixes.

https://lwn.net/Articles/995130/


OpenSSL 3.4.0 released

Version 3.4.0 of the OpenSSL SSL/TLS library has been released.  It adds a
number of new encryption algorithms, support for "directly fetched
composite signature algorithms such as RSA-SHA2-256", and more.  See the
release notes for details.

https://lwn.net/Articles/995098/


Security updates for Tuesday

Security updates have been issued by Debian (ffmpeg, ghostscript, libsepol, openjdk-11, openjdk-17, perl, and python-sql), Oracle (389-ds-base, buildah, containernetworking-plugins, edk2, httpd, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, kernel, python-setuptools, skopeo, and webkit2gtk3), Red Hat (buildah), Slackware (openssl), SUSE (apache2, firefox, libopenssl-3-devel, podman, and python310-starlette), and Ubuntu (cups-browsed, firefox, libgsf, and linux-gke).

https://lwn.net/Articles/995095/


A new kernel testing tree

Sasha Levin has https://lwn.net/ml/all/ZxZ8MStt4e8JXeJb@sashalap
 a
new tree that is intended to perform continuous-integration tests of pull
requests aimed at the mainline.  The plan is for this tree to hold more
finished work than sometimes ends up in linux-next; in a name that seems
destined to create typographical confusion, it is called "linus-next".

	The linus-next tree aims to provide a more stable and testable
	integration point compared to linux-next, addressing the runtime
	issues that make testing linux-next challenging and focusing on
	code that's about to be pulled by Linus.

https://lwn.net/Articles/994983/


Bootc 1.1.0 released

https://github.com/containers/bootc/releases/tag/v1.1.0
 utility for
performing transactional, in-place operating system updates using https://opencontainers.org/
 (OCI)
images, has been released. This release "officially stabilizes all
APIs" for bootc and includes a number of bug fixes. LWN https://lwn.net/Articles/979182/
 in June.

https://lwn.net/Articles/994962/


[$] Python PGP proposal poses packaging puzzles

https://docs.sigstore.dev/
 is a
project that is meant to simplify and improve the process of signing,
verifying, and protecting software. It is a relatively new project, https://www.prnewswire.com/news-releases/sigstore-announces-general-availability-at-sigstorecon-301657741.html

"generally available" in 2022. Python is an early adopter of sigstore; it started providing
signatures for CPython artifacts with https://www.python.org/downloads/release/python-3110/

in 2022. This is in addition to the https://www.openpgp.org/
 signatures it has been
providing since at
least 2001. Now, Seth Michael Larson—the Python Software
Foundation (PSF) security
developer-in-residence—would like to deprecate the PGP
signature and move to sigstore exclusively by next year. If that
happens, it will involve some changes in the way that Linux
distributions verify Python releases, since none of the major
distributions have processes for working with sigstore.

https://lwn.net/Articles/993787/


Security updates for Monday

Security updates have been issued by Debian (asterisk, chromium, php-horde-mime-viewer, and php-horde-turba), Fedora (apache-commons-io, buildah, chromium, containers-common, libarchive, libdigidocpp, oath-toolkit, podman, rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4, thunderbird, and unbound), SUSE (buildah, chromedriver, chromium, element-desktop, element-web, jetty-annotations, nodejs-electron, php7, php74, php8, podman, python3-virtualbox, qemu, thunderbird, and valkey), and Ubuntu (amd64-microcode).

https://lwn.net/Articles/994941/


LWN.net (RSS Feed)

LWN.net is a comprehensive source of news and opinions from
        and about the Linux community.  This is the main LWN.net feed,
        listing all articles which are posted to the site front page.

https://lwn.net


Kernel prepatch 6.12-rc4

Linus has released https://lwn.net/Articles/994842/
 for testing.
"I'm not happy with how big this is - it's probably far from the biggest
rc4 ever, but it _is_ the biggest rc4 we've had in the 6.x series at least
in number of commits."

https://lwn.net/Articles/994843/


[$] The long road to lazy preemption

The kernel's CPU scheduler currently offers several preemption modes that
implement a range of tradeoffs between system throughput and response time.
Back in September 2023, a discussion
on scheduling led to the concept of "lazy preemption", which could
simplify scheduling in the kernel while providing better results.  Things
went quiet for a while, but lazy preemption has returned in the form of https://lwn.net/ml/all/20241007074609.447006177@infradead.org

from Peter Zijlstra.  While the concept appears to work well, there is
still a fair amount of work to be done.

https://lwn.net/Articles/994322/


Security updates for Friday

Security updates have been issued by AlmaLinux (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-21-openjdk, and webkit2gtk3), Debian (apache2), Red Hat (expat), SUSE (cups-filters, jetty-minimal, OpenIPMI, and python-starlette), and Ubuntu (linux-azure, linux-azure, linux-azure-5.15, linux-azure, linux-azure-5.4, and oath-toolkit).

https://lwn.net/Articles/994703/


Rust 1.82.0 released

Version
1.82.0 of the Rust language has been released.  There are a lot of new
features this time, including a cargo info command, tier-1 support
for 64-bit Apple Arm systems, a new native syntax (&raw) to create
raw pointers, changes to unsafe extern, unsafe attributes,
standardized rules around the handling of floating-point not-a-number
values, and more.

https://lwn.net/Articles/994654/


[$] A look at the aerc mail client

Email has become somewhat unfashionable as a collaboration tool for
open-source projects, but there are still a number of projects—such as
PostgreSQL and the Linux kernel—that expect contributors to send and
review patches via email. The https://aerc-mail.org/

mail client is aimed at developers looking for a text-based, efficient, and
extensible client that is meant to be used for working with Git and
email. It uses Vim-style keybindings by default, and has an interface
inspired by https://github.com/tmux/tmux/wiki
 that
lets users manage multiple accounts, mails, and embedded terminals at once.

https://lwn.net/Articles/993498/


Five new stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/994633/
 stable kernels.  As usual, this set
of updates contains a long list of important fixes throughout the kernel
tree.

https://lwn.net/Articles/994632/


Security updates for Thursday

Security updates have been issued by Debian (python-cryptography), Fedora (dnsdist and python-virtualenv), Red Hat (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, and java-21-openjdk), Slackware (libssh2 and mozilla), SUSE (haproxy, keepalived, libarchive, libnss_slurm2, php8, and python310-pytest-html), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gkeop,
 linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15,
 linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency,
 linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15,
 linux-raspi, linux-xilinx-zynqmp, linux, linux-aws, linux-aws-5.4, linux-bluefield, linux-gcp,
 linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4,
 linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4,
 linux-xilinx-zynqmp, and linux, linux-aws, linux-aws-6.8, linux-gcp, linux-gcp-6.8, linux-hwe-6.8,
 linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia,
 linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle,
 linux-oracle-6.8, linux-raspi).

https://lwn.net/Articles/994630/


Forgejo 9.0 released

https://forgejo.org/2024-10-release-v9-0/
 of the
Forgejo software forge system has been released.  Changes include a switch
to the GPLv3 license, the beginning of a quota system, the removal of
go-git support, and a lot of fixes.
(LWN https://lwn.net/Articles/963095/
 in February).

https://lwn.net/Articles/994515/


[$] Using LKMM atomics in Rust

Rust, like C, has its own memory model describing how concurrent access to the
same data by multiple threads can behave.
The Linux kernel, however, has its own
ideas. The

Linux kernel memory model (LKMM) is subtly different from both the
standard C memory model and Rust's model.
At Kangrejos, Boqun Feng gave a presentation about the
need to reconcile the memory models used by Rust and the kernel,
including a few potential avenues for doing so. While
no consensus was reached, it is an area of active discussion.

https://lwn.net/Articles/993785/


[$] Two pidfd tweaks: PIDFD_GET_INFO and PIDFD_SELF

The pidfd mechanism, which uses file descriptors to refer to processes in
an unambiguous and race-free way, was first
introduced in 2018.  Since then, the interface has https://lwn.net/Articles/794707/
, but
development has slowed over time as the interface has matured.  There are,
however, a couple of patches in circulation that are meant to make working
with pidfds simpler in some situations.

https://lwn.net/Articles/992991/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (buildah, containernetworking-plugins, and skopeo), Fedora (pdns-recursor and valkey), Mageia (unbound), Red Hat (fence-agents, firefox, java-11-openjdk, python-setuptools, python3-setuptools, resource-agents, and thunderbird), SUSE (etcd-for-k8s, libsonivox3, rubygem-puma, and unbound), and Ubuntu (apr, libarchive, linux, linux-aws, linux-aws-hwe, linux-azure-4.15, linux-gcp,
 linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, nano, and vim).

https://lwn.net/Articles/994436/


LibreSSL 4.0.0 released

https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.0.0-relnotes.txt
 TLS/cryptography stack
has been released. Changes include a cleanup of the MD4 and MD5
implementations, removal of unused DSA methods, changes in libtls
protocol parsing to ignore unsupported TLSv1.1 and TLSv1.0 protocols,
and many more internal changes and bug fixes.

https://lwn.net/Articles/994320/


Security updates for Tuesday

Security updates have been issued by AlmaLinux (container-tools:rhel8, firefox, OpenIPMI, podman, and thunderbird), Debian (libapache-mod-jk, php7.4, and webkit2gtk), Fedora (edk2, koji, libgsf, rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, and rust-tower0.4), Mageia (packages and thunderbird), Oracle (bind, container-tools:ol8, kernel, kernel-container, OpenIPMI, podman, and thunderbird), Red Hat (container-tools:rhel8, containernetworking-plugins, podman, and skopeo), SUSE (argocd-cli, bsdtar, keepalived, kernel, kyverno, libmozjs-115-0, libmozjs-128-0, libmozjs-78-0, OpenIPMI, opensc, php8, thunderbird, and xen), and Ubuntu (configobj, haproxy, imagemagick, nginx, and postgresql-10, postgresql-9.3).

https://lwn.net/Articles/994268/


[$] Zapping pointers out of thin air

Paul McKenney gave a presentation at Kangrejos this year that wasn't (directly)
related to Rust. Instead, he spoke about the work he has been doing in concert
with many other contributors on improving the handling of subtle concurrency
problems in C++.
Although he cautioned that his talk was only an overview, and not a
substitute for reading the relevant papers, he hoped that the things the C++
community is working on would be of interest to the Rust developers present as
well, and potentially inform future work on the language. McKenney's talk was,
as is his style, full of subtle examples of weird multithreaded behavior.
Interested readers may wish to refer to

his slides in an attempt to follow along.

https://lwn.net/Articles/993484/


Inkscape 1.4 released

Version
1.4 of the https://inkscape.org/

open-source vector-graphics editor has been released. Highlights of
this release include a filter gallery, import for https://en.wikipedia.org/wiki/Affinity_Designer

files, internal links in exported PDFs, and more. See the release
notes for all of the new features. LWN https://lwn.net/Articles/991732/
 the 1.4 release
in early October.

https://lwn.net/Articles/994098/


[$] Debian's "secret" sauce

While Debian's "sauce" is not actually all that secret, it is not particularly
well-known either, Samuel Henrique said at the start of his https://debconf24.debconf.org/
 talk.  There is a lot
of software-engineering effort that has been put in place by the
distribution in order to create and maintain its releases, but "loads of
people are not aware" of it.  That may be due to the fact that all of
that is
not really documented anywhere in a central location that he can just point
someone to.  Recognizing that is what led him to give the talk;
hopefully it will be a "first step toward" helping solve the problem.

https://lwn.net/Articles/990177/


Security updates for Monday

Security updates have been issued by Debian (docker.io, libreoffice, node-dompurify, python-reportlab, and thunderbird), Fedora (buildah, chromium, kernel, kernel-headers, libgsf, mosquitto, p7zip, podman, python-cramjam, python-virtualenv, redis, rust-async-compression, rust-brotli, rust-brotli-decompressor, rust-libcramjam, rust-libcramjam0.2, rust-nu-command, rust-nu-protocol, rust-redlib, rust-tower-http, thunderbird, and webkit2gtk4.0), Oracle (.NET 6.0, .NET 8.0, e2fsprogs, firefox, golang, openssl, python3-setuptools, systemd, and thunderbird), SUSE (chromium, firefox, java-jwt, libmozjs-128-0, libwireshark18, ntpd-rs, OpenIPMI, thunderbird, and wireshark), and Ubuntu (firefox, python2.7, python3.5, thunderbird, and ubuntu-advantage-desktop-daemon).

https://lwn.net/Articles/994080/


Kernel prepatch 6.12-rc3

The https://lwn.net/Articles/993955/
 kernel prepatch is out for
testing.

	So the diffstat looks a bit odd, because one of the fixes here
	caused the UTF tables to be regenerated, and an effective one-liner
	change turned into 6703 lines of diff.

	But if you ignore that effect, everything looks normal.

https://lwn.net/Articles/993956/


[$] FFI type mismatches in Rust for Linux

At Kangrejos, Gary Guo wanted to discuss three problems with the way
Rust and C code in the kernel interact: mismatched types, too many type casts,
and the overhead of helper functions. To fix the first two problems, Guo proposed
changing the way the kernel maps C types into Rust types. The last problem was a
bit trickier, but he has a clever workaround for that, based on tricking
the compiler into inlining the helper functions across language boundaries.

https://lwn.net/Articles/993163/


Security updates for Friday

Security updates have been issued by AlmaLinux (.NET 6.0, .NET 8.0, and openssl), Debian (firefox-esr), Fedora (firefox), Mageia (php, quictls, and vim), Red Hat (buildah, container-tools:rhel8, containernetworking-plugins, firefox, podman, skopeo, and tomcat), Slackware (mozilla), SUSE (apache-commons-io, kernel, and xen), and Ubuntu (golang-1.17, libgsf, and linux-aws-6.8, linux-oracle-6.8).

https://lwn.net/Articles/993778/


Ubuntu 24.10 released

Version
24.10 of the Ubuntu distribution is out. This release includes GNOME 47, Linux 6.11,
security enhancements for managing Personal Package Archives (PPAs),
experimental security controls for Snap packages, and more.

https://lwn.net/Articles/993660/


[$] On Rust in enterprise kernels

At the recently concluded Maintainers Summit, it was generally agreed that the Rust experiment would
continue, and that the path was clear for more Rust code to enter the
kernel.  But the high-level view taken at such gatherings cannot always
account for the difficult details that will inevitably arise as the Rust
work proceeds.  A recent discussion on the nouveau mailing list may have
escaped the notice of many, but it highlights some of the problems that
will have to be worked out as important functionality written in Rust heads
toward the mainline.

https://lwn.net/Articles/993337/


Updating Firefox is highly recommended

Mozilla has released Firefox versions 131.0.2, ESR 128.3.1, and ESR
115.16.1.  These updates address a
severe, remotely exploitable code-execution vulnerability that is
evidently already being exploited.  Updating to a fixed release seems like
a wise thing to do.

https://lwn.net/Articles/993608/


Security updates for Thursday

Security updates have been issued by Debian (chromium), Fedora (firefox, koji, unbound, webkit2gtk4.0, and xen), Red Hat (glibc, net-snmp, and tomcat), Slackware (mozilla), SUSE (apache-commons-io, buildah, cups-filters, liboath-devel, libreoffice, libunbound8, podman, and redis), and Ubuntu (cups-browsed, cups-filters, edk2, linux-raspi-5.4, and oath-toolkit).

https://lwn.net/Articles/993595/


[$] LWN.net Weekly Edition for October 10, 2024

The LWN.net Weekly Edition for October 10, 2024 is available.

https://lwn.net/Articles/992718/


[$] Improving bindgen for the kernel

Bindgen is a widely used tool that automatically generates Rust bindings from C
headers. The

Rust-for-Linux project uses it to create some of
the bindings between Rust code and the rest of the kernel. John Baublitz
presented at Kangrejos about the improvements that he has made to the tool in
order to make the generated bindings easier to use, including improved support
for macros, bitfields, and enums.

https://lwn.net/Articles/992693/


Julia v1.11.0 has been released

The Julia project has

released version 1.11.0. A separate

blog post covers some of the highlights. The release includes a number of helpful features.

In previous Julia versions, there was no "programmatic way" of knowing if an unexported name was considered part of the public API or not. Instead, the guideline was basically that if it was not in the manual then it was not public which was a bit underwhelming. To remedy that, there is now a public keyword in Julia that can be used to indicate that an unexported name is part of the public API.

https://lwn.net/Articles/993436/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (firefox, mod_jk, and thunderbird), Debian (apache2 and firefox-esr), Fedora (crosswords, logiops, p7zip, and perl-App-cpanminus), Red Hat (.NET 6.0, firefox, git, kernel, kernel-rt, openssl, and thunderbird), SUSE (buildah, json-lib, kernel, Mesa, mozjs78, pgadmin4, podman, podofo, qatlib, redis7, roundcubemail, rusty_v8, and seamonkey), and Ubuntu (dotnet6, dotnet8, nginx, and ruby-webrick).

https://lwn.net/Articles/993433/


[$] The Open Source Pledge: peer pressure to pay maintainers

In the early days of open source, it was a struggle to get companies
to accept the concept and trust its development model.
Now, companies have few qualms about using it, but do tend to take open source and
those who maintain it for granted. The struggle now is to find ways
to compensate producers of the software, sustain the open‑source
commons, and avoid burning out maintainers. The https://opensourcepledge.com/
 project is
an effort to persuade companies to pay maintainers by making it a social
norm. On October 8, the project is launching a marketing campaign to raise
awareness and try to get a larger conversation started around paying
maintainers.

https://lwn.net/Articles/993073/


[$] Efficient Rust tracepoints

Alice Ryhl has been working to enable

tracepoints — which are widely used
throughout the kernel — to be seamlessly placed in Rust code as well. She spoke
about her approach at Kangrejos. Her

patch set
enables efficient use of static
tracepoints, but supporting dynamic tracepoints will take some additional effort.

https://lwn.net/Articles/992455/


Security updates for Tuesday

Security updates have been issued by Debian (kernel), Fedora (webkitgtk), Mageia (cups), Oracle (e2fsprogs, kernel, and kernel-container), Red Hat (buildah, container-tools:rhel8, containernetworking-plugins, git-lfs, go-toolset:rhel8, golang, grafana-pcp, podman, and skopeo), SUSE (Mesa, mozjs115, podofo, and redis7), and Ubuntu (cups and cups-filters).

https://lwn.net/Articles/993276/


OpenBSD 7.6 released

OpenBSD 7.6 has been https://www.openbsd.org/76.html
. Notable new
features include work to improve suspend/resume on modern hardware,
support for the arm64 Qualcomm Snapdragon X Elite laptops, as well as many
improvements in hardware support and driver bug fixes.

With this release all files that existed in the first commit
in the OpenBSD source repository have been updated,
modified or replaced at some point in time, reaching OpenBSD of Theseus.

See the https://www.openbsd.org/plus76.html

for all changes between OpenBSD 7.5 and 7.6.

https://lwn.net/Articles/993203/


[$] ClassicPress: WordPress without the block editor

The recent WordPress
controversy is not the first time there's been tension between the
https://wordpress.org/
 as a business, and Matt
Mullenweg's leadership as WordPress's benevolent dictator for
life (BDFL). In particular, Mullenweg's focus on pushing WordPress to use a new
"editing experience" called https://wordpress.org/gutenberg/
 caused significant
friction—and led to the https://www.classicpress.net/
 fork. Users who
want to preserve the "classic" WordPress experience without straying
too far from the WordPress fold may want to look into ClassicPress.

https://lwn.net/Articles/992219/


Python 3.13 released

Version 3.13 of the https://www.python.org/
. The
"What's New
In Python 3.13" page has a summary of all the new features and
changes. Highlights of the release include https://lwn.net/Articles/977855/
,
experimental support for https://lwn.net/Articles/985041/
, and much
more. See the https://docs.python.org/3.13/whatsnew/changelog.html

for even more details.

https://lwn.net/Articles/993191/


[$] In search of the AOSP community

The core of the Android operating system, as represented by the https://source.android.com/
 (AOSP),
can only be considered one of the most successful open-source initiatives
ever created; its user count is measured in the billions.  But few would
consider it to be a truly community-oriented project.  At the 2024 https://lpc.events/
, Chris Simmonds
asked why the AOSP community is so hard to find, and what might be done
about the situation.

https://lwn.net/Articles/992992/


Git 2.47.0 released

https://lwn.net/ml/all/xmqqa5fg9bsz.fsf@gitster.g
 of the Git
source-code management system has been released.  The changes include a
long list of incremental improvements; see the announcement and this
GitHub blog post for details.

https://lwn.net/Articles/993180/


RPM 4.20 released

https://rpm.org/wiki/Releases/4.20.0
 of
the RPM Package Manager (RPM) has been released. Major changes in this
release include a new plugin to prevent filesystem and network access
by scriptlets, the BuildSystem directive for declaring the
build system to be used by packaged software, and more. LWN https://lwn.net/Articles/988927/
 the development of
RPM 4.20 in September.

https://lwn.net/Articles/993161/


Security updates for Monday

Security updates have been issued by AlmaLinux (go-toolset:rhel8 and linux-firmware), Arch Linux (oath-toolkit), Debian (e2fsprogs, firefox-esr, libgsf, mediawiki, and oath-toolkit), Fedora (aws, chromium, firefox, p7zip, pgadmin4, python-gcsfs, unbound, webkitgtk, znc, znc-clientbuffer, and znc-push), Mageia (ghostscript and rootcerts nss firefox firefox-l10n), Oracle (kernel, oVirt 4.4 ovirt-engine, and thunderbird), SUSE (chromedriver, chromium, cups-filters, ffmpeg-7, frr, Mesa, openssl-3, openvpn, pcp, and redis), and Ubuntu (firefox and ruby-webrick).

https://lwn.net/Articles/993160/


Kernel prepatch 6.12-rc2

Linus has released https://lwn.net/Articles/993106/
 for testing.

	Anyway, this isn't one of the small rc2's. But looking at
	historical trends, being a bigger rc2 isn't _that_ unusual, and
	nothing in here looks all that odd. Yes, the diffstat may look a
	bit unusual, in that we had a global header renaming
	(asm/unaligned.h -> linux/unaligned.h) and we had a couple of
	reverts that stand out as spikes in the stats, but everything else
	looks nice and small.

https://lwn.net/Articles/993107/


Akamai finds many systems with exposed CUPS vulnerability

Akamai

released a report pointing out that the

recently-reported CUPS vulnerability
(https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
)
could be used to drive distributed denial-of-service (DDoS) attacks as well. Even if an attacker cannot gain remote control over a computer, they can still cause it to fetch a URL of their choice — potentially getting free DDoS amplification.

The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet; roughly 34% of those could be used for DDoS abuse (58,000+).

https://lwn.net/Articles/993044/


[$] Smart pointers for the kernel

Rust has a plethora of smart-pointer types, including reference-counted
pointers, which have special support in the compiler to make them
easier to use. The Rust-for-Linux project would like to reap those same benefits
for its smart pointers, which need to be written by hand to conform to
the

Linux kernel
memory model. Xiangfei Ding
presented at Kangrejos about the work to enable custom
smart pointers to function the same as built-in smart pointers.

https://lwn.net/Articles/992055/


Three Friday kernel updates

The
https://lwn.net/Articles/992978/
,
https://lwn.net/Articles/992979/
,
and
https://lwn.net/Articles/992980/
 stable kernels have been released.
They contain important fixes, and upgrading is, as always, recommended.

https://lwn.net/Articles/992977/


oath-toolkit: privilege escalation in pam_oath.so (SUSE Security Team Blog)

The SUSE Security Team Blog has a detailed
report on its discovery of https://www.nongnu.org/oath-toolkit/security/CVE-2024-47191/
 in the
https://gitlab.com/oath-toolkit/oath-toolkit
,
which provides libraries and utilities for managing one-time password
(OTP) authentication.

Fellow SUSE engineer Fabian Vogt approached our Security Team about
the project's PAM module. A couple of years ago, the module gained a
feature which allows to place the OTP state file (called usersfile) in
the home directory of the to-be-authenticated user. Fabian noticed
that the PAM module performs unsafe file operations in users' home
directories. Since PAM stacks typically run as root, this can easily
cause security issues.

https://lwn.net/Articles/992948/


Security updates for Friday

Security updates have been issued by AlmaLinux (firefox, golang, linux-firmware, and thunderbird), Debian (kernel and zabbix), Fedora (firefox, pgadmin4, and php), Mageia (chromium-browser-stable, cjson, hostapd and wpa_supplicant, and openjpeg2), Oracle (firefox, flatpak, and go-toolset:ol8), Red Hat (cups-filters, firefox, grafana, linux-firmware, python3, python3.11, and python3.9), SUSE (expat, firefox, libpcap, and opensc), and Ubuntu (freeradius, imagemagick, and unzip).

https://lwn.net/Articles/992936/


Security updates for Thursday

Security updates have been issued by AlmaLinux (cups-filters), Debian (chromium and php8.2), Fedora (firefox), Oracle (cups-filters, flatpak, kernel, krb5, oVirt 4.5 ovirt-engine, and python-urllib3), Red Hat (cups-filters, firefox, go-toolset:rhel8, golang, and thunderbird), SUSE (postgresql16), and Ubuntu (gnome-shell and linux-azure-fde-5.15).

https://lwn.net/Articles/992798/


[$] LWN.net Weekly Edition for October 3, 2024

The LWN.net Weekly Edition for October 3, 2024 is available.

https://lwn.net/Articles/991771/


[$] BTF, Rust, and the kernel toolchain

BPF Type Format (BTF),
BPF's debugging information format, has undergone rapid evolution to match
the evolving needs of BPF programs. José Marchesi spoke at Kangrejos about some
of that work — and how it could impact Rust, specifically. He discussed debug
information, kernel-specific relocations, and the planned changes to kernel
stack unwinding. Each of these will require some amount of work to fully
support in Rust, but preliminary signs look promising.

https://lwn.net/Articles/991719/


Manjaro 24.1 released

Version
24.1 of the Arch-based https://manjaro.org/

distribution is now available with the 6.10 Linux kernel,
GNOME 46.5, KDE Plasma 6.1 and KDE Gear 24.08:

Plasma 6.1 on Wayland now has a feature that "remembers" what you were
doing in your last session like it did under X11. Although this is
still work in progress, If you log off and shut down your computer
with a dozen open windows, Plasma will now open them for you the next
time you power up your desktop, making it faster and easier to get
back to what you were doing. At Manjaro we are still defaulting to
X11, however switching to Wayland can be done easily by selecting the
wanted session in your display manager.

The project also offers minimal install images with the 6.6 LTS and
6.1 LTS kernels to support older hardware as needed.

https://lwn.net/Articles/992660/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (grafana), Fedora (cjson and php), Oracle (389-ds-base, freeradius, grafana, kernel, and krb5), Slackware (cryfs, cups, and mozilla), SUSE (OpenIPMI, openssl-3, openvpn, thunderbird, and tomcat), and Ubuntu (cups, cups-filters, knot-resolver, linux-raspi, linux-raspi-5.4, orc, php7.4, php8.1, php8.3, python-asyncssh, ruby-devise-two-factor, and vim).

https://lwn.net/Articles/992650/


Firefox 131.0 released

Version
131.0 of the Firefox browser has been released.  Changes include the
ability to temporarily grant permissions to sites and a preview that pops
up when hovering over tabs.

https://lwn.net/Articles/992489/


[$] An update on gccrs development

One concern that has often been expressed about the Rust language is that
there is only one compiler for it.  That makes it hard to say what the
standard version of the language is and restricts the architectures that
can be targeted by Rust code to those that the available compiler supports.
Adding a Rust frontend to GCC would do much to address those concerns; at
the 2024 GNU Tools
Cauldron, Pierre-Emmanuel Patry gave an update on the state of that
work and what its objectives are.

https://lwn.net/Articles/991199/


Security updates for Tuesday

Security updates have been issued by Debian (debian-security-support, nghttp2, and sqlite3), Oracle (cups-filters, kernel, and osbuild-composer), SUSE (openssl-3), and Ubuntu (bubblewrap, flatpak and python2.7, python3.5).

https://lwn.net/Articles/992444/


[$] Coccinelle for Rust

Tathagata Roy has been working to make the

Coccinelle tool that is used (among other things)
to automate the refactoring of C code work on Rust
code as well. Roy gave a
presentation at https://kangrejos.com/
 about that work,
including the creative approaches necessary to work with Rust's more complicated
control flow and syntax.

https://lwn.net/Articles/991399/


[$] The rest of the 6.12 merge window

Linus Torvalds released
6.12-rc1 and closed the 6.12 merge window on September 29; at that
point, 11,260 non-merge change sets had been pulled into the mainline for
the 6.12 release.  That is the lowest number of merge-window changes since
5.17-rc1 in January 2022, which brought in 11,068 changesets.  Nonetheless,
6.12 brings a number of interesting changes, many of which were included in
the roughly 4,500 changes merged since the
summary of the first half of the 6.12 merge window was written.

https://lwn.net/Articles/991301/


Four new stable kernels

The https://lwn.net/Articles/992294/
 stable kernels have been released.
Each contains important fixes and users of those series should upgrade.

https://lwn.net/Articles/992292/


Tcl/Tk 9.0 released

The most recent major release of the https://www.tcl.tk/
.  The 9.0 release brings 64-bit data values, better Unicode support, the ability to use zip files as filesystems, a switch to use epoll() or kqueue() where they are available, SVG support in Tk, access to notifications and other desktop-platform services in Tk, and lots more.  For more information, see the release notes for Tcl and Tk that can be downloaded as Markdown files from the announcement page. (Thanks to Matt Bradley.)

https://lwn.net/Articles/992284/


Security updates for Monday

Security updates have been issued by AlmaLinux (cups-filters, net-snmp, and osbuild-composer), Debian (booth, cups, cups-filters, python-asyncssh, ruby-httparty, ruby-loofah, ruby-rails-html-sanitizer, tryton-server, unbound, and wireshark), Fedora (chromium, cjson, cups, cups-browsed, libcupsfilters, and libppd), Gentoo (Apache HTTPD, Docker, HashiCorp Consul, IcedTea, nginx, tmux, and yt-dlp), Mageia (java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, & java-latest-openjdk and libreoffice), Red Hat (git-lfs, grafana, and osbuild-composer), and SUSE (chromedriver, chromium, coredns, json-java-20240303, kernel, libmozjs-128-0, maven-archetype, python3, python312, and quagga).

https://lwn.net/Articles/992281/


Arch Linux getting support from Valve

The Arch Linux project has announced that Valve will be helping the
distribution with a couple of important initiatives:

Valve is generously providing backing for two
critical projects that will have a huge impact on our distribution: a
build service infrastructure and a secure signing enclave. By supporting
work on a freelance basis for these topics, Valve enables us to work on
them without being limited solely by the free time of our volunteers.

https://lwn.net/Articles/992194/


Kernel prepatch 6.12-rc1

Linus has https://lwn.net/Articles/992184/
 and closed the
merge window for this release.

	Despite conference travel (both for me and several maintainers),
	things seemed to go mostly fairly normally. There's a couple of
	notable new features in here: For one thing, PREEMPT_RT is now
	mainlined and enabled as a config option (you do need to enable
	"EXPERT" to get the question). For another, sched_ext also got
	merged.

https://lwn.net/Articles/992185/


Górny: The perils of transition to 64-bit time_t

Michał Górny describes
the challenges involved in transitioning Gentoo to year-2038-safe time
representations:

	There is a general agreement that the way forward is to change
	time_t to a 64-bit type. Musl has already switched to that, glibc
	supports it as an option. A number of other distributions such as
	Debian have taken the leap and switched. Unfortunately,
	source-based distributions such as Gentoo don't have it that
	easy. So we are still debating the issue and experimenting, trying
	to figure out a maximally safe upgrade path for our users.

	Unfortunately, that's nowhere near trivial. Above all, we are
	talking about a breaking ABI change.

https://lwn.net/Articles/992120/


Security updates for Friday

Security updates have been issued by Debian (chromium and trafficserver), Fedora (chromium), Mageia (apache-mod_jk, gnome-shell, kernel, kmod-xtables-addons, and kmod-virtualbox, kernel-linus, and python3), Oracle (container-tools:ol8, dovecot, emacs, expat, firefox, git-lfs, gtk3, kernel, nano, net-snmp, osbuild-composer, python3, python3.11, python3.12, ruby:3.3, and virt:ol and virt-devel:rhel), Slackware (boost), SUSE (kernel), and Ubuntu (configobj, cups, cups-browsed, cups-filters, libcupsfilters, and libppd).

https://lwn.net/Articles/992030/


Remote exploit of CUPS

Security researcher Simone Margaritelli

has reported a new vulnerability in

CUPS, the software that many Linux systems use to manage printers and print jobs. Margaritelli describes the impact of the attack by saying:

A remote unauthenticated attacker can silently replace existing printers' (or install new ones) IPP urls with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer).

The vulnerability relies on a few related problems in CUPS libraries and utilities; versions before 2.0.1 or 2.1b1 (depending on the component) may be affected.

https://lwn.net/Articles/991929/


[$] Getting PCI driver abstractions upstream

Danilo Krummrich gave a talk at Kangrejos 2024 focusing on the question of how
the Rust-for-Linux project could improve at getting device and driver
abstractions upstream. As a case study, he used some of his recent work that
attempts to make it possible to write a PCI driver entirely in Rust. There
wasn't time to go into as much detail as he would have liked, but he did
demonstrate that it is possible to interface with the kernel's module loader in
a way that is much harder to
screw up than the current standard approach in C.

https://lwn.net/Articles/990918/


PostgreSQL 17 released

Version
17 of the https://www.postgresql.org/
 database has been released.

This release of PostgreSQL adds significant overall performance gains,
including an overhauled memory management implementation for vacuum,
optimizations to storage access and improvements for high concurrency
workloads, speedups in bulk loading and exports, and query execution
improvements for indexes. PostgreSQL 17 has features that benefit
brand new workloads and critical systems alike, such as additions to
the developer experience with the SQL/JSON JSON_TABLE command, and
enhancements to logical replication that simplify management of high
availability workloads and major version upgrades.

LWN recently https://lwn.net/Articles/984599/

some of the interesting new features and security enhancements in
PostgreSQL 17.

https://lwn.net/Articles/991904/


Uniting for Internet Freedom: Tor Project & Tails Join Forces (Tor blog)

The online-privacy-focused Tor
project has https://blog.torproject.org/tor-tails-join-forces/

that it has "joined forces and merged operations" with the https://tails.net/
 Linux distribution.

Countering the threat of global mass surveillance and censorship to a free Internet, Tor and Tails provide essential tools to help people around the world stay safe online. By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.

In late 2023, Tails approached the Tor Project with the idea of merging operations. Tails had outgrown its existing structure. Rather than expanding Tails's operational capacity on their own and putting more stress on Tails workers, merging with the Tor Project, with its larger and established operational framework, offered a solution. By joining forces, the Tails team can now focus on their core mission of maintaining and improving Tails OS, exploring more and complementary use cases while benefiting from the larger organizational structure of The Tor Project.

https://lwn.net/Articles/991899/


[$] Sched_ext at LPC 2024

The https://lwn.net/Articles/922405/

enables the implementation of CPU schedulers as a set of BPF programs
loaded from user space; it first hit the mailing lists in late 2022.
Sched_ext has engendered its share of controversy since, but is currently
slated to be part of the 6.12 kernel release.  At the 2024 https://lpc.events/
, the growing
sched_ext community held one of its first public gatherings; sched_ext
would appear to have launched a new burst of creativity in scheduler
design.

https://lwn.net/Articles/991205/


Security updates for Thursday

Security updates have been issued by AlmaLinux (container-tools:rhel8, dovecot, emacs, expat, git-lfs, go-toolset:rhel8, golang, grafana, grafana-pcp, gtk3, kernel, kernel-rt, nano, python3, python3.11, python3.12, and virt:rhel and virt-devel:rhel), Debian (mediawiki and puredata), Fedora (chisel), Mageia (glib2.0, gtk+2.0 and gtk+3.0, and python-astropy), Red Hat (git-lfs, grafana, grafana-pcp, kernel, and kernel-rt), SUSE (kubernetes1.24, kubernetes1.25, kubernetes1.26, kubernetes1.27, kubernetes1.28, opensc, and python36), and Ubuntu (apparmor, apr, ca-certificates, linux, linux-aws, linux-kvm, linux-lts-xenial, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-raspi, openjpeg2, ruby-rack, and tomcat8, tomcat9).

https://lwn.net/Articles/991897/


Eliminating Memory Safety Vulnerabilities at the Source
(Google Security Blog)

Here's a
post on the Google Security Blog on how switching to a memory-safe
language can quickly reduce vulnerabilities in a project, even if a large
body of older code persists.

	 This leads to two important takeaways:

     The problem is overwhelmingly with new code, necessitating a
    fundamental change in how we develop code.
     Code matures and gets safer with time, exponentially, making the
    returns on investments like rewrites diminish over time as code gets
    older.

For example, based on the average vulnerability lifetimes, 5-year-old code
has a 3.4x (using lifetimes from the study) to 7.4x (using lifetimes
observed in Android and Chromium) lower vulnerability density than new
code.

https://lwn.net/Articles/991775/


[$] What the Nova GPU driver needs

In March, Danilo Krummrich https://lwn.net/Articles/966129
 the new
Nova GPU driver — a successor to Noveau for controlling NVIDIA GPUs.
At Kangrejos 2024, Krummrich gave a
presentation about what it is, why it's needed, and where it's
going next. Hearing about the needs of the driver provoked extended discussion
on related topics, including what level of safety is reasonable to expect from
drivers, given that they must interact with the hardware.

https://lwn.net/Articles/990736/


[$] Linus and Dirk on succession, Rust, and more

The "Linus and Dirk show" has been a fixture at Open Source Summit for as
long as the conference has existed; it started back when the conference was
called LinuxCon.  Since Linus Torvalds famously does not like to give
talks, as he said during this year's edition at https://events.linuxfoundation.org/open-source-summit-europe/

(OSSEU) in Vienna, Austria, he and Dirk Hohndel have been sitting down for an
informal chat on a wide range of topics as a keynote session.  That way,
Torvalds does not need to prepare, but also does not know what topics
will be brought up, which makes it "so much more fun for one of us", Hohndel
said with a grin.   The topics this time ranged from the just-released 6.11
kernel and the upcoming Linux 6.12, through Rust for the kernel, to the recurring topic of succession and
the graying of Linux maintainers.

https://lwn.net/Articles/990534/


Security updates for Wednesday

Security updates have been issued by Debian (booth), Gentoo (Xpdf), Oracle (go-toolset:ol8, golang, grafana, grafana-pcp, kernel, libnbd, openssl, pcp, and ruby:3.3), Red Hat (container-tools:rhel8, go-toolset:rhel8, golang, kernel, and kernel-rt), SUSE (apr, cargo-audit, chromium, obs-service-cargo, python311, python36, quagga, traefik, and xen), and Ubuntu (intel-microcode, linux-azure-fde-5.15, and puma).

https://lwn.net/Articles/991701/


[$] KDE sets its goals through 2026

Almost a decade ago https://ev.kde.org/
,
the non-profit organization that supports KDE, started a https://community.kde.org/Goals/Goals_Process
 for
selecting https://kde.org/goals/
 to help the community unite behind a common vision for where the
project should go in the near future. KDE
recently wrapped up its 2022-2024 https://community.kde.org/Goals
 on September 7, in Würzburg,
Germany. This time around, KDE will be looking to streamline its
application-development experience, improve support for input devices,
and bring in new contributors.

https://lwn.net/Articles/990604/


HarfBuzz 10.0.0 released

Version
10.0.0 of the https://harfbuzz.github.io/

text-shaping engine has been released. Notable changes in this release
include Unicode
16.0.0 support, adding Cairo script as an output format for
hb-view, and a number of bug fixes.

https://lwn.net/Articles/991529/


[$] Committing to Rust in the kernel

The project to enable the writing of kernel code in Rust has been underway
for several years, and each kernel release includes more Rust code.  Even
so, some developers have expressed frustration at the time it takes to get
new functionality merged, and an air of uncertainty still hangs over
the project.  At the 2024 Maintainers Summit, Miguel Ojeda led a discussion
on the status of Rust in the kernel and whether the time had come to stop
considering it an experimental project.  There were not answers to all of the
questions, but it seems clear that Rust in the kernel will continue
steaming ahead.

https://lwn.net/Articles/991062/


Security updates for Tuesday

Security updates have been issued by Gentoo (GCC, Hunspell, Tor, and ZNC), SUSE (apr-devel, cargo-c, chromedriver, firefox, kernel, libecpg6, libmfx, onefetch, postgresql12, postgresql13, postgresql14, postgresql15, postgresql16, python310-azure-identity, python39, qemu, rage-encryption, stgit, and system-user-zabbix), and Ubuntu (kernel, linux-ibm-5.15, linux-oracle-5.15, linux-xilinx-zynqmp, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-raspi, and py7zr).

https://lwn.net/Articles/991492/


Hy 1.0.0 released

Version 1.0.0 of Hy, a Lisp dialect that is embedded in Python, has been https://github.com/hylang/hy/discussions/2608

after nearly 12 years in development. This is the first stable release of the project:

Henceforth, breaking changes to documented parts of the language
(other than dropping support for versions of Python that are
themselves no longer supported by the CPython developers) will
increase the major version number, and my intention is for that not to
happen often, if at all.

The 1.0.0 release supports Python 3.8 through 3.13. See the documentation and the "Why Hy?" page for why
one might want to use it.

https://lwn.net/Articles/991401/


[$] Resources for learning Rust for kernel development

Dirk Behme led a second session, back-to-back with
https://lwn.net/Articles/990489/
 at
Kangrejos 2024, discussing providing better guidance for users of the kernel's
Rust abstractions. Just after that,
Carlos Bilbao and Miguel Ojeda had their own time slot dedicated to collecting
resources that could be of use to someone trying to come up to speed
on kernel development in
Rust. The attendees provided a lot of guidance in both sessions, and
discussed what they could do to make things easier for people coming
from non-Rust backgrounds.

https://lwn.net/Articles/990619/


Security updates for Monday

Security updates have been issued by AlmaLinux (expat, fence-agents, firefox, libnbd, openssl, pcp, ruby:3.3, and thunderbird), Debian (ruby-saml), Fedora (aardvark-dns, chromium, expat, jupyterlab, less, openssl, python-jupyterlab-server, python-notebook, python3-docs, and python3.12), Gentoo (calibre, curl, Emacs, org-mode, Exo, file, GPL Ghostscript, gst-plugins-good, liblouis, Mbed TLS, OpenVPN, Oracle VirtualBox, PJSIP, Portage, PostgreSQL, pypy, pypy3, Rust, Slurm, stb, VLC, and Xen), SUSE (container-suseconnect, ffmpeg-4, kernel, libpcap, python3, python310, python36, and wpa_supplicant), and Ubuntu (firefox, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, linux-azure, and linux-ibm-5.15, linux-oracle-5.15).

https://lwn.net/Articles/991377/


pcp: pmcd network daemon review (SUSE Security Team Blog)

The SUSE Security Team Blog has a https://security.opensuse.org/2024/09/18/pcp-network-audit.html
:

The rather complex PCP software suite was difficult to judge just from
a cursory look, so we decided to take a closer look especially at
PCP's networking logic at a later time. This report contains two CVEs
and some non-CVE related findings we also gathered during the
follow-up review.

https://nvd.nist.gov/vuln/detail/CVE-2024-45769
,
a flaw that could allow an attacker to send crafted data to crash
https://man7.org/linux/man-pages/man1/pmcd.1.html
,
which could allow a full local root exploit from the pcp user to root,
have been addressed in the https://github.com/performancecopilot/pcp/releases/tag/6.3.1

release of PCP.

https://lwn.net/Articles/991091/


[$] The 6.12 merge window begins

As of this writing, 6,778 non-merge changesets have been pulled into the
mainline kernel for the 6.12 release — over half of the work that had been
staged in linux-next prior to the opening of the merge window.  There has
been a lot of refactoring and cleanup work this time around, but also some
significant changes.  Read on for a summary of the first half of the 6.12
merge window.

https://lwn.net/Articles/990750/


OpenSSH 9.9 released

The OpenSSH project has https://www.openssh.com/txt/release-9.9
 version 9.9. This version includes support for the
https://lwn.net/Articles/973231/
.
The release also includes
the next step in the deprecation of DSA keys — they are now disabled by default at compile time,
and are expected to be removed entirely in early 2025. The release also contains the normal mixture of bug fixes and small usability improvements.

https://lwn.net/Articles/991028/


[$] Considering kernel pass-through interfaces

The kernel normally sits firmly between user space and the system's
peripheral devices, and provides a standard interface to those devices.  At
times, though, a more direct interface to a device is desired — but such
interfaces can be controversial.  At the 2024 Maintainers Summit, the
assembled developers considered a specific case — the proposed https://lwn.net/Articles/969383/
 — as well as the role of such
drivers in general.

https://lwn.net/Articles/990802/


Security updates for Friday

Security updates have been issued by Debian (chromium), Fedora (bluez, chromium, frr, iwd, libell, python3.11, python3.8, python3.9, and ruby), Mageia (kernel, kmod-xtables-addons, and kmod-virtualbox and kernel-linus), Red Hat (kernel), SUSE (kernel, kubernetes1.23, kubernetes1.24, kubernetes1.25, libmfx, and python-azure-identity), and Ubuntu (emacs, emacs24, emacs25, libreoffice, postgresql-9.5, python2.7, python3.5, and tgt).

https://lwn.net/Articles/991027/


The realtime preemption pull request

<img src="https://lwn.net/images/conf/2024/ms/rt-pull-sm.png" alt="[pull request]" align="right">

On September 19, Thomas Gleixner delivered the pull request for the
realtime preemption enablement patches to Linus Torvalds — in printed form,
wrapped in gold, with a ribbon, as Torvalds had requested.  It was a
significant milestone, marking the completion of a project that required
20 years of effort.  Congratulations are due to everybody involved.

Torvalds https://git.kernel.org/linus/baeb9a7d8b60

the pull request the following morning.

https://lwn.net/Articles/990985/


[$] Best practices for error handling in kernel Rust

Dirk Behme led a session discussing the use of Rust's question-mark operator in
the kernel at Kangrejos 2024. He was particularly concerned with the concept of
"silent" errors that don't print any messages to the console.
Other attendees were less convinced that this was a problem, but his presentation
sparked a lot of discussion about whether the Rust-for-Linux project could
improve error handling in kernel Rust code.

https://lwn.net/Articles/990489/


[$] RPM 4.20 is coming

The https://rpm.org/
 (RPM) project is
nearing the release of RPM 4.20, the last major planned update for the RPM 4.x
series. It has few user-facing changes, but
several additions and enhancements for developers—as well as
some small incompatibilities that will likely require RPM packagers to
revise their spec
files. 4.20 will be rolling out to many users soon, in
Fedora 41, which is scheduled for October. RPM 6.0 is
already in the works, with a new package format and opening the door
to enabling C++ use in the RPM codebase.

https://lwn.net/Articles/988927/


Security updates for Thursday

Security updates have been issued by Debian (expat and tinyproxy), Fedora (frr, microcode_ctl, python3.10, python3.12, python3.6, and ruby), Oracle (expat, fence-agents, firefox, ghostscript, java-1.8.0-openjdk, kernel, and thunderbird), Red Hat (firefox, openssl, ruby:3.3, and thunderbird), SUSE (clamav, ffmpeg-4, kernel, libmfx, python3, python312, runc, ucode-intel, and wireshark), and Ubuntu (apache2, git, linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi, linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, and linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-oem-6.8, linux-oracle).

https://lwn.net/Articles/990877/


[$] The uncertain future of kernel regression tracking

Tracking of regressions seems like an important task for any project; there
is no other way to ensure that known problems are fixed.  At the 2024
Maintainers Summit, though, Thorsten Leemhuis, who has been doing that work
for the kernel, expressed some doubts about whether it is worth continuing.
The result was an energetic session on how regression tracking should be
done better, and how this work should be supported.

https://lwn.net/Articles/990599/


GNOME 47 released

https://release.gnome.org/47/
 of the GNOME desktop
has been released.  Changes include configurable accent colors, better
small-screen support, some performance improvements, new file open and save
dialogs, and more.

https://lwn.net/Articles/990788/


Three stable kernel updates for Wednesday

The https://lwn.net/Articles/990768/
 stable kernel updates have all
been released. As usual, they contain important fixes throughout the
tree. Users of those kernels should upgrade.

https://lwn.net/Articles/990766/


Swift 6 released

Version
6.0 of the Swift programming language has been released. Notable
changes include new low-level programming features,
expanded Linux support, and a preview release of the Embedded
Swift language subset for embedded software development with a
toolchain for Arm and RISC-V targets. See the https://github.com/swiftlang/swift/blob/main/CHANGELOG.md#swift-60

for full details of changes in 6.0.

https://lwn.net/Articles/990753/


Haiku R1/beta5 has been released

Version
R1/beta5 for the https://www.haiku-os.org/about/

project, an open-source "spiritual successor to https://en.wikipedia.org/wiki/BeOS
. Notable
changes in this release include a TUN/TAP network driver, basic
support for USB audio devices, TCP throughput improvements, a
rewritten driver for the FAT filesystem, read-only support for
Unix File System 2 (UFS2), as well as hundreds of bug fixes and
performance improvements since the https://www.haiku-os.org/get-haiku/r1beta4/
 in
December 2022. Thanks to Paul Wise for the tip.

https://lwn.net/Articles/990735/


[$] Kernel developers at Cauldron

A Linux system is made up of a large number of interdependent components,
all of which must support each other well.  It can thus be surprising that,
it seems, the developers working on those components do not often speak
with each other.  In the hope of improving that situation, efforts have
been made in recent years to attract toolchain developers to the
kernel-heavy Linux Plumbers Conference.  This year, though, the opposite
happened as well: the 2024
GNU Tools Cauldron hosted a discussion where kernel developers were
invited to discuss their needs.

https://lwn.net/Articles/990379/


LLVM 16.1.0 released

Version
16.1.0 of the LLVM compiler suite has been released:

This is the first release in the LLVM 19.x series and represents 6
months of work the LLVM community. During this period 1502 unique
authors contributed 18925 commits (3605729 lines added and 1665792
lines removed) to LLVM.

As usual, there is a long list of changes; see the release notes
for https://releases.llvm.org/19.1.0/docs/ReleaseNotes.html
,
https://releases.llvm.org/19.1.0/projects/libcxx/docs/ReleaseNotes.html
,
https://releases.llvm.org/19.1.0/tools/lld/docs/ReleaseNotes.html
,
https://releases.llvm.org/19.1.0/tools/clang/docs/ReleaseNotes.html
,
and Extra
Clang Tools for changes to each.

https://lwn.net/Articles/990706/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (pcs), Debian (expat, galera-4, libreoffice, mariadb-10.5, and php-twig), Fedora (chromium), Red Hat (ghostscript and git), SUSE (gstreamer-plugins-bad, gstreamer-plugins-bad, libvpl, python-dnspython, python3, and python36), and Ubuntu (expat, frr, libxmltok, linux-xilinx-zynqmp, openssl, and quagga).

https://lwn.net/Articles/990731/


[$] A discussion of Rust safety documentation

Kangrejos 2024 started off with a talk from Benno Lossin about his
https://lwn.net/Articles/982868/

to establish a standard for safety documentation in Rust kernel code. Lossin
began his talk by giving a brief review of what safety documentation is, and
why it's needed, before moving on to the current status of his work. Safety
documentation is easier to read and write when there's a shared vocabulary for
discussing common requirements; Lossin wants to establish that shared vocabulary
for Rust code in the Linux kernel.

https://lwn.net/Articles/990273/


Security proof for Linux's random number generator

Four researchers have https://eprint.iacr.org/2024/1421.pdf
 a formal proof that Linux's new deterministic random bit generator (DRBG) is secure in a particular sense — specifically, that the number of queries that would need to be made to it to uncover its internal state depends on the quality of the entropy it can collect from different sources. As long as it can gather enough entropy, it produces secure random numbers.

Since the significant structural changes in Linux 4 and Linux 5.17, there has
been no research on the provable security of Linux-DRBG. For the first time (to
the best of our knowledge), we formally model the Linux-DRBG in Linux 6.4.8
and prove its security in the seedless robustness model

Thanks to Jason Donenfeld for bringing the paper to our attention.

https://lwn.net/Articles/990596/


[$] An update on BPF generation from GCC

The generation of binary code for the kernel's BPF virtual machine has been
limited to the Clang compiler since the beginning; even developers who
use GCC to build kernels must use Clang to compile to BPF.  Work has
been underway for some years on adding a BPF backend to GCC as well; the
developers involved ran a session at the https://gcc.gnu.org/wiki/cauldron2024
 to
provide an update on that project.  It would seem that the BPF backend is
close to being ready for production use.

https://lwn.net/Articles/990343/


Security updates for Tuesday

Security updates have been issued by Debian (php-twig and pymongo), Fedora (linux-firmware, microcode_ctl, and python3.13), Mageia (clamav, microcode, postgresql13 and postgresql15, python3-webob, suricata, tcpreplay, tgt, and wireshark), Oracle (httpd, kernel, and linux-kernel), Red Hat (firefox, kernel, kernel-rt, pcs, and thunderbird), SUSE (389-ds, chromium, golang-github-prometheus-prometheus, htmldoc, kernel, SUSE Manager Client Tools, and wireshark), and Ubuntu (clamav, curl, dcmtk, dovecot, nginx, openssh, and python3.10, python3.12, python3.8).

https://lwn.net/Articles/990588/


Linux Foundation announces OpenSearch Software Foundation

The Linux Foundation has https://www.linuxfoundation.org/press/linux-foundation-announces-opensearch-software-foundation-to-foster-open-collaboration-in-search-and-analytics

the creation of the OpenSearch Software
Foundation as a vendor‑neutral home for the https://opensearch.org
 search and observability
software:

Established in 2021 and previously hosted by Amazon Web Services
(AWS), OpenSearch has recorded more than 700 million software
downloads and participation from thousands of contributors and more
than 200 project maintainers.

AWS https://aws.amazon.com/blogs/opensource/introducing-opensearch/

the OpenSearch project as an open-source fork of ElasticSearch and
Kibana in 2021 after Elastic moved those projects to
non-free licenses. Elastic https://lwn.net/Articles/987850/
 in August that it would
relicense the projects under the Affero GPL (AGPL).

https://lwn.net/Articles/990517/


[$] Fedora evicts WolfSSL

The Fedora
Engineering Steering Committee (FESCo) has voted to
immediately remove the https://www.wolfssl.com
 package from all of Fedora's
repositories due to its maintainer failing to gain approval to package
a new cryptography library for Fedora. Its brief travels through
Fedora's package system highlights gaps in documentation, as well as
in the package‑review process. The good news is that this may stir
Fedora to improve its documentation and revive a formal security
team.

https://lwn.net/Articles/989687/


Valkey 8.0.0 released

https://valkey.io/blog/valkey-8-ga/
 of
the https://valkey.io
 open-source in-memory data
store is now available. This is the first major release of Valkey
since the project https://lwn.net/Articles/966631/
 in March of this year:

While this is a major version, Valkey takes command set compatibility
seriously: Valkey 8.0.0 makes no backwards incompatible changes to the
existing command syntax or their responses. Your existing tools and
custom software will be able to immediately take advantage of Valkey
8.0.0. Since Valkey 8.0.0 does make some small changes to previously
undefined behaviors, it's wise to read
the release notes. Additionally, because this version makes changes in how the
software uses threading, you may want to re-evaluate your cluster's
infrastructure to achieve the highest performance.

https://lwn.net/Articles/990490/


[$] Some 6.11 development statistics

The 6.11 kernel was https://lwn.net/ml/all/CAHk-=whVpSHw9+4ov=oLevfv8sPYbh59T_9VKif-6Vqkr41jQA@mail.gmail.com/

on September 15 after a typical nine-week development cycle.  This
release integrates 13,890 non-merge changesets, so it was a moderately busy
cycle, slightly more so that 6.10 was.  With a new release comes a new round
of development statistics; read on for the details.

https://lwn.net/Articles/989528/


The 6.11 kernel has been released

Linus has https://lwn.net/Articles/990403/
.
"I'm once again on the road and not in my normal timezone, but it's
Sunday afternoon here in Vienna, and 6.11 is out."
Significant changes in this release include
new io_uring operations for bind() and listen(),
the https://lwn.net/Articles/978189/
 patches,
the https://lwn.net/Articles/866493/
 to write to busy executable
files,
support for writing block drivers in Rust,
support for https://lwn.net/Articles/974578/
 in the
block layer,
the https://lwn.net/Articles/965837/
,
the https://lwn.net/Articles/980447/
,
and more.  See the LWN merge-window summaries
(https://lwn.net/Articles/982034/
,
https://lwn.net/Articles/982605/
) for more information.

https://lwn.net/Articles/990307/


GNOME Foundation opens search for new Executive Director

The https://foundation.gnome.org

that it is looking for a new Executive Director following the https://lwn.net/Articles/981850/
 of Holly Million
in July:

As the cornerstone of our leadership team, the Executive Director will
play a critical role in shaping the strategic direction of the
Foundation, working closely with staff, community members, and
partners to expand our reach and impact. The ideal candidate will have
professional experience working with nonprofits, a strong passion for
open-source software, a deep commitment to our community values, and
the vision to drive the next phase of GNOME's growth and development.

The window of opportunity for the job is closing quickly,
applications are due by September 20.

https://lwn.net/Articles/990270/


Sovereign Tech Fund (STF) to invest in Samba improvements

Germany's Sovereign
Tech Fund (STF) has agreed to https://www.sovereigntechfund.de/tech/samba

to improve the security, stability, and functionality of https://www.samba.org/
. The investment will take
place over three years and will be managed by https://samba.plus/about-sernet
, a company that
employs several Samba core developers and offers support for
Samba. According to its https://samba.plus/blog/detail/sernet-secures-funding-for-samba-project-from-sovereign-tech-fund
,
work has already begun and is expected to complete in 2026:

The project's focus is on areas like transparent failover, SMB3 UNIX
extensions, and modern security protocols such as SMB over QUIC. These
improvements are designed to ensure that Samba remains a robust and
secure solution for organizations that rely on a sovereign IT
infrastructure that is as independent as possible of proprietary
software regimes, but including optimal interoperability.

https://lwn.net/Articles/990264/


Security updates for Friday

Security updates have been issued by Fedora (haproxy, osc, and python3.11), Oracle (389-ds:1.4), Red Hat (kernel), SUSE (clamav, colord, kernel, postgresql16, and qemu), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi, linux-azure, linux-azure-5.15, linux-azure-fde, linux-lowlatency-hwe-6.8, linux-nvidia-6.8, and linux-xilinx-zynqmp).

https://lwn.net/Articles/990202/


VirtualBox 7.1.0 released

Version
7.1.0 of the https://www.virtualbox.org/
 virtualization system has been
released. Changes include a major GUI update, a new Network Address
Translation (NAT) engine with IPv6 support, shared clipboard support on Wayland, and more.

https://lwn.net/Articles/990125/


[$] Debating ifupdown replacements for Debian trixie

Debian does not have an official way to configure
networking. Instead, it has https://wiki.debian.org/NetworkConfiguration

recommended ways to configure networking, one of which is the
venerable https://salsa.debian.org/debian/ifupdown
, which
has part of Debian since the turn of the century and is showing its
age. A conversation about its maintainability and possible replacement with https://github.com/ifupdown-ng/ifupdown-ng
 has
led to discussions about the default network-management tools for
Debian "https://www.debian.org/releases/trixie/
"
(Debian 13, which expected in 2025) and beyond. No route to consensus
has been found, yet.

https://lwn.net/Articles/989055/


New stable kernels released

Greg Kroah-Hartman has announced the release of seven new stable kernels:
https://lwn.net/Articles/990044/
.  As usual, they all contain lots of
important fixes throughout the kernel tree.

https://lwn.net/Articles/990043/


Security updates for Thursday

Security updates have been issued by Debian (chromium and redis), Fedora (nextcloud, python3.10, python3.13, python3.6, vim, and wolfssl), Mageia (expat, libpcap, and microcode), Oracle (dovecot, kernel, and kernel-container), Red Hat (kernel and krb5), SUSE (389-ds, colord, containerd, curl, expat, glib2, go1.22, go1.23, kernel, libpcap, postgresql16, and runc), and Ubuntu (expat, libxmltok, linux, linux-aws, linux-azure, linux-bluefield, linux-gcp, linux-gkeop, linux-ibm, linux-kvm, linux-oracle, linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oem-6.8, linux-oracle, linux-aws-5.4, linux-azure-5.4, linux-gcp-5.4, linux-hwe-5.4, linux-ibm-5.4, linux-oracle-5.4, linux-raspi-5.4, linux-azure, linux-iot, linux-nvidia, linux-nvidia-lowlatency, python-setuptools, setuptools, tiff, and unbound).

https://lwn.net/Articles/990040/


[$] LWN.net Weekly Edition for September 12, 2024

The LWN.net Weekly Edition for September 12, 2024 is available.

https://lwn.net/Articles/988984/


[$] A mess in the Python community

The Python community has been roiled, to a certain extent, by an action
taken by
the steering council (SC): the three-month suspension
of a unnamed—weirdly—Python core developer.  Tim Peters is the developer
in question, as he has https://www.theregister.com/2024/08/09/core_python_developer_suspended_coc/
,
though it could easily be deduced from the SC message. Peters has been
involved in the
project from its early days and, among many other things, is the author of
https://peps.python.org/pep-0020/
 ("The Zen of
Python").  The suspension was due to violations of the project's code of
conduct that stem from the discussion around a somewhat controversial set
of proposed changes to the bylaws for the https://www.python.org/psf-landing/

(PSF) back in mid-June.

https://lwn.net/Articles/988894/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (389-ds:1.4, dovecot, emacs, and glib2), Fedora (bluez, iwd, libell, linux-firmware, seamonkey, vim, and wireshark), Mageia (apr, libtiff, Nginx, openssl, orc, unbound, webmin, and zziplib), Red Hat (389-ds:1.4), and SUSE (containerd, curl, go1.22, go1.23, gstreamer-plugins-bad, kernel, ntpd-rs, python-Django, and python311).

https://lwn.net/Articles/989772/


Pandoc 3.4 released

Version
3.4 of the https://pandoc.org/

document-conversion tool has been released. Notable changes in this
release include a new ANSI output format (for console output), a https://github.com/jgm/pandoc/issues/10142
 as the PDF engine for
HTML to PDF conversion, the ability to position captions
above or below tables and figures, and much more.

https://lwn.net/Articles/989660/


[$] The trouble with iowait

CPU scheduling is a challenging job; since it inherently requires making
guesses about what the demands on the system will be in the future, it
remains reliant on heuristics, despite ongoing efforts to remove them.
Some of those heuristics take special note of tasks that are (or appear to
be) waiting for fast I/O operations.  There is some unhappiness, though,
with how this factor is used, leading to a couple of patches taking rather
different approaches to improve the situation.

https://lwn.net/Articles/989272/


Radicle 1.0 released

https://radicle.xyz/2024/09/10/radicle-1.0.html

of the Radicle development platform has been released.

	Radicle 1.0 represents the culmination of years of experimentation
	and hard work from our team and community, where we set out to
	ensure that free and open source software ecosystems can flourish
	without having to rely on the whims of Big Tech. We designed
	Radicle with a first-principles approach, as a natural extension to
	Git, expanding it to work in a collaborative, local-first,
	peer-to-peer setting.

LWN https://lwn.net/Articles/966869/
 in March.

https://lwn.net/Articles/989605/


Security updates for Tuesday

Security updates have been issued by Debian (cacti), Fedora (aardvark-dns, expat, and firefox), Mageia (ffmpeg, ntfs-3g, and vim), Oracle (emacs, glib2, java-11-openjdk, and qt5-qtbase), Red Hat (emacs, python-setuptools, python3.11, python3.11-setuptools, python3.12-setuptools, python3.9, and python39:3.9), Slackware (netatalk), SUSE (buildah, expat, java-1_8_0-ibm, kanidm, kernel, and postgresql16), and Ubuntu (netty, php7.0, php7.2, tiff, and webkit2gtk).

https://lwn.net/Articles/989602/


[$] Attracting and retaining Debian contributors

Many projects struggle with attracting and retaining contributors; Debian
is no different in that regard.  At https://debconf24.debconf.org/
, Carlos Henrique Lima
Melara and Lucas Kanashiro gave a presentation about efforts that the
Brazilian Debian community has made to increase participation.  Their ideas
and the lessons
learned can be applied more widely, both for other Debian communities and
for other projects.

https://lwn.net/Articles/987548/


Adams: Linux's bedtime routine

Jacob Adams wanders into
the kernel's hibernation code:

	How does Linux move from an awake machine to a hibernating one? How
	does it then manage to restore all state? These questions led me to
	read way too much C in trying to figure out how this particular
	hardware/software boundary is navigated.

https://lwn.net/Articles/989489/


Security updates for Monday

Security updates have been issued by Debian (amanda, aom, bluez, python-jwcrypto, and thunderbird), Fedora (chromium, firefox, and thunderbird), Red Hat (bubblewrap and flatpak, containernetworking-plugins, flatpak, and runc), Slackware (python3), SUSE (apache2, bubblewrap and flatpak, postgresql16, and wireshark), and Ubuntu (thunderbird).

https://lwn.net/Articles/989488/


Kernel prepatch 6.11-rc7

Linus has released https://lwn.net/Articles/989425/
 for testing.

	And I wish I could say that things have calmed down, but I can't
	really say that. In fact, rc7 is slightly bigger than both rc6 and
	rc5 were, both in number of commits, and in actual diff
	size. That's not really how it should work out.

	That said, there's nothing *scary* in here.

He is apparently "still waffling" about whether to release 6.11 next
weekend, which would cause the 6.12 merge window to land on top of the
Maintainers Summit, Linux Plumbers Conference, and Open Source Summit.

https://lwn.net/Articles/989426/


Three weekend stable kernels

The
https://lwn.net/Articles/989410/
,
https://lwn.net/Articles/989411/
, and
https://lwn.net/Articles/989412/

stable kernel updates have been released; each contains another set of
important fixes.

https://lwn.net/Articles/989409/


[$] Testing AI-enhanced reviews for Linux patches

Code review is in high demand, and short supply, for most open-source projects.
Reviewer time is precious, so any tool that can lighten the load is worth exploring.
That is why Jesse Brandeburg and Kamel Ayari decided to test whether
tools like ChatGPT could review patches to provide quick feedback to
contributors about common problems. In a
talk at the Netdev
0x18 conference this July, Brandeburg provided an overview of an
experiment using machine learning to review emails containing patches
sent to the https://www.kernel.org/doc/html/v5.6/networking/netdev-FAQ.html

mailing list. Large-language models (LLMs) will not be replacing human reviewers anytime
soon, but they may be a useful addition to help humans focus on deeper
reviews instead of simple rule violations.

https://lwn.net/Articles/987319/


Man pages maintenance suspended

Alejandro Colomar, who has been maintaining the Linux man pages for the
last four years, has https://lwn.net/ml/all/4d7tq6a7febsoru3wjium4ekttuw2ouocv6jstdkthnacmzr6x@f2zfbe5hs7h5

that he will have to stop that work.

	 I've been doing it in my free time, and no company has sponsored
	 that work at all.  At the moment, I cannot sustain this work
	 economically any more, and will temporarily and indefinitely stop
	 working on this project.  If any company has interests in the
	 future of the project, I'd welcome an offer to sponsor my work
	 here; if so, please let me know.

https://lwn.net/Articles/989215/


The realtime preemption end game — for real this time

Work on realtime preemption for the Linux kernel https://lwn.net/Articles/106010/
 almost exactly 20 years ago
(though it had its roots in earlier work, of course).  It is fair to say
that finishing that job has taken a bit longer than anybody involved would
have expected.  Now, though, Sebastian Andrzej Siewior has posted a brief
patch series making it possible to enable realtime preemption in the
mainline kernel on three architectures.

	With the printk bits merged, PREEMPT_RT could be enabled on X86,
	ARM64 and Risc-V. These three architectures merged required changes
	over the years leaving me in a position where I have no essential
	changes in the queue that would affect them.

Congratulations are due to the many developers who have worked on this
project for the last two decades.

https://lwn.net/Articles/989212/


Rust 1.81.0 released

Version
1.81.0 of the Rust language has been released.  Changes include the
stabilization of the Error trait in core, some new sort
algorithms, some linting improvements, and more.

https://lwn.net/Articles/989106/


[$] Application monitoring with OpenSnitch

https://github.com/evilsocket/opensnitch
 is an
"interactive application firewall". Like other firewalls, it uses a
series of rules to decide what network traffic should be permitted. Unlike
many other firewalls, though, OpenSnitch does not ask the user to create a list of rules
ahead of time. Instead, the list of rules can be built up
incrementally as applications make connections — and the user can peruse both
the rules that have built up over time, and statistics on the connections that
have been attempted.

https://lwn.net/Articles/988401/


Samba 4.21.0 released

Version 4.21.0 of the Samba Windows interoperability suite has been
released.  Changes include some authentication hardening, a number of LDAP
improvements, per-user and per-group veto and hide files, group-managed
service accounts, and quite a bit more.

https://lwn.net/Articles/989047/


Security updates for Thursday

Security updates have been issued by AlmaLinux (bubblewrap and flatpak, containernetworking-plugins, fence-agents, ghostscript, krb5, orc, podman, python3.11, python3.9, resource-agents, runc, and wget), Debian (chromium, cinder, glance, gnutls28, nova, nsis, python-oslo.utils, ruby-sinatra, and setuptools), Fedora (kernel), Oracle (bubblewrap and flatpak, buildah, containernetworking-plugins, fence-agents, ghostscript, gvisor-tap-vsock, kernel, krb5, libndp, nodejs:18, orc, podman, postgresql, python-urllib3, python3.11, python3.12, python3.9, runc, skopeo, and wget), SUSE (hdf5, netcdf, trilinos), and Ubuntu (firefox, imagemagick, ironic, openssl, python-django, vim, and znc).

https://lwn.net/Articles/989046/


Call for candidates for the 2024 Linux Foundation TAB election

The https://lwn.net/ml/all/87zforv3zc.fsf@trenco.lwn.net

has gone out for the 2024 election of members of the Linux Foundation
Technical Advisory Board:

	The TAB exists to provide advice from the kernel community to the
	Linux Foundation and holds a seat on the LF's board of directors;
	it also serves to facilitate interactions both within the community
	and with outside entities.  Over the last year, the TAB has
	overseen the organization of the Linux Plumbers Conference, advised
	on the setup of the kernel CVE numbering authority, worked behind
	the scenes to help resolve a number of contentious community
	discussions, worked with the Linux Foundation on community
	conference planning, and more.

Nominations are due by September 20.

https://lwn.net/Articles/988862/


Tellico 4.0 released

https://tellico-project.org/tellico-4-0-released/
 collection management
software has been released. This is the first release to use the
KDE Frameworks 6 and Qt6 libraries, with a fallback
available for Frameworks 5 and Qt5. Other notable changes in 4.0
include importing video collections from file metadata and correctly
importing multi-disc album data from https://www.discogs.com/
. Users
of prior versions are advised to make a backup of their data before upgrading.

https://lwn.net/Articles/988837/


[$] Whither the Apple AGX graphics driver?

Much of the early Rust code for the kernel has taken the form of
reimplementations of existing drivers as a proof of concept.  One project,
though, is entirely new: the driver for Apple GPUs written by Asahi Lina.
This driver has shipped with Asahi
Linux for some time and, by many accounts, is stable, usable, and a
shining example of how Rust can be used in a complex kernel subsystem.
That driver remains outside of the mainline kernel, though, and merging
currently looks like a distant prospect.  The reasons for that state of
affairs highlight some of the difficulties inherent in integrating a new
language (and its associated development style) into the Linux kernel.

https://lwn.net/Articles/988438/


Seven stable kernel updates for Wednesday

The https://lwn.net/Articles/988748/
 stable kernel updates have all
been released. As usual, they contain important fixes throughout the
tree. Users of those kernels should upgrade.

https://lwn.net/Articles/988747/


Security updates for Wednesday

Security updates have been issued by AlmaLinux (buildah, gvisor-tap-vsock, nodejs:18, python-urllib3, and skopeo), Debian (firefox-esr and openssl), Fedora (apr and seamonkey), Red Hat (podman), Slackware (mozilla and seamonkey), SUSE (bubblewrap and flatpak, buildah, docker, dovecot23, ffmpeg, frr, go1.21-openssl, graphviz, java-1_8_0-openj9, kubernetes1.26, kubernetes1.27, kubernetes1.28, openssl-1_0_0, openssl-3, perl-DBI, python-aiohttp, python-Django, python-WebOb, thunderbird, tiff, ucode-intel, unbound, webkit2gtk3, and xen), and Ubuntu (drupal7 and twisted).

https://lwn.net/Articles/988746/


Firefox 130.0 released

Version
130.0 of the Firefox browser has been released. Notable in this
release is the addition of a Firefox Labs tab in Firefox
Settings. This allows users to easily enable experimental features,
such as the ability to translate selected text portions to different
languages after a full-page translation, and add
an AI chatbot to the sidebar. Firefox 130 also addresses several
security issues, adds 11 new languages to its translation support,
and more.

https://lwn.net/Articles/988607/


[$] Transcribing audio with AI using Speech Note

One of the joys of writing about technology is the opportunity to
cover interesting talks on open‑source and free‑software topics. One
of the pains is creating transcriptions of said talks, or continually
referring back to a recording, to be able to write about
them. https://github.com/mkiol/dsnote
 is an
open-source application that uses machine-learning models, running locally, to
translate speech to text and take the pain out of transcription. It
also handles text to speech, and language translations. While not
perfect, its transcriptions are better than one might expect, even when
handling jargon, accents, and less-than-perfect audio.

https://lwn.net/Articles/987315/


Security updates for Tuesday

Security updates have been issued by AlmaLinux (python3.12), Debian (calibre, exfatprogs, frr, git, libtommath, nbconvert, ruby-nokogiri, ruby-tzinfo, and webkit2gtk), Fedora (flatpak, lua-mpack, and python3.12), Red Hat (389-ds-base, 389-ds:1.4, buildah, fence-agents, gvisor-tap-vsock, httpd:2.4, kernel, kernel-rt, nodejs:18, orc, postgresql, postgresql:12, postgresql:13, postgresql:15, python-urllib3, python3.12, and skopeo), SUSE (389-ds, bubblewrap and flatpak, cacti, cacti-spine, curl, glib2, kernel-firmware, libqt5-qt3d, libqt5-qtquick3d, opera, python39, qemu, unbound, xen, and zziplib), and Ubuntu (ffmpeg, linux-raspi-5.4, and python-webob).

https://lwn.net/Articles/988570/


[$] Advances in font technology and GTK text rendering

At this year's https://events.gnome.org/event/209/
 in Denver, Colorado, Behdad Esfahbod and Matthias Clasen
presented a https://events.gnome.org/event/209/contributions/749/
 on a topic that's deeply important to desktop
environments: fonts. Esfahbod covered advances in font
technology that are making their way to becoming standards, and Clasen briefly
discussed improvements in GTK text rendering. The talk presented some
fascinating insights into the problems around accurately rendering
writing systems on the desktop, and where font technologies may be
going in the near future.

https://lwn.net/Articles/987176/


Security updates for Monday

Security updates have been issued by AlmaLinux (postgresql:16), Debian (dovecot, pymatgen, ruby2.7, systemd, and webkit2gtk), Fedora (microcode_ctl, python3.11, vim, and xen), Oracle (kernel, postgresql:12, postgresql:13, postgresql:15, and python39:3.9 and python39-devel:3.9), Slackware (libpcap), SUSE (cacti, cacti-spine, python-Django, and trivy), and Ubuntu (dovecot).

https://lwn.net/Articles/988364/


Kernel prepatch 6.11-rc6

Linus has released https://lwn.net/Articles/988183/
 for testing.
"Things look pretty normal, although we have perhaps unusually many
filesystem fixes here, spread out over smb, xfs, bcachefs and netfs."

https://lwn.net/Articles/988184/


Understanding the Postgres Hackers Mailing List Language

Reading an established open-source project's developer mailing list
may leave new contributors wishing they had a decoder ring. Greg
Sabino Mullane has written up a valuable https://www.crunchydata.com/blog/understanding-the-postgres-hackers-mailing-list

for those new to the PostgreSQL hackers (https://www.postgresql.org/list/pgsql-hackers/
)
mailing list that may also be useful for decoding other lists as well:

The mailing lists are full of acronyms and jargon that might not be
familiar to younger people who did not grow up on email (although text
messages have inherited many of the abbreviations). If you are a
non-native English speaker, or under the age of 30, or not steeped in
the world of tech, I offer some solutions below.

To do this, I downloaded the last year's worth of hackers email,
wrote a program to strip out all the non-human stuff (headers, code
blocks, attachments, etc.), and then did some data analysis on the
results.

https://lwn.net/Articles/987892/


[$] A SpamAssassin surprise

Here is a piece of advice for anybody wanting an easy and frustration-free
life: do not run your own email system.  While there numerous advantages to
keeping some control over your communications, there is also a long list of
things that can go wrong.  A recent failure of spam filtering on the LWN
email system illustrated one of those ways, as well as shining a light on
how even a seemingly independent email system is tied to other services
across the net.

https://lwn.net/Articles/987566/


ElasticSearch and Kibana become free software (again)

Back in 2021, the ElasticSearch search engine and Kibana visualization
platform https://lwn.net/Articles/843274/
 under the non-free
Server Side Public License (SSPL).  Now, Elastic (the company owning those
projects) has https://www.elastic.co/blog/elasticsearch-is-open-source-again

that those projects will also be distributable under the Affero GPL license.

	We never stopped believing and behaving like an open source
	community after we changed the license. But being able to use the
	term Open Source, by using AGPL, an OSI approved license, removes
	any questions, or fud, people might have.

https://lwn.net/Articles/987850/


Airlie: On Rust, Linux, developers, maintainers

Dave Airlie makes
an analogy between the stages of road building and those of adding Rust
to the Linux kernel.

	For the wayfinders the process of interacting with maintainers is
	frustrating and slow, and they don't enjoy it as much as
	wayfinding, and because they still only care about the hotel at the
	end, when a maintainer gets into the details of their particular
	intersection they don't want to do anything but go stay in their
	hotel.

	The road will get built, it will get traffic on it. There will be
	tunnels where we should have intersections, there will be bridges
	that need to be built from both sides, but I do think it will get
	built.

https://lwn.net/Articles/987849/


Security updates for Friday

Security updates have been issued by AlmaLinux (libvpx, postgresql, postgresql:12, postgresql:13, postgresql:15, and python39:3.9 and python39-devel:3.9), Debian (chromium and ghostscript), Fedora (python3.13), and SUSE (chromium and podman).

https://lwn.net/Articles/987836/


GNU Screen v.5.0.0 is released

Version 5.0.0 of https://www.gnu.org/software/screen/
 has
been released. Notable changes in this release include
new commands for authentication, input into multiple windows at the
same time, and to turn on/off truecolor support.

https://lwn.net/Articles/987700/


Three new stable kernels

Greg Kroah-Hartman has announced the release of the https://lwn.net/Articles/987678/
 stable kernels.  They all contain
important fixes throughout the kernel tree, as is the norm.

https://lwn.net/Articles/987677/


[$] Plasma Mobile for highly configurable Linux phones

https://plasma-mobile.org
 is an open-source
user interface for mobile devices, developed by the KDE community. It's
built on the same foundations as https://kde.org/plasma-desktop/
 window
manager. Much like its desktop counterpart, Plasma Mobile caters to
advanced users by offering extensive customizability. It is offered as an
option on phones with various mobile Linux
distributions.

https://lwn.net/Articles/986899/


Security updates for Thursday

Security updates have been issued by AlmaLinux (bind and bind-dyndb-ldap and postgresql:16), Fedora (less and python3.6), Mageia (nodejs & yarnpkg), Oracle (libvpx and postgresql:16), Red Hat (edk2, git, kernel, openldap, postgresql:15, postgresql:16, python3, and python39:3.9 and python39-devel:3.9), SUSE (apache2, python-setuptools, and python3-setuptools), and Ubuntu (linux-oracle).

https://lwn.net/Articles/987664/


Rust-for-Linux Wedson Almeida Filho drops out

Wedson Almeida Filho, one of the key developers driving the https://rust-for-linux.com/
, has retired from the
project.

	 After almost 4 years, I find myself lacking the energy and
	 enthusiasm I once had to respond to some of the nontechnical
	 nonsense, so it's best to leave it up to those who still have it
	 in them.

As an example of the sort of "nonsense" he referred to, he provided https://youtu.be/WiPp9YEBV0Q?t=1529
 from the
https://lwn.net/Articles/978738/
 at the 2024
Linux Storage, Filesystem, Memory-Management, and BPF Summit.  His work was
fundamental to getting the project as far as it has come; he will be missed.

https://lwn.net/Articles/987635/


[$] LWN.net Weekly Edition for August 29, 2024

The LWN.net Weekly Edition for August 29, 2024 is available.

https://lwn.net/Articles/986853/


Judge dismisses majority of GitHub Copilot copyright claims (Developer)

Developer https://www.developer-tech.com/news/judge-dismisses-majority-github-copilot-copyright-claims/

that most (but not all) of the claims in the GitHub Copilot lawsuit have
been dismissed with prejudice by the judge.

	Judge Jon Tigar's ruling, unsealed last week, leaves only two
	claims standing: one accusing the companies of an open-source
	license violation and another alleging breach of contract. This
	decision marks a substantial setback for the developers who argued
	that GitHub Copilot, which uses OpenAI's technology and is owned by
	Microsoft, unlawfully trained on their work.

https://lwn.net/Articles/987524/


Security updates for Wednesday

Security updates have been issued by Fedora (calibre, dotnet8.0, dovecot, webkit2gtk4.0, and webkitgtk), Oracle (nodejs:20), Red Hat (bind, bind and bind-dyndb-ldap, postgresql:16, and squid), Slackware (kcron and plasma), SUSE (keepalived and webkit2gtk3), and Ubuntu (drupal7).

https://lwn.net/Articles/987519/


WineHQ to take over Mono

The Mono project was started in 2001 to develop a .NET environment for
Linux systems.  Microsoft has owned that project since 2016, but has not
made a major release since 2019.  The company has now https://www.mono-project.com/
 that Mono is being
handed over to the WineHQ organization, which will maintain https://gitlab.winehq.org/wine-mono/mono
 going
forward.  Microsoft, meanwhile, is steering users toward its "modern
fork" that it continues to maintain.

https://lwn.net/Articles/987465/


Calligra Office 4.0 released

KDE developer Carl Schwan has https://carlschwan.eu/2024/08/27/calligra-office-4.0-is-out/

the release of https://calligra.org/

version 4.0. The most significant changes in this release include a "major
overhaul" of the office suite's user interface, and a transition to https://en.wikipedia.org/wiki/Qt_(software)
.

https://lwn.net/Articles/987414/


Call for nominations: Ubuntu Community Council

Nominations are now
open for people interested in joining the Ubuntu
Community Council, "the highest governance body of the Ubuntu
project". Any https://ubuntu.com/community/membership
 can
apply from now until Sunday, September 22 at 23:59 UTC.

The Ubuntu project turned 20 this year, but is still in constant
flux. The advent of new communication platforms, new projects under
our umbrella, and the ever-growing popularity of the project requires
our community to evolve. We need to make sure Ubuntu is set to tackle
the challenges of the next 20 years. It needs a strong and active
community council to guide the project forwards.

See Merlijn Sebrechts's blog
post, "A year in the Ubuntu community council", for an overview of
what it's like to serve on the council.

https://lwn.net/Articles/987406/


[$] NIST finalizes post-quantum encryption standards

On August 13, the US National Institute of Standards and Technology (NIST)

published the final form of its new post-quantum cryptographic standards. One
key-exchange mechanism and two digital-signature schemes are now officially
sanctioned by the institute. Adopting the new standards should be fairly
painless for most developers, but the overhead added by the schemes could pose
challenges for some applications.

https://lwn.net/Articles/973231/


Security updates for Tuesday

Security updates have been issued by AlmaLinux (nodejs:20), Debian (python3.11), Fedora (dotnet8.0), Red Hat (bind, krb5, libreoffice, linux-firmware, orc, orc:0.4.28, and orc:0.4.31), SUSE (mariadb and openssl-3), and Ubuntu (linux-aws-5.4).

https://lwn.net/Articles/987393/


Sovereign Tech Fund (STF) to invest in FreeBSD infrastructure modernization

The https://freebsdfoundation.org/
 has announced that Germany's Sovereign Tech
Fund (STF) has agreed to invest €686,400 toward improvements in the
https://www.freebsd.org/
 project's infrastructure, security, regulatory compliance, and
developer experience:

The work commissioned by STF also aligns closely with the recent
August
9, 2024 summary report released by the U.S. Office of the
National Cyber Director (ONCD), consolidating feedback from the 2023
request for information on key priorities for securing the open source
software ecosystem. By enhancing security controls and SBOM tooling,
the FreeBSD Foundation is helping to keep FreeBSD at the forefront of
improved vulnerability disclosure mechanisms and secure software
foundations.

https://lwn.net/Articles/987311/