Odprtokodni pogled

Opensource view

LWN.net

Syndicate content
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
Posodobljeno: 18 min 3 sec nazaj

[$] A modest update to Qubes OS

Tor, 02/20/2024 - 19:58

Qubes OS is a security-focused desktop Linux distribution built on Fedora Linux and the Xen hypervisor. Qubes uses virtualization to run applications, system services, and devices access via virtual machines called "qubes" that have varying levels of trust and persistence to provide an open-source "reasonably secure" operating system with "serious privacy". The Qubes 4.2.0 release, from December 2023, brings a number of refinements to make Qubes OS easier to manage and use.

Righi: Writing a scheduler for Linux in Rust that runs in user-space

Tor, 02/20/2024 - 15:32
Andrea Righi has started a blog series on writing a user-space CPU scheduler with the BPF-based extensible scheduler class:

.select_cpu() implements the logic to assign a target CPU to a task that wants to run, typically you have to decide if you want to keep the task on the same CPU or if it needs to be migrated to a different one (for example if the current CPU is busy); if we can find an idle CPU at this stage there's no reason to call the scheduler, the task can be immediately dispatched here.

Hare programming language 0.24.0 released

Tor, 02/20/2024 - 15:13

Drew DeVault announced the first numbered release of the Hare programming language on February 16.

Many Hare users want to ship their Hare projects to users, and as such, software written in Hare is making its way into Linux distributions and the like. However, due to Hare's unstable nature, we have not provided any versioned releases, forcing any distributions who want to package Hare to package Hare's master branch, which is less than ideal.

Security updates for Tuesday

Tor, 02/20/2024 - 14:42
Security updates have been issued by Fedora (freeglut, hugin, libmodsecurity, qemu, rust-asyncgit, rust-bat, rust-cargo-c, rust-eza, rust-git-absorb, rust-git-delta, rust-git2, rust-gitui, rust-libgit2-sys, rust-lsd, rust-pore, rust-pretty-git-prompt, rust-shadow-rs, rust-silver, rust-tokei, and rust-vergen), Mageia (packages, radare2, ruby-rack, and wireshark), Oracle (.NET 8.0 and python-pillow), Red Hat (gimp:2.8, java-1.8.0-ibm, and kpatch-patch), SUSE (dpdk and opera), and Ubuntu (bind9, curl, linux-raspi, linux-raspi-5.4, node-ip, and tiff).

[$] A Spritely distributed-computing library

Pon, 02/19/2024 - 18:34

Spritely is a project seeking to build a platform for sovereign distributed applications — applications where users run their own nodes in order to control their own data — as the basis of a new social internet. While there are many such existing projects, Spritely takes an unusual approach based on a new interoperable protocol for efficient, secure remote procedure calls (RPC). The project is in its early stages, with many additional features planned, but it is already possible to play around with Goblins, the distributed actor library that Spritely intends to build on.

Security updates for Monday

Pon, 02/19/2024 - 15:00
Security updates have been issued by Debian (engrampa, openvswitch, pdns-recursor, and runc), Fedora (caddy, expat, freerdp, libgit2, libgit2_1.6, mbedtls, python-cryptography, qt5-qtbase, and sudo), Gentoo (Apache Log4j, Chromium, Google Chrome, Microsoft Edge, CUPS, e2fsprogs, Exim, firefox, Glade, GNU Tar, intel-microcode, libcaca, QtNetwork, QtWebEngine, Samba, Seamonkey, TACACS+, Thunar, and thunderbird), Mageia (dnsmasq, unbound, and vim), Oracle (container-tools:4.0, container-tools:ol8, dotnet6.0, dotnet7.0, kernel, nss, openssh, and sudo), Red Hat (python-pillow), and SUSE (bitcoin, dpdk, libssh, openvswitch, postgresql12, and postgresql13).

Kernel prepatch 6.8-rc5

Ned, 02/18/2024 - 22:35
The 6.8-rc5 kernel prepatch is out for testing. "Absolutely nothing stands out here, although I do wish things should have calmed down a bit more at this point in the release process."

Exploring Agama's 2024 roadmap (openSUSE News)

Pet, 02/16/2024 - 21:42

The openSUSE News blog looks at the roadmap for Agama (a new installer from the YaST development team) with releases planned for April and July:

The milestone in April is set to revolutionize Agama’s architecture. It will be moving away from its reliance on Cockpit toward a more autonomous framework that is coupled with a refined user interface that aims to streamline storage configurations.

The aim of the second milestone is to improve Agama’s flexibility and capabilities for unattended installations, which seeks to position Agama as a formidable alternative to AutoYaST.

The Agama page explains why YaST is due for replacement.

Stable kernels 6.7.5, 6.6.17, and 6.1.78

Pet, 02/16/2024 - 19:50
Greg Kroah-Hartman has announced the release of the 6.7.5, 6.6.17, and 6.1.78 stable kernels. As is the norm, they contain important fixes throughout the kernel tree. So far, there are no new CVEs reported on the linux-cve-announce mailing list, which means that the new kernel CVE numbering authority (CNA) powers have not yet been used.

[$] Windows NT synchronization primitives for Linux

Pet, 02/16/2024 - 17:14
The futex mechanism provided by the kernel allows for the creation of efficient and flexible locking primitives in user space. Futexes work well for many applications, but not all. One of the exceptions, it seems, is that perennially difficult-to-support use case: Windows games. With this patch series, Elizabeth Figura seeks to provide the sort of locking that those games need, by way of a special-purpose virtual device.

Security updates for Friday

Pet, 02/16/2024 - 15:24
Security updates have been issued by Mageia (bind), Red Hat (.NET 8.0 and kpatch-patch), SUSE (golang-github-prometheus-alertmanager, java-1_8_0-openj9, kernel, libaom, openssl-3, postgresql15, salt, SUSE Manager Client Tools, SUSE Manager Server 4.3, and webkit2gtk3), and Ubuntu (shadow).

[$] Open-source AI at FOSDEM

Čet, 02/15/2024 - 18:33
At FOSDEM 2024 in Brussels, the AI and Machine Learning devroom hosted several talks about open-source AI models. With talks about a definition of open-source AI, "ethical" restrictions in licenses, and the importance of open data sets, in particular for non-English languages, the devroom provided an overview of the current state of the domain.

Security updates for Thursday

Čet, 02/15/2024 - 14:47
Security updates have been issued by Debian (edk2, postgresql-13, and postgresql-15), Fedora (engrampa, vim, and xen), Mageia (mbedtls and quictls), Oracle (nss, openssh, and tcpdump), Red Hat (.NET 8.0), SUSE (hugin, kernel, pdns-recursor, python3, tomcat, and tomcat10), and Ubuntu (clamav, edk2, linux-gcp-6.2, linux-intel-iotg-5.15, linux-oem-6.1, and ujson).

[$] LWN.net Weekly Edition for February 15, 2024

Čet, 02/15/2024 - 01:44
The LWN.net Weekly Edition for February 15, 2024 is available.

LineageOS 21 released

Čet, 02/15/2024 - 00:03
Version 21 of LineageOS, an Android-based distribution, has been released.

With all that said, we have been working extremely hard since Android 14’s release last October to port our features to this new version of Android. Thanks to our hard work adapting to Google’s largely UI-based changes in Android 12/13, and Android 14’s dead-simple device bring-up requirements, we were able to rebase our changes onto Android 14 much more efficiently.

This lets us spend some much overdue time on our apps suite! Applications such as Aperture had their features and UX improved significantly, while many of our aging apps such as Jelly, Dialer, Contacts, Messaging, LatinIME (Keyboard), and Calculator got near full redesigns that bring them into the Material You era!

The Ubuntu community mourns the loss of Gunnar Hjalmarsson

Sre, 02/14/2024 - 20:52

The Ubuntu Weekly Newsletter carries the sad news that long-time contributor Gunnar Hjalmarsson has passed away. Gunnar has been a steadfast contributor to Ubuntu and Debian for well over a decade. His work around translation and localization efforts has helped enable people from around the world to use and enjoy the software that we all love. It goes without saying that people like Gunnar are the foundation of our community, and his passing is a tremendous loss.

[$] KDE Plasma X11 support gets a reprieve for Fedora 40

Sre, 02/14/2024 - 20:06

The Fedora Project is working toward the release of Fedora Linux 40, and (as with each release) that means changes to the way the project works and the software included in its repositories. Most of the changes set for Fedora 40 are uncontroversial, but one change is causing quite a stir. The KDE Special Interest Group's (SIG) proposal to adopt KDE Plasma 6 with only Wayland session support, which it interpreted as a mandate to block any X11 packages for Plasma. Others saw it as overreach by the SIG, and an attempt to block users and contributors from maintaining software they needed.

[$] A turning point for CVE numbers

Sre, 02/14/2024 - 18:05
The Common Vulnerabilities and Exposures (CVE) system was set up in 1999 as a way to refer unambiguously to known vulnerabilities in software. That system has found itself under increasing strain over the years, and numerous projects have responded by trying to assert greater control over how CVE numbers are assigned for their code. On February 13, though, a big shoe dropped when the Linux kernel project announced that it, too, was taking control of CVE-number assignments. As is often the case, though, the kernel developers are taking a different approach to vulnerabilities, with possible implications for the CVE system as a whole.

Security updates for Wednesday

Sre, 02/14/2024 - 15:09
Security updates have been issued by Debian (bind9 and unbound), Fedora (clamav, firecracker, libkrun, rust-event-manager, rust-kvm-bindings, rust-kvm-ioctls, rust-linux-loader, rust-userfaultfd, rust-versionize, rust-vhost, rust-vhost-user-backend, rust-virtio-queue, rust-vm-memory, rust-vm-superio, rust-vmm-sys-util, and virtiofsd), Red Hat (.NET 6.0, dotnet6.0, and dotnet7.0), Slackware (bind and dnsmasq), and Ubuntu (dotnet6, dotnet7, dotnet8, linux-lowlatency, linux-raspi, linux-nvidia-6.2, and ujson).

The kernel becomes its own CNA

Tor, 02/13/2024 - 20:13
Greg Kroah-Hartman has announced that the kernel project has been accepted as a CVE numbering authority (CNA). The way that CVE numbers will be handled by the kernel is described in this documentation patch:

As part of the normal stable release process, kernel changes that are potentially security issues are identified by the developers responsible for CVE number assignments and have CVE numbers automatically assigned to them. These assignments are published on the linux-cve mailing list as announcements on a frequent basis.

Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team are overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team.

sfy39587f05