F21 System Wide Change: Format Security
by Jaroslav Reznik
= Proposed System Wide Change: Format Security =
https://fedoraproject.org/wiki/Changes/FormatSecurity
Change owner(s): Dhiru Kholia <dhiru.kholia(a)gmail.com>
Enable "-Werror=format-security" compilation flag for all packages in Fedora.
Once this flag is enabled, GCC will refuse to compile code that could be
vulnerable to a string format security flaw.
== Detailed Description ==
Once "-Werror=format-security" is enabled, GCC will refuse to compile code
that could be vulnerable to a string format security flaw. For more details,
please see this FESCo ticket [1].
Enabling this option eliminates an entire class of security issues! To further
understand why it is important to fix such bugs, please see Format-Security-FAQ
page [2].
Implementing this change requires a single line change to be made to the
/usr/lib/rpm/redhat/macros file (part of redhat-rpm-config package). My patch to
do this can be found at [3]
== Scope ==
Proposal owners: Currently, around 400 packages FTBFS if this flag is enabled.
We need to file bugs and also try solving these FTBFS issues.
Other developers: Currently, around 400 packages FTBFS if this flag is enabled.
A list of packages which FTBFS is available at [4]. The fix for these errors is
quite simple (in most cases). It's a matter of changing a line like,
printf(foo), to read printf("%s", foo), instead. That's it. More details are
available on Format-Security-FAQ. Additionally, we highly encourage owners (of
the affected packages) to work with upstream.
Release engineering: A mass build is required.
Policies and guidelines: N/A
[1] https://fedorahosted.org/fesco/ticket/1185
[2] https://fedoraproject.org/wiki/Format-Security-FAQ
[3] https://bitbucket.org/dhiru/redhat-rpm-config/branch/strict-format
[4] http://people.fedoraproject.org/~halfie/rebuild-logs.txt
9 years, 10 months
Reminder: Fedora 20 Final Change Deadline in one week (2013-11-26)
by Jaroslav Reznik
Greetings,
this is a reminder that Fedora 20 Final Change Deadline is in one
week - 2013-11-26, see the Schedule [1]. Be aware of that period
between Beta release and Final release is one week shorter as
approved by FESCo [2] to avoid holidays. Make sure to submit and
get karma for your updates in Bodhi on time.
After the Final Change Deadline, only accepted Blockers [3] and
Freeze Exception [4] will be allowed into Fedora 20 Final. All
updates after this time are considered zero day updates.
Please take a look on outstanding Final blocker tracker [5].
This is the list of accepted blockers still in NEW/ASSIGNED state:
1008732 anaconda LUKSError: luks device not configured
1013586 anaconda SizeNotPositiveError: spec= param must be >=0
1020974 anaconda incorrectly treats a disk with partially corrupt
GPT as having no partition at all
1027965 anaconda CreateException: Can't have a partition outside
the disk!
1028110 anaconda LVMError: lvresize failed for root: running lvm
lvresize --force -L 8712m fedora/root failed
1028367 anaconda Invalid resize operation crashes
864198 grubby grubby fatal error updating grub.cfg when /boot is
btrfs
1028207 kbd non US keyboard layouts not working at console
1030719 pungi tmux segfaults on start in 32-bit Fedora 20 TC1
install images due to libevent-2.0.so.5 being corrupt, causing
anaconda to fail to start
790339 system-config-services [abrt] system-config-services-0.101.7-2.fc17:
connection.py:630:call_blocking:DBusException: org.freedesktop.
DBus.Error.UnknownMethod: Method "list_services" with signature ""
on interface "org.fedoraproject.Config.Services.ServiceHerder"
doesn't exist
1008965 xorg-x11-server mouse cursor sometimes disappears on login
Jaroslav
[1] https://fedoraproject.org/wiki/Releases/20/Schedule
[2] https://fedorahosted.org/fesco/ticket/1191
[3] https://fedoraproject.org/wiki/QA:SOP_blocker_bug_process
[4] https://fedoraproject.org/wiki/QA:SOP_freeze_exception_bug_process
[5] https://qa.fedoraproject.org/blockerbugs/milestone/20/final/buglist
9 years, 10 months
F21 Self Contained Change: Replace Bacula with Bareos
by Jaroslav Reznik
= Proposed Self Contained Change: Replace Bacula with Bareos =
https://fedoraproject.org/wiki/Changes/Bareos
Change Owner(s): Simone Caronni <negativo17 at gmail.com>
The powerful Bacula network backup solution has switched from being Open
Source friendly to being almost closed source. Originally the project was
conceived totally as Open Source, but since the creation of Bacula Systems and
its proprietary Bacula Enterprise Edition product, the Open Source (now called
"Community Edition") has received less and less updates and is mostly
abandoned.
== Detailed description ==
The most important points that are left "abandoned" are the following:
* Installation scripts and updates to makefiles are not updated anymore.
* New plugins and functionalities are not added anymore, except those in the
"core" daemons.
* Gaphical (and buggy) console has not received any update in almost two
years.
* Patches and bugs opened in the bug tracker are mostly left abandoned. Even
trivial fixes are not imported in the source.
* Windows binaries are no longer provided, nor the source for the clients has
been updated. Even if compiled with difficulties, there is no support for recent
Windows versions.
A former Bacula developer, frustrated by the situation created the fork Bareos
a long time ago from Bacula 5.2.x (the current Fedora and RHEL 7 version).
This version has now received '''a lot of bugfixes''' compared to the original
Bacula source. This makes compilation and installation a lot easier than it
was with Bacula.
On top of this, a '''lot of new features''' have been added; some unique to
Bareos but many available only in the closed source Bacula Enterprise.
Here is the list of new features compared to the current Bacula 5.2.13:
* http://www.bareos.org/en/whats_new.html
Some highlights include NDMP support for enterprise class storage (NetApp,
etc.), support for enterprise class tape libraries and Windows support
(including Windows Server 2012) with Bareos generated binaries.
For further details on why a Bacula fork was created please look at the
following links:
* http://www.bareos.org/en/faq/items/why_fork.html
Bareos can also be '''fully compatible with Bacula''' by setting a specific
configuration directive in the Daemon configuration files; thus providing the
option for RHEL 6/7 users to interoperate with Fedora systems.
* http://www.bareos.org/en/faq/items/bareos_bacula_compatibility.html
== Scope ==
To accomplish the goal, the following Bacula packages need to be replaced with
Bareos equivalents:
bacula
bacula-docs
Currently, the same Fedora packages can be rebuilt as they are, to work also
on CentOS/RHEL 5 and 6, upgrading the EPEL or official Bacula packages in the
distributions. This is to have a consistent backup infrastructure across all
the Fedora/CentOS/RHEL ecosystem.
To ease installation, a repository for installing those packages on a
CentOS/RHEL system do exist:
http://repos.fedorapeople.org/repos/slaanesh/bacula/README.txt
The idea is the same for Bareos: import into Fedora 21 packages that can be
rebuilt for all supported Fedora/RHEL/CentOS releases and provide a repository
that can upgrade any Bacula release currently installed in the system with the
new one. In detail; the upgrade scenarios supported when going from Bacula to
Bareos would be:
>From Bacula 2.4:
* RHEL/CentOS 5 with EPEL repository
>From Bacula 5.0:
* RHEL/CentOS 6
>From Bacula 5.2.13:
* Fedora 18+
* RHEL/CentOS 5
* RHEL/CentOS 6
As written before, the change is impacting only Fedora 21, the list of
upgrades supported are only for users who want a consistent backup solution
across the enterprise.
=== External activities ===
Proposal owners: I'm the current Bacula mantainer in Fedora and will complete
the transition in time for the release.
Other developers: N/A (not a System Wide Change)
Release engineering: the release engineering team should make sure the new
Bareos packages are in place instead of the current Bacula packages for the
new release.
Policies and guidelines: N/A (not a System Wide Change)
9 years, 10 months
F21 System Wide Change: Headless Java
by Jaroslav Reznik
= Proposed System Wide Change: Headless Java =
https://fedoraproject.org/wiki/Changes/HeadlessJava
Change owner(s): Stanislav Ochotnicky <sochotnicky(a)redhat.com>
Server installations of Fedora should usually not pull in packages related to
X system or sound subsystem. For this reason part of OpenJDK package has been
split into headless subpackage which has smaller dependency chain. Fedora
packages should be migrated to require java-headlesss instead of full java
package when appropriate.
== Detailed description ==
OpenJDK package in Fedora has been traditionally monolithic, pulling in a lot
of dependencies including (but not limited to)
* libXrender
* libXi
* libXtst
* pulseaudio
This is obviously not optimal for minimal server installations where OpenJDK
is used for web application development and deployment.
Designed after Debian packaging, Fedora OpenJDK package has been split into
packages providing java and java-headless. This makes it possible for packages
to use "Requires: java-headless". For most libraries and generic packages this
is sufficient. End-user applications should keep "Requires: java" to pull in
full OpenJDK package.
This change aims to convert most Java packages to have "Requires: java-
headless" when appropriate. BuildRequires on java-devel are unaffected.
== Scope ==
Proposal owners:
* Modify javapackages-tools package to automatically generate "java-headless"
autorequires (simple change)
* Identify and file bugs for affected packages (repoquery and bugzilla bug
creation)
* (optional) Mass-change spec files that have "Requires: java" to "Requires:
java-headless"
Other developers:
* Modify spec files to have "Requires: java-headless" instead of "Requires:
java"
* (note) JavaSIG has several proven packages that could assist with this
change
Release engineering:
* mass rebuild is not necessary but it would simplify things
Policies and guidelines:
* Packaging:Java needs to be modified to account for java-headless package
existence (Note: there is already a packaging draft that aims to do that among
other changes)
9 years, 10 months
Rawhide and branched nightly compose changes
by Dennis Gilmore
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi all,
I have just changed the starting times of the nightly branched
composes. Rawhide now kicks off 3 hours earlier at 05:15 UTC. Branched
now starts 2 hours earlier at 07:15 UTC. Releng is working to integrate
the nightly livecd composes into the automated compose process, as well
as adding nightly arm and cloud image creation.
as we stabilise the compose processes we will add a separate email with
a notification of the nightly image composition completion.
Dennis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJShPFIAAoJEH7ltONmPFDRbxEQAKI1oFfh7BIMXLHP5xVMUb14
jJVMGRAgJkZxWa0a3BzXXg6aK7OdW7Q7JQTslYSrS64Vf85Ze9Fb4CdX6rhQX4yG
oBAzuJkenVhValaG/nQ5fcP9hDBIyIdbP0eJFDx5/2MZXdzDoThuIIWvgxBgXlpX
qFdBPtDDypZXjS3wiMTGa4ZnLjLnagSXmi0KLzUiWGlo4oFfi6YUsXj5lDosnj/X
LpAxc5YhFpBMwpivBc6Tq+nJqTY+1ML40Nmp15EibDnFgIPn6cto2s19iv+Svf1o
LbDltJfs/4VTpq/MSJqiYV56wYrVSMEb52ijbgXHJhR1SnxfnF3fBf31KkAtcIAr
X+XT3TU+jO9wzRPE8Pu9NsxQerZGBqKPGAXDeGzo0cpF8zCnow13wKIeHkv0PtnC
LQOlf2vDEL7f7zlA04+nxbbvRdrF2O2KNxoCP7pIEXdyKOP32ILmgcTIfY9PjmkX
Ftd8oPoccefb0NG3mJ2I/EGkmGRXU4X7iJskYkV7Kcuhg1LerltPqkdIpluQThp+
s/if2V+0AYGDVWX9kB2d4NmPW0uFKrV7NTWjvxClyGjeQgsRu8yjEtFRzkEbQZ5P
X3vfTWtEmvjPj5naVTa9lWHIzTCpO1fzwi1MBej5P5yrvjhMZFTmyEsZRDzmywZA
GvpoK1wIbzsOPfvn2olN
=L+9x
-----END PGP SIGNATURE-----
9 years, 10 months
Announcing the release of Fedora 20 Beta!
by Dennis Gilmore
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The Fedora 20 "Heisenbug" beta release has arrived with a preview of
the latest fantastic, free, and open source technology currently under
development. Take a peek inside:
*** What is the Beta Release? ***
The beta release is the last important milestone before the release of Fedora
20. A Beta release is code-complete and bears a very strong resemblance to the
third and final release. Only critical bug fixes will be pushed as updates up
to the general release of Fedora 20. The final release of Fedora 20 is expected
in early December. Meanwhile, download the beta of Fedora 20 and help us make
it even better:
http://fedoraproject.org/get-prerelease
We need your help to make Fedora 20 the best release yet, so please take some
time to download and try out the beta and make sure the things that are
important to you are working. If you find a bug, please report it – every bug
you uncover is a chance to improve the experience for millions of Fedora users
worldwide. Together, we can make Fedora 20 a rock-solid distribution. We have a
culture of coordinating new features and pushing fixes upstream as much as
feasible and your feedback will help improve not only Fedora but Linux and free
software on the whole. (See the end of this announcement for more information
on how to help.)
Since it's a beta release, some problems may still be lurking. A list of
problems that we already know about can be found at the Common F20 bugs page,
found at http://fedoraproject.org/wiki/Common_F20_bugs.
== 10 Years of Fedora ==
The Fedora 20 release coincides nicely with the 10th anniversary of Fedora. The
first Fedora release (then called Fedora Core 1) came out on November 6, 2003.
Since then, the Fedora Project has become an active and vibrant community that
produces nearly a dozen "spins" that are tailor made for desktop users,
hardware design, gaming, musicians, artists, and early classroom environments.
== ARM as a Primary Architecture ==
While Fedora has supported a number of hardware architectures over the years,
x86/x86_64 has been the default for the majority of Fedora users and for the
Linux community in general.
ARM, however, has been making massive strides. It already dominates the mobile
market, and is becoming a go-to platform for hobbyists and makers, and is
showing enormous promise for the server market as well.
In keeping with Fedora's commitment to innovation, the Fedora community has
been pushing to make ARM a primary architecture to satisfy the needs of users
and developers targeting the ARM platform.
*** Maturity and Advanced Features ***
Sometimes it's not the big new features that make a users' experience better,
it's the little enhancements or long-awaited tricky features that really help
make a new release the bee's knees.
=== NetworkManager Improvements ===
NetworkManager is getting several improvements in Fedora 20 that will be
welcome additions for power users and system administrators.
Users will now be able to add, edit, delete, activate, and de-activate network
connections via the nmcli command line tool, which will make life much easier
for non-desktop uses of Fedora.
NetworkManager is also getting support for bonding interfaces and bridging
interfaces. Bonding and bridging are used in many enterprise setups and are
necessary for virtualization and fail-over scenarios.
=== No Default Sendmail, Syslog ===
Fedora 20 removes some services that many users find unnecessary, though (of
course) they will remain available as installable packages for users who might
need them.
The systemd journal now takes the place as the default logging solution, having
been tested and able to manage persistent logging in place of syslog.
Also, Sendmail will no longer be installed by default, as most Fedora installs
have no need of a Mail Transfer Agent (MTA).
=== Cloud and Virtualization Improvements ===
The Fedora 20 release continues the Fedora tradition of adopting and
integrating leading edge technologies used in cloud computing. This release
includes a number of features that will make working with virtualization and
cloud computing much easier.
=== First-Class Cloud Images ===
The Fedora Cloud SIG has been working hard on providing images that are
well-suited to running as guests in public and private clouds like Amazon Web
Services (AWS) and OpenStack. If you're using public or private cloud, you
should definitely test-drive the beta images today!
=== OS Installer Support for LVM Thin Provisioning ===
LVM has introduced thin provisioning technology, which provides greatly
improved snapshot functionality in addition to thin provisioning capability.
This change will make it possible to configure thin provisioning during OS
installation.
=== VM Snapshot UI with virt-manager ===
This change will make taking VM snapshots much easier. qemu and libvirt have
all the major pieces in place for performing safe VM snapshots/checkpoints,
however there isn't any simple discoverable UI. This feature will track adding
that UI to virt-manager, and any other virt stack bits that need to be fixed/
improved. This includes adding functionality to libvirt to support deleting and
rebasing to external snapshots.
=== Role based access control with libvirt ===
Libvirt role based access control will allow fine grained access control like
'user FOO can only start/stop/pause vm BAR', but for all libvirt APIs and
objects.
=== ARM on x86 with libvirt/virt-manager ===
This change will fix running ARM VMs on x86 hosts using standard libvirt tools
libvirt virsh, virt-manager and virt-install.
*** Developer Goodness ***
As always, Fedora 20 will include several new features and updated packages
that will be of interest to all manner of developers.
=== ACPICA Tools Update ===
Fedora 20 includes an update to the ACPICA tools from the Component
Architecture (ACPICA) project. This provides developers with a significant
number of additional tools that have never been included in Fedora before --
for example, tools that allow one to create an ACPI table and execute the
methods contained in the table in user space, instead of having to modify
existing tables. The update brings Fedora up-to-date for ACPI development and
exploration, and reflects the reference implementation as closely as possible.
=== Ruby on Rails 4.0 ===
This update will keep Fedora up-to-date and will ensure that the current Ruby
on Rails developers stay with us as they will get support for system-packaged
Ruby on Rails of the latest version. Apart from that, Rails 4.0 also bring
improved functionality, speed, security and better modularization.
=== GNU C Library 2.18 ===
Fedora 20 includes the GNU C Library version 2.18, which brings the project up
to sync with the upstream release from the GNU project, released in August.
This resolves a number of bugs from upstream as well as security issues. This
upgrade should be backwards compatible.
*** Even More Changes ***
Fedora prides itself on bringing cutting-edge technologies to users of open
source software around the world, and this release continues that tradition. No
matter what you do, Fedora 20 has the tools you need to help you get things
done.
A complete list with details of each new change is available here:
https://fedoraproject.org/wiki/Releases/20/ChangeSet
*** Desktop Environments and Spins ***
The Fedora project strives to provide the best desktop experiences possible for
users, from desktop environment to application selection.
== GNOME 3.10 ==
Fedora 20 Beta will have a preview of GNOME 3.10. GNOME 3.10 will have a number
of new applications and new features that will please GNOME-lovers in the
Fedora 20 release. This release includes a new music application (gnome-music),
a new maps application (gnome-maps), a revamp for the system status menu, and
Zimbra support in Evolution.
== KDE Plasma Workspaces 4.11 ==
The Fedora KDE SIG has rebased to KDE 4.11 for Fedora 20. This release includes
faster Nepomuk indexing, improvements to Kontact, KScreen integration in KWin,
Metalink/HTTP support for KGet, and much more.
== X2Go ==
The current nx package in Fedora is based on the last open source release from
NoMachine. NoMachine is no longer developing nx as an open source project. The
X2Go project has taken the nx code and is maintaining it as well as developing
new client and server code around it.
*** Spins ***
Spins are alternate versions of Fedora. In addition to various desktop
environments for Fedora, spins are also available as tailored environments for
various types of users via hand-picked application sets or customizations.
To see all of the Official Fedora 20 Release Spins, see the Fedora 20 Release
Spins link.
Nightly composes of alternate Spins are available here:
http://dl.fedoraproject.org/pub/alt/nightly-composes
*** Note on performance ***
Fedora development releases use a kernel with extra debug information to help
us understand and resolve issues faster; however, this can have a significant
impact on performance. Refer to the kernel debug strategy for more details. You
can boot with slub_debug=- or use the kernel from nodebug repository to disable
the extra debug info.
*** Issues and Details ***
Heisenbug Alpha is a testing release. To report issues encountered during
testing, contact the Fedora QA team via the mailing list or in #fedora-qa on
freenode.
As testing progresses, common issues are tracked at
https://fedoraproject.org/wiki/Common_F20_bugs
For tips on reporting a bug effectively, read
http://fedoraproject.org/wiki/How_to_file_a_bug_report .
*** Contributing ***
There are many ways to contribute beyond bug reporting. You can help translate
software and content, test and give feedback on software updates, write and
edit documentation, design and do artwork, help with all sorts of promotional
activities, and package free software for use by millions of Fedora users
worldwide. To get started, visit http://join.fedoraproject.org today!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
iQIcBAEBAgAGBQJSgkG/AAoJEH7ltONmPFDRzScQALEcS5RkbI4y8/xeuEVQ2yPc
NyDDVWWnEq2GuqlFP0eDudk+9TqFRBVaniundhg6VutRjcj+h9fwg//Iosf0X3P1
xK46siwmXOHFWXkw65+2E2kYQP9K83Z5KPwz/lW2UPmHUjqTrx5ejK2/Zpe0018S
viASROl/mU1NrYodx1fYzwFJKEqQ+wisMyd8MZCRx0mmMdOuhiRGLeDL15lS62N9
HAODCS3RvnjmMbWTut0fNGbiebG3N7VGjQEknTJxJMzsa3eJLBt+rddWw2H7Rtyq
rc04cadfliEprmVCHSxrxhGv78I93F36JPMwEXKGFcCrRSHSmsGdAvHSZrwF9mIa
DtVBXB+POO0gdRySE5gukOL1O4JP/YqUx4bfZUDNKChOXAw6VJHJJWnWCl5G8cp5
XdNGRWz9SGHegtWTqCPXfrFmTGof36wSIak0GSO+Z1+whDV6jFGGcjY9m0EcspbP
wtB80pzcjjOfgL6BnqBTbAzr/pkvf6K2INcRGHg6WCGMf9EIz7y1rf3p79otkG4C
C3PFkoLKbOX0XmLpOgXgiAfKV5bMPelRFaPEhAxRxjFi2VaSAgtHBVs/N+m2w3/D
fmRh3J4o9C9/WmgEJXPlUprpHpKAKXDvDXR4GGfdx6mTla/WFahfQLg9E/SbJSAY
5iN+BnC08LxB0f34+p34
=KGU+
-----END PGP SIGNATURE-----
9 years, 10 months