-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-20:20.tzdata Errata Notice
The FreeBSD Project
Topic: Timezone database information update
Category: contrib
Module: zoneinfo
Announced: 2020-12-01
Affects: All supported versions of FreeBSD.
Corrected: 2020-10-23 01:06:33 UTC (stable/12, 12.1-STABLE)
2020-12-01 19:35:48 UTC (releng/12.2, 12.2-RELEASE-p1)
2020-12-01 19:35:48 UTC (releng/12.1, 12.1-RELEASE-p11)
2020-10-23 01:06:42 UTC (stable/11, 11.4-STABLE)
2020-12-01 19:35:48 UTC (releng/11.4, 11.4-RELEASE-p5)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The tzsetup(8) program allows the user to specify the default local timezone.
Based on the selected timezone, tzsetup(8) copies one of the files from
/usr/share/zoneinfo to /etc/localtime. This file actually controls the
conversion.
II. Problem Description
Several changes in Daylight Saving Time happened after previous FreeBSD
releases were released that would affect many people who live in different
parts of the world. Because of these changes, the data in the zoneinfo files
need to be updated, and if the local timezone on the running system is
affected, tzsetup(8) needs to be run so the /etc/localtime is updated.
III. Impact
An incorrect time will be displayed on a system configured to use one of the
affected timezones if the /usr/share/zoneinfo and /etc/localtime files are
not updated, and all applications on the system that rely on the system time,
such as cron(8) and syslog(8), will be affected.
IV. Workaround
The system administrator can install an updated timezone database from the
misc/zoneinfo port and run tzsetup(8) to get the timezone database corrected.
Applications that store and display times in Coordinated Universal Time (UTC)
are not affected.
V. Solution
Please note that some third party software, for instance PHP, Ruby, Java and
Perl, may be using different zoneinfo data source, in such cases this
software must be updated separately. For software packages that is installed
via binary packages, they can be upgraded by executing `pkg upgrade'.
Following the instructions in this Errata Notice will update all of the
zoneinfo files to be the same as what was released with FreeBSD release.
Perform one of the following:
1) Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date. Restart all the affected
applications and daemons, or reboot the system.
2) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
Restart all the affected applications and daemons, or reboot the system.
3) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-20:20/tzdata-2020d.patch
# fetch https://security.FreeBSD.org/patches/EN-20:20/tzdata-2020d.patch.asc
# gpg --verify tzdata-2020d.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart all the affected applications and daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r366956
releng/12.2/ r368251
releng/12.1/ r368251
stable/11/ r366957
releng/11.4/ r368251
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-20:20.tzdata.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl/GndRfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cLWBw/9HeAWb+xuxt8CdZUD+99vXFdHb8gLSFrlFZbHnjDwrGhz4yrAzO/3NFxh
j+DQugxxUgLvJpm3W+sYAwqO7TjJE2DkG2BV2r4vdMCax3YpkPqvuk/3oYdVy+nm
c0LTJDwHLWhluO7nrA3v49yOPICMGW1Xb7S7hNPHQaRCEVfP3hI61LM9sHAEp3zW
Q44qWfeXK46grCCbviDI+GVYmQr3/b5QJbvLidzIAz+XTToD88+DDgaowwg8GuUn
9v29aT8LjLB2XNYxRr3CZ5khdZTT5q+CGWSb0VvKHKaRgFMNLYw7gTKDOFTBQi0x
utonkT5Jsxq6kqHbp9drA6LMvUzWOThrabxCaJEk5p7t5FQWtYUfDTsspThwS54e
6n2cSCNg8j3eW6YVF7CVvCrUEsXejA/bv0ZW0M896oy5xizTKa6Yjh1llqNvpJ1h
jW9UrxtI4oGQ+Q2cUc7+85P7ddNQ/wO/SHIRVcKPHVBbs8u0YAikGjUzEhWR/pDD
tzUpNR3UTOIq96h1J+sK+jxk7arw6gCIksNDCKo3AI2DoXTe12K2OdG88OKW/t5P
iZZZufbAvY88SdKSGlBHbSXZLiMB+uH1NTI2Fab4XIetXdZq/5TPX7rRmlINS8nd
LMqCDSsVhjaUR6E1D3pOamo3n8IZgiluxqx7JZ2m9p0nKMjHDZo=
=gsQm
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Tuesday, December 1, 2020
[FreeBSD-Announce] FreeBSD Errata Notice FreeBSD-EN-20:19.audit
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-20:19.audit Errata Notice
The FreeBSD Project
Topic: execve/fexecve system call auditing
Category: core
Module: kernel
Announced: 2020-12-01
Affects: FreeBSD 12.1 and later.
Corrected: 2020-10-27 13:13:04 UTC (stable/12, 12.2-STABLE)
2020-12-01 19:34:45 UTC (releng/12.2, 12.2-RELEASE-p1)
2020-12-01 19:34:45 UTC (releng/12.1, 12.1-RELEASE-p11)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The audit(4) facility allows a system administrator to audit
security-relevant events. System calls are one such security-related event,
and the audit(4) facility will record whether the system call was successful
along with other important details.
II. Problem Description
All execve/fexecve system calls in affected versions will be reported as a
failure, even upon successful execution. For affected kernels, the exact
error reported is EJUSTRETURN, 201, or "Just return" depending on the tooling
used. These can safely be considered successful returns for the fexecve and
execve system calls. Note that audit trails that were produced by kernels
starting with FreeBSD 12.0 will exhibit this problem.
III. Impact
It is important to be able to determine when a process is, for instance,
executing a shell. Such events may be indicative of an intrusion if they
are not expected. Failure to report such an execution as successful may
result in intrusions that are no longer detectable.
IV. Workaround
No workaround is available. This error is irrelevant for system
administrators that do not use the audit(4) facility. Users of the
audit(4) facility could detect the specific error that is being
returned as success, but this may complicate auditing as all failures
must be recorded.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for errata update"
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 12.2]
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.2.patch
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.2.patch.asc
# gpg --verify audit.12.2.patch.asc
[FreeBSD 12.1]
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.1.patch
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.1.patch.asc
# gpg --verify audit.12.1.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r367080
releng/12.2/ r368249
releng/12.1/ r368249
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=249179>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-20:19.audit.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl/GnclfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKqdBAAjBubNRAnzviekLybf9W6QnFT+9LrdoHEKM0epXT7GxHeGdKSbWwJPvaO
PmogRZ88uPOvaRVYIjGLXjJf48zA6D5LuQrVre0BEICVsLEaKcoQpwqOgtSKroI4
LguI26tLC/TmzWMid7CUeDOxzY0yg+t8QWPvrc9kDCZVqDFjrWtUDurLYM50p8Rm
FHfbWgFg0g3ytPF6k7DuafDrSJIs0lULwOtAPBrYR5chTr3/quc6onU99B6oxo4K
rRe4Se458M3Gm637lADAqqyRXtzwMXZ+bJBRFjdMZb3gn6QSRphHluXosv9EWwZe
FV5muyouYzxObkE4ev8dXF8Xx6LyuWfYLj5r064DRS7oFIZjIc/5F3wUITmkzCSc
iqOPZ545JO2Mxd5JwgA6QMy1YagHJb4MKDpwoQG5EHdNSSIRxRy9SEnyyxB/boMw
c65iw+SXM6ln+iAoFO9tyoLF5ek9OFRMH/1hemkY82eECcMA2m8/taSHb3++YOQr
7tmGjBZpynj/xDLQKwQiOrz5bVSPkWFc/4q9yQWAg/IoRPs+j/bsu1QoFlZX5b/8
/161dxwjs5ZLsTj+/oV/cBKQSWIFkSkbaK61ZAdrysXmGHB1jJ6OZDlsXK9kptHr
XavfRbYVCs8tB6NmWWEcfRQvLso20u+9zLO2X0yGz0+XEpKNU4k=
=QTo/
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
Hash: SHA512
=============================================================================
FreeBSD-EN-20:19.audit Errata Notice
The FreeBSD Project
Topic: execve/fexecve system call auditing
Category: core
Module: kernel
Announced: 2020-12-01
Affects: FreeBSD 12.1 and later.
Corrected: 2020-10-27 13:13:04 UTC (stable/12, 12.2-STABLE)
2020-12-01 19:34:45 UTC (releng/12.2, 12.2-RELEASE-p1)
2020-12-01 19:34:45 UTC (releng/12.1, 12.1-RELEASE-p11)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
<URL:https://security.FreeBSD.org/>.
I. Background
The audit(4) facility allows a system administrator to audit
security-relevant events. System calls are one such security-related event,
and the audit(4) facility will record whether the system call was successful
along with other important details.
II. Problem Description
All execve/fexecve system calls in affected versions will be reported as a
failure, even upon successful execution. For affected kernels, the exact
error reported is EJUSTRETURN, 201, or "Just return" depending on the tooling
used. These can safely be considered successful returns for the fexecve and
execve system calls. Note that audit trails that were produced by kernels
starting with FreeBSD 12.0 will exhibit this problem.
III. Impact
It is important to be able to determine when a process is, for instance,
executing a shell. Such events may be indicative of an intrusion if they
are not expected. Failure to report such an execution as successful may
result in intrusions that are no longer detectable.
IV. Workaround
No workaround is available. This error is irrelevant for system
administrators that do not use the audit(4) facility. Users of the
audit(4) facility could detect the specific error that is being
returned as success, but this may complicate auditing as all failures
must be recorded.
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date and reboot.
Perform one of the following:
1) To update your system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r +10min "Rebooting for errata update"
2) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 12.2]
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.2.patch
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.2.patch.asc
# gpg --verify audit.12.2.patch.asc
[FreeBSD 12.1]
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.1.patch
# fetch https://security.FreeBSD.org/patches/EN-20:19/audit.12.1.patch.asc
# gpg --verify audit.12.1.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/12/ r367080
releng/12.2/ r368249
releng/12.1/ r368249
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=249179>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-20:19.audit.asc>
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE/A6HiuWv54gCjWNV05eS9J6n5cIFAl/GnclfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEZD
MEU4NzhBRTVBRkU3ODgwMjhENjM1NUQzOTc5MkY0OUVBN0U1QzIACgkQ05eS9J6n
5cKqdBAAjBubNRAnzviekLybf9W6QnFT+9LrdoHEKM0epXT7GxHeGdKSbWwJPvaO
PmogRZ88uPOvaRVYIjGLXjJf48zA6D5LuQrVre0BEICVsLEaKcoQpwqOgtSKroI4
LguI26tLC/TmzWMid7CUeDOxzY0yg+t8QWPvrc9kDCZVqDFjrWtUDurLYM50p8Rm
FHfbWgFg0g3ytPF6k7DuafDrSJIs0lULwOtAPBrYR5chTr3/quc6onU99B6oxo4K
rRe4Se458M3Gm637lADAqqyRXtzwMXZ+bJBRFjdMZb3gn6QSRphHluXosv9EWwZe
FV5muyouYzxObkE4ev8dXF8Xx6LyuWfYLj5r064DRS7oFIZjIc/5F3wUITmkzCSc
iqOPZ545JO2Mxd5JwgA6QMy1YagHJb4MKDpwoQG5EHdNSSIRxRy9SEnyyxB/boMw
c65iw+SXM6ln+iAoFO9tyoLF5ek9OFRMH/1hemkY82eECcMA2m8/taSHb3++YOQr
7tmGjBZpynj/xDLQKwQiOrz5bVSPkWFc/4q9yQWAg/IoRPs+j/bsu1QoFlZX5b/8
/161dxwjs5ZLsTj+/oV/cBKQSWIFkSkbaK61ZAdrysXmGHB1jJ6OZDlsXK9kptHr
XavfRbYVCs8tB6NmWWEcfRQvLso20u+9zLO2X0yGz0+XEpKNU4k=
=QTo/
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-announce@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-announce
To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"
[announce] NYC*BUG Wednesday Troff meeting
For this Wednesday's meeting
(https://www.nycbug.org/index?action=view&id=10678), we'll use a basic
RSVP system.
You have to email to rsvp at lists.nycbug.org, and the Zoom meeting
details will be sent the morning of the meeting.
During the meeting, we'll be on IRC at Freenode #nycbug, as usual.
While the meeting starts 1845 EST, we recommend joining earlier to make
sure your connected up fine, and obviously for the catch-up aspect...
it's been too long.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org:8080/mailman/listinfo/announce
(https://www.nycbug.org/index?action=view&id=10678), we'll use a basic
RSVP system.
You have to email to rsvp at lists.nycbug.org, and the Zoom meeting
details will be sent the morning of the meeting.
During the meeting, we'll be on IRC at Freenode #nycbug, as usual.
While the meeting starts 1845 EST, we recommend joining earlier to make
sure your connected up fine, and obviously for the catch-up aspect...
it's been too long.
_______________________________________________
announce mailing list
announce@lists.nycbug.org
http://lists.nycbug.org:8080/mailman/listinfo/announce
[USN-4656-1] X.Org X Server vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4656-1
December 01, 2020
xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in X.Org X Server.
Software Description:
- xorg-server: X.Org X11 server
- xorg-server-hwe-18.04: X.Org X11 server
- xorg-server-hwe-16.04: X.Org X11 server
Details:
Jan-Niklas Sohn discovered that the X.Org X Server XKB extension
incorrectly handled certain inputs. A local attacker could possibly use
this issue to escalate privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xserver-xorg-core 2:1.20.9-2ubuntu1.1
Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.8-2ubuntu2.6
Ubuntu 18.04 LTS:
xserver-xorg-core 2:1.19.6-1ubuntu4.8
xserver-xorg-core-hwe-18.04 2:1.20.8-2ubuntu2.2~18.04.4
Ubuntu 16.04 LTS:
xserver-xorg-core 2:1.18.4-0ubuntu0.11
xserver-xorg-core-hwe-16.04 2:1.19.6-1ubuntu4.1~16.04.5
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://usn.ubuntu.com/4656-1
CVE-2020-14360, CVE-2020-25712
Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.9-2ubuntu1.1
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.8-2ubuntu2.6
https://launchpad.net/ubuntu/+source/xorg-server/2:1.19.6-1ubuntu4.8
https://launchpad.net/ubuntu/+source/xorg-server-hwe-18.04/2:1.20.8-2ubuntu2.2~18.04.4
https://launchpad.net/ubuntu/+source/xorg-server/2:1.18.4-0ubuntu0.11
https://launchpad.net/ubuntu/+source/xorg-server-hwe-16.04/2:1.19.6-1ubuntu4.1~16.04.5
Ubuntu Security Notice USN-4656-1
December 01, 2020
xorg-server, xorg-server-hwe-16.04, xorg-server-hwe-18.04 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in X.Org X Server.
Software Description:
- xorg-server: X.Org X11 server
- xorg-server-hwe-18.04: X.Org X11 server
- xorg-server-hwe-16.04: X.Org X11 server
Details:
Jan-Niklas Sohn discovered that the X.Org X Server XKB extension
incorrectly handled certain inputs. A local attacker could possibly use
this issue to escalate privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
xserver-xorg-core 2:1.20.9-2ubuntu1.1
Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.8-2ubuntu2.6
Ubuntu 18.04 LTS:
xserver-xorg-core 2:1.19.6-1ubuntu4.8
xserver-xorg-core-hwe-18.04 2:1.20.8-2ubuntu2.2~18.04.4
Ubuntu 16.04 LTS:
xserver-xorg-core 2:1.18.4-0ubuntu0.11
xserver-xorg-core-hwe-16.04 2:1.19.6-1ubuntu4.1~16.04.5
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://usn.ubuntu.com/4656-1
CVE-2020-14360, CVE-2020-25712
Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.9-2ubuntu1.1
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.8-2ubuntu2.6
https://launchpad.net/ubuntu/+source/xorg-server/2:1.19.6-1ubuntu4.8
https://launchpad.net/ubuntu/+source/xorg-server-hwe-18.04/2:1.20.8-2ubuntu2.2~18.04.4
https://launchpad.net/ubuntu/+source/xorg-server/2:1.18.4-0ubuntu0.11
https://launchpad.net/ubuntu/+source/xorg-server-hwe-16.04/2:1.19.6-1ubuntu4.1~16.04.5
[USN-4655-1] Werkzeug vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4655-1
December 01, 2020
python-werkzeug vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Werkzeug.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications (Python 2.x)
Details:
It was discovered that Werkzeug has insufficient debugger PIN randomness.
An attacker could use this issue to access sensitive information. This issue only
affected Ubuntu 18.04 LTS. (CVE-2019-14806)
It was discovered that Werkzeug incorrectly handled certain URLs.
An attacker could possibly use this issue to cause pishing attacks.
This issue only affected Ubuntu 16.04 LTS. (CVE-2020-28724)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
python-werkzeug 0.14.1+dfsg1-1ubuntu0.1
python3-werkzeug 0.14.1+dfsg1-1ubuntu0.1
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.2
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4655-1
CVE-2019-14806, CVE-2020-28724
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.14.1+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ubuntu1.2
Ubuntu Security Notice USN-4655-1
December 01, 2020
python-werkzeug vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Werkzeug.
Software Description:
- python-werkzeug: collection of utilities for WSGI applications (Python 2.x)
Details:
It was discovered that Werkzeug has insufficient debugger PIN randomness.
An attacker could use this issue to access sensitive information. This issue only
affected Ubuntu 18.04 LTS. (CVE-2019-14806)
It was discovered that Werkzeug incorrectly handled certain URLs.
An attacker could possibly use this issue to cause pishing attacks.
This issue only affected Ubuntu 16.04 LTS. (CVE-2020-28724)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
python-werkzeug 0.14.1+dfsg1-1ubuntu0.1
python3-werkzeug 0.14.1+dfsg1-1ubuntu0.1
Ubuntu 16.04 LTS:
python-werkzeug 0.10.4+dfsg1-1ubuntu1.2
python3-werkzeug 0.10.4+dfsg1-1ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4655-1
CVE-2019-14806, CVE-2020-28724
Package Information:
https://launchpad.net/ubuntu/+source/python-werkzeug/0.14.1+dfsg1-1ubuntu0.1
https://launchpad.net/ubuntu/+source/python-werkzeug/0.10.4+dfsg1-1ubuntu1.2
OpenBSD Errata: December 1st, 2020 (xmaplen)
Errata patches for the X server have been released for OpenBSD 6.7 and 6.8.
Multiple input validation failures in the X server XKB extension can lead
to out of bounds memory accesses for authorized clients.
Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:
https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html
Multiple input validation failures in the X server XKB extension can lead
to out of bounds memory accesses for authorized clients.
Binary updates for the amd64, i386, and arm64 platforms are available via
the syspatch utility. Source code patches can be found on the respective
errata page:
https://www.openbsd.org/errata67.html
https://www.openbsd.org/errata68.html
[USN-4654-1] PEAR vulnerabilities
==========================================================================
Ubuntu Security Notice USN-4654-1
December 01, 2020
php-pear vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
PEAR could be made to run programs as an administrator.
Software Description:
- php-pear: PHP Extension and Application Repository
Details:
It was discovered that PEAR incorrectly sanitized filenames. A remote
attacker could possibly use this issue to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
php-pear 1:1.10.9+submodules+notgz-1ubuntu0.20.10.1
Ubuntu 20.04 LTS:
php-pear 1:1.10.9+submodules+notgz-1ubuntu0.20.04.1
Ubuntu 18.04 LTS:
php-pear 1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
Ubuntu 16.04 LTS:
php-pear 1:1.10.1+submodules+notgz-6ubuntu0.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4654-1
CVE-2020-28948, CVE-2020-28949
Package Information:
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.9+submodules+notgz-1ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.9+submodules+notgz-1ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.1+submodules+notgz-6ubuntu0.2
Ubuntu Security Notice USN-4654-1
December 01, 2020
php-pear vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
PEAR could be made to run programs as an administrator.
Software Description:
- php-pear: PHP Extension and Application Repository
Details:
It was discovered that PEAR incorrectly sanitized filenames. A remote
attacker could possibly use this issue to execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
php-pear 1:1.10.9+submodules+notgz-1ubuntu0.20.10.1
Ubuntu 20.04 LTS:
php-pear 1:1.10.9+submodules+notgz-1ubuntu0.20.04.1
Ubuntu 18.04 LTS:
php-pear 1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
Ubuntu 16.04 LTS:
php-pear 1:1.10.1+submodules+notgz-6ubuntu0.2
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4654-1
CVE-2020-28948, CVE-2020-28949
Package Information:
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.9+submodules+notgz-1ubuntu0.20.10.1
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.9+submodules+notgz-1ubuntu0.20.04.1
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.5+submodules+notgz-1ubuntu1.18.04.2
https://launchpad.net/ubuntu/+source/php-pear/1:1.10.1+submodules+notgz-6ubuntu0.2
lists.linuxfromscratch.org mailing list memberships reminder
This is a reminder, sent out once a month, about your
lists.linuxfromscratch.org mailing list memberships. It includes your
subscription info and how to use it to change it or unsubscribe from a
list.
lists.linuxfromscratch.org mailing list memberships. It includes your
subscription info and how to use it to change it or unsubscribe from a
list.
You can visit the URLs to change your membership status or
configuration, including unsubscribing, setting digest-style delivery
or disabling delivery altogether (e.g., for a vacation), and so on.
In addition to the URL interfaces, you can also use email to make such
changes. For more info, send a message to the '-request' address of
the list (for example, mailman-request@lists.linuxfromscratch.org)
containing just the word 'help' in the message body, and an email
message will be sent to you with instructions.
If you have questions, problems, comments, etc, send them to
mailman-owner@lists.linuxfromscratch.org. Thanks!
Passwords for reallost1.fbsd2233449@blogger.com:
List Password // URL
---- --------
lfs-announce@lists.linuxfromscratch.org vaozebru
http://lists.linuxfromscratch.org/options/lfs-announce/reallost1.fbsd2233449%40blogger.com
Monday, November 30, 2020
Mass spec file change: Adding BuildRequires: make
Hi,
As part of the f34 change request[1] for removing make from the
buildroot, I will be doing a mass update of packages[2] to add
BuildRequires: make where it is needed.
If you are a package maintainer and would prefer to update your packages
on your own, please do so before Dec 14, which is when I will begin
doing the mass update.
I will be doing the updates in batches, so that if there is a mistake
the impact will be limited. Here is the rough schedule of the changes:
Dec 14: Update first 50 packages.
Dec 16: Next 1000.
Dec 18: Next 1000.
Jan 4: Next 1000.
Jan 5: Next 1000.
Jan 6: Next 1000.
Jan 7: Next 1000.
Jan 8: Rest of packages.
The deadline for completing these updates is the start of the f34 mass
rebuild (Jan 20).
Thanks,
Tom
[1] https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
[2] https://fedorapeople.org/~tstellar/needs_br_make_packages.txt
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
As part of the f34 change request[1] for removing make from the
buildroot, I will be doing a mass update of packages[2] to add
BuildRequires: make where it is needed.
If you are a package maintainer and would prefer to update your packages
on your own, please do so before Dec 14, which is when I will begin
doing the mass update.
I will be doing the updates in batches, so that if there is a mistake
the impact will be limited. Here is the rough schedule of the changes:
Dec 14: Update first 50 packages.
Dec 16: Next 1000.
Dec 18: Next 1000.
Jan 4: Next 1000.
Jan 5: Next 1000.
Jan 6: Next 1000.
Jan 7: Next 1000.
Jan 8: Rest of packages.
The deadline for completing these updates is the start of the f34 mass
rebuild (Jan 20).
Thanks,
Tom
[1] https://fedoraproject.org/wiki/Changes/Remove_make_from_BuildRoot
[2] https://fedorapeople.org/~tstellar/needs_br_make_packages.txt
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
[USN-4653-1] containerd vulnerability
==========================================================================
Ubuntu Security Notice USN-4653-1
November 30, 2020
containerd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
containerd could be made to crash or run programs as an administrator
if it opened a specially crafted file.
Software Description:
- containerd: daemon to control runC
Details:
It was discovered that access controls for the shim's API socket did not
restrict access to the abstract unix domain socket in some cases. An attacker
could use this vulnerability to run containers with elevated privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
containerd 1.3.7-0ubuntu3.1
Ubuntu 20.04 LTS:
containerd 1.3.3-0ubuntu2.1
Ubuntu 18.04 LTS:
containerd 1.3.3-0ubuntu1~18.04.3
Ubuntu 16.04 LTS:
containerd 1.2.6-0ubuntu1~16.04.5
After a standard system update you need to restart containerd to make
all the necessary changes.
References:
https://usn.ubuntu.com/4653-1
CVE-2020-15257
Package Information:
https://launchpad.net/ubuntu/+source/containerd/1.3.7-0ubuntu3.1
https://launchpad.net/ubuntu/+source/containerd/1.3.3-0ubuntu2.1
https://launchpad.net/ubuntu/+source/containerd/1.3.3-0ubuntu1~18.04.3
https://launchpad.net/ubuntu/+source/containerd/1.2.6-0ubuntu1~16.04.5
Ubuntu Security Notice USN-4653-1
November 30, 2020
containerd vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
Summary:
containerd could be made to crash or run programs as an administrator
if it opened a specially crafted file.
Software Description:
- containerd: daemon to control runC
Details:
It was discovered that access controls for the shim's API socket did not
restrict access to the abstract unix domain socket in some cases. An attacker
could use this vulnerability to run containers with elevated privileges.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.10:
containerd 1.3.7-0ubuntu3.1
Ubuntu 20.04 LTS:
containerd 1.3.3-0ubuntu2.1
Ubuntu 18.04 LTS:
containerd 1.3.3-0ubuntu1~18.04.3
Ubuntu 16.04 LTS:
containerd 1.2.6-0ubuntu1~16.04.5
After a standard system update you need to restart containerd to make
all the necessary changes.
References:
https://usn.ubuntu.com/4653-1
CVE-2020-15257
Package Information:
https://launchpad.net/ubuntu/+source/containerd/1.3.7-0ubuntu3.1
https://launchpad.net/ubuntu/+source/containerd/1.3.3-0ubuntu2.1
https://launchpad.net/ubuntu/+source/containerd/1.3.3-0ubuntu1~18.04.3
https://launchpad.net/ubuntu/+source/containerd/1.2.6-0ubuntu1~16.04.5
Fedora 34 Change proposal: ibus-anthy for default Japanese IME (System-Wide Change)
https://fedoraproject.org/wiki/Changes/ibus-anthy_for_default_Japanese_IME
== Summary ==
The current default Japanese IME(input method engine) is ibus-kkc and
the default is going to change to ibus-anthy to develop Japanese IME
more effectively.
== Owner ==
* Name: [[User:Fujiwara|Takao Fujiwara]]
* Email: fujiwara [at] redhat [dot] com
== Detailed Description ==
Currently some development plans have been pending because of the
delay of [https://github.com/ueno/ibus-kkc ibus-kkc] [1] which is the
default IME for Japanese and I make the default IME to bring back to
[https://github.com/ibus/ibus-anthy ibus-anthy] now. Originally the
default was changed from ibus-anthy to ibus-kkc because the
[https://osdn.net/projects/anthy/ upstream anthy] is no longer
updated. Recently I got the agreement with the original developer of
anthy and forked it to [https://github.com/fujiwarat/ibus-anthy
anthy-unicode] and start to change the default IME again.
I also considered about [https://github.com/google/mozc ibus-mozc] for
the default but the configuration GUI is based on Qt which has the
different theme from GNOME desktop in Fedora.
[1] https://github.com/ibus/ibus/wiki/GSettingsMigration
== Benefit to Fedora ==
Make the effective developments in the Japanese IME and apply the
latest updates in ibus to each IME more effectively because I'm the
maintainer of both ibus and ibus-anthy.
== Scope ==
* Proposal owners:
* Other developers: gnome-desktop3 for default ja_JP
* Release engineering: (a check of an impact with Release Engineering is needed)
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with Objectives:
== Upgrade/compatibility impact ==
The default installed package will be changed from ibus-kkc to ibus-anthy.
== How To Test ==
Install Fedora with Japanese and the default IME is ibus-anthy.
== User Experience ==
# The Japanese detabase and some keybindings will be changed
# The setting UI is a little different
# The package size and depended packages are different
# The memory usage is a little different
== Dependencies ==
anthy-unicode and kasumi
# comps has to be updated
# gnome-desktop3 has to be updated
== Contingency Plan ==
* Contingency mechanism: Revert comps and gnome-desktop3
* Contingency deadline: Beta release
* Blocks release? No
== Documentation ==
TBD
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
The current default Japanese IME(input method engine) is ibus-kkc and
the default is going to change to ibus-anthy to develop Japanese IME
more effectively.
== Owner ==
* Name: [[User:Fujiwara|Takao Fujiwara]]
* Email: fujiwara [at] redhat [dot] com
== Detailed Description ==
Currently some development plans have been pending because of the
delay of [https://github.com/ueno/ibus-kkc ibus-kkc] [1] which is the
default IME for Japanese and I make the default IME to bring back to
[https://github.com/ibus/ibus-anthy ibus-anthy] now. Originally the
default was changed from ibus-anthy to ibus-kkc because the
[https://osdn.net/projects/anthy/ upstream anthy] is no longer
updated. Recently I got the agreement with the original developer of
anthy and forked it to [https://github.com/fujiwarat/ibus-anthy
anthy-unicode] and start to change the default IME again.
I also considered about [https://github.com/google/mozc ibus-mozc] for
the default but the configuration GUI is based on Qt which has the
different theme from GNOME desktop in Fedora.
[1] https://github.com/ibus/ibus/wiki/GSettingsMigration
== Benefit to Fedora ==
Make the effective developments in the Japanese IME and apply the
latest updates in ibus to each IME more effectively because I'm the
maintainer of both ibus and ibus-anthy.
== Scope ==
* Proposal owners:
* Other developers: gnome-desktop3 for default ja_JP
* Release engineering: (a check of an impact with Release Engineering is needed)
* Policies and guidelines: N/A
* Trademark approval: N/A
* Alignment with Objectives:
== Upgrade/compatibility impact ==
The default installed package will be changed from ibus-kkc to ibus-anthy.
== How To Test ==
Install Fedora with Japanese and the default IME is ibus-anthy.
== User Experience ==
# The Japanese detabase and some keybindings will be changed
# The setting UI is a little different
# The package size and depended packages are different
# The memory usage is a little different
== Dependencies ==
anthy-unicode and kasumi
# comps has to be updated
# gnome-desktop3 has to be updated
== Contingency Plan ==
* Contingency mechanism: Revert comps and gnome-desktop3
* Contingency deadline: Beta release
* Blocks release? No
== Documentation ==
TBD
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Fedora 34 Change proposal: Xwayland as a standalone package (System-Wide Change)
https://fedoraproject.org/wiki/Changes/XwaylandStandalone
== Summary ==
Move Xwayland to a standalone package built from current code upstream
rather than the stable branch.
== Owner ==
* Name: [[User:ofourdan| Olivier Fourdan]], [[User:mdaenzer| Michel Dänzer]]
* Email: <ofourdan@redhat.com>, <mdaenzer@redhat.com>
== Detailed Description ==
Xorg releases upstream are stuck to the current 1.20 branch for years
with no foreseeable future major update.
But Xwayland, the X11 server for Wayland, is receiving quite a lot of
updates upstream.
Xwayland has no device dependent driver loaded at run time, doesn't
load any module, so it is not limited by the Xorg API versioning like
the rest of Xorg.
So technically, there is nothing stopping us from having Xwayland as a
standalone separate package built on git master, while the rest of
xorg-x11-server comes from the stable tree upstream.
This change is about moving Xwayland to a separate package from the
rest of Xorg, built from git snapshots of the current code upstream
rather than the stable branch.
== Benefit to Fedora ==
Xwayland from upstream current code has interesting features missing
from the stable branch, some are backported manually in the current
Fedora package, but some others aren't.
There are also existing COPRs trying to backport those features, but
that can introduce bugs. Using the code from upstream would avoid the
appeal or even the need for such backports.
===XRandR emulation for games===
Those changes from [[User:Jwrdegoede | Hans De Goede]] are already
backported in the current Fedora package for each new release, using
Xwayland from current code upstream would save us from this backport
process, and the potential issues induced by backports.
===Multiple window buffers===
This is basically "tearfree" for Xwayland applications.
===initfd support===
To be able to run Xwayland on demand, the compositor needs a side
channel display where it can run the special X11 clients which need
to complete before the regular clients are started. That feature is
present in Xwayland from current code upstream, and mutter can already
make use of it.
===Xwayland pkgconfig file===
That allows other packages to know about the Xwayland built options
and the Xwayland executable location so that Wayland compositors such
as gnome-shell/mutter can adapt to Xwayland features enabled at build
time.
For example, we could chose to have Xwayland installed in "libexec"
path rather than the common "bindir" path, and mutter could start
Xwayland from there (that requires changes in mutter though, but the
pkg-config for for Xwayland opens for that possibility)
===Maintainability===
With Xwayland receiving most of the attention upstream, that will
allow for new features to be available for Fedora users faster and
more easily.
== Scope ==
* Proposal owners: We would make Xwayland a separate package build
from git snapshots from upstream. That package would provide Xwayland
and Xwayland-devel (for the Xwayland pkg-config file).
The existing Xwayland build would be removed from the xorg-x11-server
package (stable releases branch).
* Other developers: Rebuild Xwayland dependent package if they want to
benefit from the new features exposed from the command line (e.g.
initfd)
* Release engineering: [https://pagure.io/releng/issues/9865 #9865]
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
The standalone Xwayland package obsoletes the existing
xorg-x11-server-Xwayland package, so the upgrade would simply replace
xorg-x11-server-Xwayland with standalone Xwayland package.
Xwayland requires no configuration file, nothing needs to be updated
on the user side.
Features are added, not removed.
== How To Test ==
* Xwayland supports EGLStream so it needs non regression testing with
NVidia closed-source driver
* No config file are involved
* Test for non regression with X11 clients as compared with
xorg-x11-server-Xwayland from the stable branch
* Test must include demanding X11 clients such as games for non
regression (Steam?)
To ease testing, a COPR with the standalone package for Fedora 33 and
rawhide is available here:
https://copr.fedorainfracloud.org/coprs/ofourdan/Xwayland/
== User Experience ==
Users should not see any change (it's the same Xwayland program, just
built from a different branch from upstream).
== Dependencies ==
The current packages which list xorg-x11-server-Xwayland as dependency are:
* gamescope
* gnome-session-wayland-session
* kwin-wayland
* plasma-workspace-wayland
* sway
But the standalone Xwayland package would be a drop-in replacement for
xorg-x11-server-Xwayland (i.e. it provides xorg-x11-server-Xwayland)
so there is no impact on those packages.
* mutter would benefit from being rebuilt against the standalone
version of Xwayland to benefit from the initfd option.
== Contingency Plan ==
* Contingency mechanism: Switch back to building Xwayland from the
stable branch (xorg-x11-server-Xwayland).
Rebuild mutter to not use initfd
Downgrading to xorg-x11-server-Xwayland from the stable branch wpuld
require a user action, in case the contingency plan is triggered.
* Contingency deadline: beta freeze
* Blocks release: No
* Blocks product: No
== Documentation ==
There is no documentation change required.
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
== Summary ==
Move Xwayland to a standalone package built from current code upstream
rather than the stable branch.
== Owner ==
* Name: [[User:ofourdan| Olivier Fourdan]], [[User:mdaenzer| Michel Dänzer]]
* Email: <ofourdan@redhat.com>, <mdaenzer@redhat.com>
== Detailed Description ==
Xorg releases upstream are stuck to the current 1.20 branch for years
with no foreseeable future major update.
But Xwayland, the X11 server for Wayland, is receiving quite a lot of
updates upstream.
Xwayland has no device dependent driver loaded at run time, doesn't
load any module, so it is not limited by the Xorg API versioning like
the rest of Xorg.
So technically, there is nothing stopping us from having Xwayland as a
standalone separate package built on git master, while the rest of
xorg-x11-server comes from the stable tree upstream.
This change is about moving Xwayland to a separate package from the
rest of Xorg, built from git snapshots of the current code upstream
rather than the stable branch.
== Benefit to Fedora ==
Xwayland from upstream current code has interesting features missing
from the stable branch, some are backported manually in the current
Fedora package, but some others aren't.
There are also existing COPRs trying to backport those features, but
that can introduce bugs. Using the code from upstream would avoid the
appeal or even the need for such backports.
===XRandR emulation for games===
Those changes from [[User:Jwrdegoede | Hans De Goede]] are already
backported in the current Fedora package for each new release, using
Xwayland from current code upstream would save us from this backport
process, and the potential issues induced by backports.
===Multiple window buffers===
This is basically "tearfree" for Xwayland applications.
===initfd support===
To be able to run Xwayland on demand, the compositor needs a side
channel display where it can run the special X11 clients which need
to complete before the regular clients are started. That feature is
present in Xwayland from current code upstream, and mutter can already
make use of it.
===Xwayland pkgconfig file===
That allows other packages to know about the Xwayland built options
and the Xwayland executable location so that Wayland compositors such
as gnome-shell/mutter can adapt to Xwayland features enabled at build
time.
For example, we could chose to have Xwayland installed in "libexec"
path rather than the common "bindir" path, and mutter could start
Xwayland from there (that requires changes in mutter though, but the
pkg-config for for Xwayland opens for that possibility)
===Maintainability===
With Xwayland receiving most of the attention upstream, that will
allow for new features to be available for Fedora users faster and
more easily.
== Scope ==
* Proposal owners: We would make Xwayland a separate package build
from git snapshots from upstream. That package would provide Xwayland
and Xwayland-devel (for the Xwayland pkg-config file).
The existing Xwayland build would be removed from the xorg-x11-server
package (stable releases branch).
* Other developers: Rebuild Xwayland dependent package if they want to
benefit from the new features exposed from the command line (e.g.
initfd)
* Release engineering: [https://pagure.io/releng/issues/9865 #9865]
* Trademark approval: N/A (not needed for this Change)
* Alignment with Objectives:
== Upgrade/compatibility impact ==
The standalone Xwayland package obsoletes the existing
xorg-x11-server-Xwayland package, so the upgrade would simply replace
xorg-x11-server-Xwayland with standalone Xwayland package.
Xwayland requires no configuration file, nothing needs to be updated
on the user side.
Features are added, not removed.
== How To Test ==
* Xwayland supports EGLStream so it needs non regression testing with
NVidia closed-source driver
* No config file are involved
* Test for non regression with X11 clients as compared with
xorg-x11-server-Xwayland from the stable branch
* Test must include demanding X11 clients such as games for non
regression (Steam?)
To ease testing, a COPR with the standalone package for Fedora 33 and
rawhide is available here:
https://copr.fedorainfracloud.org/coprs/ofourdan/Xwayland/
== User Experience ==
Users should not see any change (it's the same Xwayland program, just
built from a different branch from upstream).
== Dependencies ==
The current packages which list xorg-x11-server-Xwayland as dependency are:
* gamescope
* gnome-session-wayland-session
* kwin-wayland
* plasma-workspace-wayland
* sway
But the standalone Xwayland package would be a drop-in replacement for
xorg-x11-server-Xwayland (i.e. it provides xorg-x11-server-Xwayland)
so there is no impact on those packages.
* mutter would benefit from being rebuilt against the standalone
version of Xwayland to benefit from the initfd option.
== Contingency Plan ==
* Contingency mechanism: Switch back to building Xwayland from the
stable branch (xorg-x11-server-Xwayland).
Rebuild mutter to not use initfd
Downgrading to xorg-x11-server-Xwayland from the stable branch wpuld
require a user action, in case the contingency plan is triggered.
* Contingency deadline: beta freeze
* Blocks release: No
* Blocks product: No
== Documentation ==
There is no documentation change required.
--
Ben Cotton
He / Him / His
Senior Program Manager, Fedora & CentOS Stream
Red Hat
TZ=America/Indiana/Indianapolis
_______________________________________________
devel-announce mailing list -- devel-announce@lists.fedoraproject.org
To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org
Subscribe to:
Posts (Atom)