Re: bundled libraries

2020-12-23 Thread Didier Fabert
Hi, Yes the guidelines are clear for fedora. I miss tell that the package is present in fedora and epel repos and my question is more like this: Is it possible to mix bundled/system libs ? like using system libs (the must part in guidelines) for fedora packages and use bundled one for epel

Re: Stale proven packagers

2020-12-23 Thread Dridi Boukelmoune
> The weakest point in the current system is really the FAS password. If > you have a packager's FAS password you can change the ssh key > associated with the account to another that you control, and the FAS > password is also all you need to run a build and submit it to Bodhi. Or you add an SSH

[389-devel] 389 DS nightly 2020-12-24 - 93% PASS

2020-12-23 Thread vashirov
https://fedorapeople.org/groups/389ds/ci/nightly/2020/12/24/report-389-ds-base-1.4.4.9-1.fc33.x86_64.html ___ 389-devel mailing list -- 389-devel@lists.fedoraproject.org To unsubscribe send an email to 389-devel-le...@lists.fedoraproject.org Fedora Code

[EPEL-devel] Fedora EPEL 7 updates-testing report

2020-12-23 Thread updates
The following Fedora EPEL 7 Security updates need testing: Age URL 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-bc6881c4f5 pngcheck-2.4.0-5.el7 7 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-dddcb59a9c phpldapadmin-1.2.5-1.el7 7

[Bug 1910212] perl-Tk-GraphViz-1.09 is available

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1910212 --- Comment #4 from Upstream Release Monitoring --- An unexpected error occurred while creating the scratch build and has been automatically reported. Sorry! -- You are receiving this mail because: You are on the CC list for the bug.

[Bug 1910212] perl-Tk-GraphViz-1.09 is available

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1910212 Upstream Release Monitoring changed: What|Removed |Added Summary|perl-Tk-GraphViz-1.08 is|perl-Tk-GraphViz-1.09 is

[EPEL-devel] Fedora EPEL 8 updates-testing report

2020-12-23 Thread updates
The following Fedora EPEL 8 Security updates need testing: Age URL 9 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-c82583d07e pngcheck-2.4.0-5.el8 8 https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2020-fe42686452 mbedtls-2.16.9-1.el8 The following builds have been

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 --- Comment #9 from Doran Moppert --- Note this vulnerability affects the php Archive_Tar package, not the perl package with the same name. Archive_Tar is included in Fedora and Red Hat Enterprise Linux bundled in the php-pear package. --

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 Doran Moppert changed: What|Removed |Added Depends On||1910452, 1910451, 1910454,

Re: Fedora 34 Change: Enable spec file preprocessing (System-Wide Change proposal)

2020-12-23 Thread clime
On Fri, 18 Dec 2020 at 17:03, clime wrote: > > On Fri, 18 Dec 2020 at 16:23, James Szinger wrote: > > > > On Fri, 18 Dec 2020 00:51:49 +0100 > > clime wrote: > > > > > Well, the users here are still packagers here no? I thought the "User" > > > in the title means "end user" who shouldn't be

Re: Fedora 34 Change: DNF/RPM Copy on Write enablement for all variants (System-Wide Change)

2020-12-23 Thread James Cassell
On Mon, Dec 21, 2020, at 11:28 AM, Ben Cotton wrote: > https://fedoraproject.org/wiki/Changes/RPMCoW > > > == Summary == > > RPM Copy on Write provides a better experience for Fedora Users as it > reduces the amount of I/O and offsets CPU cost of package > decompression. RPM Copy on Write uses

Re: Fedora 34 Change: DNF/RPM Copy on Write enablement for all variants (System-Wide Change)

2020-12-23 Thread Chris Murphy
On Mon, Dec 21, 2020 at 10:49 AM Colin Walters wrote: > > > > On Mon, Dec 21, 2020, at 11:28 AM, Ben Cotton wrote: > > ## Regular RPMs use a compressed .cpio based payload. In contrast, > > extent based RPMs contain uncompressed data aligned to the fundamental > > page size of the architecture,

Re: Stale proven packagers

2020-12-23 Thread Gary Buhrmaster
On Wed, Dec 23, 2020 at 8:43 PM Matthew Miller wrote: > I'm not in favor of that -- I think it's generally not the best policy Correct, that is what FIDO2 biometrics are designed to replace entirely. Passwords, in general, must die. > and doesn't address the issue directly. Agreed, as was

Release 5.6.1 of Sundials

2020-12-23 Thread Antonio T. sagitter
Hi all. Next release of Sundials will be the 5.6.1: https://github.com/LLNL/sundials/releases/tag/v5.6.1 (Included changes of the 5.6.0 [1]) I'll update Sundials in Rawhide after the New Years'Day [1] https://github.com/LLNL/sundials/releases/tag/v5.6.0 -- --- Antonio Trande Fedora Project

Re: Stale proven packagers

2020-12-23 Thread Matthew Miller
On Wed, Dec 23, 2020 at 12:06:25PM -0800, Michel Alexandre Salim wrote: > Maybe mandatory password/key rotation is an option? With your account > disabled after a grace period if the password is expired. I'm not in favor of that -- I think it's generally not the best policy¹ and doesn't address

Re: Stale proven packagers

2020-12-23 Thread Michel Alexandre Salim
On Wed, 2020-12-23 at 00:49 +, Peter Robinson wrote: > On Wed, Dec 23, 2020 at 12:37 AM Peter Robinson > wrote: > > > > On Wed, Dec 23, 2020 at 12:20 AM Kevin Fenzi > > wrote: > > > > > > On Tue, Dec 22, 2020 at 11:22:17PM +, Peter Robinson wrote: > > > > On Tue, Dec 22, 2020 at 11:02

Re: Stale proven packagers

2020-12-23 Thread Adam Williamson
On Wed, 2020-12-23 at 18:04 +0100, Florian Weimer wrote: > * Gary Buhrmaster: > > > It does support it, but AFAIK does not require it. > > > > Arguably those with elevated access (provenpackagers(*)) > > should be required to use a hardware token such > > as a FIDO2 authenticators with

Re: Non-responsive maintainer check for slaanesh

2020-12-23 Thread Robert Scheck
Hello, On Mon, 21 Dec 2020, Luya Tshimbalanga wrote: > Slaanesh is still active. The best way to contact him is through e-mail. even the RHBZs should already have lead to e-mails, I'm trying it directly as suggested: Please respond to libtelnet vs. EPEL 8:

Re: Should we retire ardour5 in rawhide?

2020-12-23 Thread Nils Philippsen
On Wed, 2020-12-23 at 13:29 +0100, Nils Philippsen wrote: > Meanwhile, I've built the current version 6.5.0 in f33 ... > > https://bodhi.fedoraproject.org/updates/FEDORA-2020-5a9f9cd189 > > ... but wasn't lucky in Rawhide. I haven't found out what the problem > is exactly, but it looks like it's

[Bug 1910394] New: perl-Devel-PatchPerl-2.06 is available

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1910394 Bug ID: 1910394 Summary: perl-Devel-PatchPerl-2.06 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Devel-PatchPerl Keywords: FutureFeature,

Re: Stale proven packagers

2020-12-23 Thread Colin Walters
On Wed, Dec 23, 2020, at 12:04 PM, Florian Weimer wrote: > Is there even meaningful two-factor authentication support for Git > pushes, anywhere? (Not just in the Fedora infrastructure.) This problem is solved by my plan:

Re: Stale proven packagers

2020-12-23 Thread Florian Weimer
* Gary Buhrmaster: > It does support it, but AFAIK does not require it. > > Arguably those with elevated access (provenpackagers(*)) > should be required to use a hardware token such > as a FIDO2 authenticators with biometrics and/or > PIN required (some phones with biometrics are > are

Re: Stale proven packagers

2020-12-23 Thread Adam Williamson
On Wed, 2020-12-23 at 15:05 +, Gary Buhrmaster wrote: > On Wed, Dec 23, 2020 at 12:49 PM Vitaly Zaitsev via devel > wrote: > > > > > Maybe Fedora should add 2FA support and require it for the most powerful > > groups? > > > > It does support it, but AFAIK does not require it. old-FAS

Re: libmemcached replacement

2020-12-23 Thread Remi Collet
Le 22/12/2020 à 10:55, Remi Collet a écrit : I've start working on a package update and this will probably become the new upstream for the fedora libmemcached package A scratch build is available https://koji.fedoraproject.org/koji/taskinfo?taskID=58118722 From my local tests, everything

Re: What is the most time consuming task for you as packager?

2020-12-23 Thread Mikolaj Izdebski
On Thu, Dec 17, 2020 at 9:11 PM Kevin Fenzi wrote: > > On Wed, Dec 16, 2020 at 03:56:25PM -0500, Neal Gompa wrote: > ...snip... > > > > What I'd really like would be a "test mass rebuild" process, where a > > > > prospective package is uploaded and everything that depends on it is > > > >

Re: Stale proven packagers

2020-12-23 Thread Gary Buhrmaster
On Wed, Dec 23, 2020 at 12:49 PM Vitaly Zaitsev via devel wrote: > > Maybe Fedora should add 2FA support and require it for the most powerful > groups? > It does support it, but AFAIK does not require it. Arguably those with elevated access (provenpackagers(*)) should be required to use a

Re: Fedora 34 Change: Enable systemd-oomd by default for all variants (System-Wide Change)

2020-12-23 Thread Michael Catanzaro
On Wed, Dec 23, 2020 at 12:32 pm, Vít Ondruch wrote: You see that I have executed FF from terminal. But I think that if any other process running in the app-org.gnome.Terminal.slice starts to grow memory usage, the whole tree will be killed. systemd scopes get cgroups too, so only the scope

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 msidd...@redhat.com changed: What|Removed |Added Flags|needinfo?(mre...@redhat.com | |)

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 msidd...@redhat.com changed: What|Removed |Added Blocks||1910324 -- You are receiving

Re: gpg-agents all over the place

2020-12-23 Thread Oron Peled
On Thursday, 17 December 2020 00:08:48 IST Sam Varshavchik wrote: > Roberto Ragusa writes: > > > On 12/16/20 2:55 AM, Kevin Kofler via devel wrote: > > > >> Believe it or not, GNU/Linux is no longer a text-only operating system, nor > >> are window managers just a container for terminal

[Bug 1904001] CVE-2020-28948 Archive_tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 msidd...@redhat.com changed: What|Removed |Added Summary|CVE-2020-28948 |CVE-2020-28948 Archive_tar:

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 msidd...@redhat.com changed: What|Removed |Added Summary|CVE-2020-28948 Archive_tar: |CVE-2020-28948 Archive_Tar:

Re: Stale proven packagers

2020-12-23 Thread Vitaly Zaitsev via devel
On 22.12.2020 21:39, Adam Williamson wrote: Perhaps we need a process for cleaning up membership of this extremely powerful group? If the FAS password of*any one* of those user accounts were somehow compromised (or if just one of them decided they had a grudge against Fedora now and were going

i-nex: how do you get a useful debug file for analysis?

2020-12-23 Thread Martin Gansser
Hi there, I compiled i-nex [1] for the new libcpuid-0.5.0 [3]. When starting i-nex [2] I get a segmentation fault (core dumped). [1] https://src.fedoraproject.org/rpms/i-nex/blob/HEAD/f/i-nex.spec [2] https://koji.fedoraproject.org/koji/buildinfo?buildID=1661492 [3]

[Bug 1904001] CVE-2020-28948 Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1904001 msidd...@redhat.com changed: What|Removed |Added CC||hho...@redhat.com,

Re: Should we retire ardour5 in rawhide?

2020-12-23 Thread Nils Philippsen
Hi Guido, sending this from my private address, because I won't read my company email until I return to work next year ;). Please keep me in Cc. On Tue, 2020-12-22 at 10:55 +0100, Guido Aulisi wrote: > Hi, > ardour5 fails to build in rawhide and it has been obsoleted by > ardour6. > > Should we

Fwd: [HEADS UP] Ceph-14.x.x, dropping 32-bit archs

2020-12-23 Thread Oliver Weinmann via devel
Hi, I'm also trying to build latest ceph on arm32 under CentOS 7 (odroid-hc2) and it keeps failing for various reasons. Main reason seems to be the lack of: devtoolset-8-gcc-8.3.1-3.1.el7.src.rpm A very helpful and friendly member of the centos mailing list pointed me to an earlier version

Re: bundled libraries

2020-12-23 Thread Richard Shaw
On Wed, Dec 23, 2020 at 2:11 AM Didier Fabert wrote: > Hi, > > How to deal with package which add new cool feature, but unfortunately > by adding bundled (static) libraries ? > > 1. I do nothing, this feature cannot be included this way > 2. I can add the feature because libraries are statically

Re: Fedora GNOME Shell rendering problem

2020-12-23 Thread Michael Schwendt
On Wed, 23 Dec 2020 12:11:53 +0100, Olivier Fourdan wrote: > > The last time I had asked about Nvidia+Fedora was in 2018 when booting > > an installation would end up with a terribly slow GNOME Shell: > > > >

[Bug 1910310] New: perl-libnet-3.13 is available

2020-12-23 Thread bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1910310 Bug ID: 1910310 Summary: perl-libnet-3.13 is available Product: Fedora Version: rawhide Status: NEW Component: perl-libnet Keywords: FutureFeature, Triaged

Re: Fedora 34 Change: Enable systemd-oomd by default for all variants (System-Wide Change)

2020-12-23 Thread Vít Ondruch
Dne 22. 12. 20 v 16:45 Michael Catanzaro napsal(a): On Tue, Dec 22, 2020 at 10:45 am, Vít Ondruch wrote: And I wonder what will be the behavior for applications, which I start from my terminal? The most typical example for me is running GVim from gnome-terminal. Each gnome-terminal tab

Re: Fedora GNOME Shell rendering problem

2020-12-23 Thread Olivier Fourdan
Hi On Wed, Dec 23, 2020 at 11:54 AM Michael Schwendt wrote: > On Tue, 22 Dec 2020 17:15:32 +0100, Olivier Fourdan wrote: > > > Can you check and look for GL_OUT_OF_MEMORY messages in the journalctl > logs > > for gnome-shell? (Xwayland being spawned by gnome-shell, the messages > from > >

Re: Fedora GNOME Shell rendering problem

2020-12-23 Thread Michael Schwendt
On Tue, 22 Dec 2020 17:15:32 +0100, Olivier Fourdan wrote: > Can you check and look for GL_OUT_OF_MEMORY messages in the journalctl logs > for gnome-shell? (Xwayland being spawned by gnome-shell, the messages from > Xwayland will be marked as gnome-shell in the logs) > > Xwayland uses glamor by

Fedora-Cloud-32-20201223.0 compose check report

2020-12-23 Thread Fedora compose checker
No missing expected images. Soft failed openQA tests: 1/7 (x86_64), 1/7 (aarch64) (Tests completed, but using a workaround for a known bug) ID: 745691 Test: x86_64 Cloud_Base-qcow2-qcow2 cloud_autocloud URL: https://openqa.fedoraproject.org/tests/745691 ID: 745698 Test: aarch64

Re: Stale proven packagers

2020-12-23 Thread Zbigniew Jędrzejewski-Szmek
On Tue, Dec 22, 2020 at 03:55:22PM -0500, Ben Cotton wrote: > On Tue, Dec 22, 2020 at 3:44 PM Adam Williamson > wrote: > > > > Perhaps we need a process for cleaning up membership of this extremely > > powerful group? > > Yes, please. I think we should split the issue in two: handling the long

bundled libraries

2020-12-23 Thread Didier Fabert
Hi, How to deal with package which add new cool feature, but unfortunately by adding bundled (static) libraries ? 1. I do nothing, this feature cannot be included this way 2. I can add the feature because libraries are statically linked 3. I can add the feature anyway if I declare bundled