F28 System Wide Change: Golang 1.10
by Jan Kurik
= System Wide Change: Golang 1.10 =
https://fedoraproject.org/wiki/Changes/golang1.10
Change owner(s):
* Jakub Čajka <jcajka AT redhat DOT com>
Rebase of Golang package to upcoming version 1.10 in Fedora 28,
including rebuild of all dependent packages(pre-release version of Go
will be used for rebuild, if released version will not be available at
the time).
== Detailed Description ==
Rebase of Golang package to upcoming version 1.10 in Fedora 28. Golang
1.10 is schedule to be released in Feb. Due to current nature of Go
packages, rebuild of dependent package will be required to pick up the
changes.
== Scope ==
* Proposal owners:
Rebase golang package in f28, help with resolving possible issues
found during package rebuilds.
* Other developers:
fix possible issues with help from golang maintainers
* Release engineering:
Rebuild of dependent packages in side tag. Tracking issue
https://pagure.io/releng/issue/7233
* List of deliverables:
N/A
* Policies and guidelines:
N/A
* Trademark approval:
N/A
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 Self Contained Change: Glibc collation update and sync with cldr
by Jan Kurik
= Proposed Self Contained Change: Glibc collation update and sync with cldr =
https://fedoraproject.org/wiki/Changes/Glibc_collation_update_and_sync_wi...
Change owner(s):
* Mike Fabian <mfabian AT redhat DOT com>
Update collation data in glibc to an ISO file from 2015 (in sync with
Unicode 8.0.0) and sync collation rules of the locales with CLDR.
== Detailed Description ==
The collation data in glibc is extremely out of date, most locales
base their collation rules on an iso14651_t1_common file which has not
been updated for probably more than 15 years. Therefore, all
characters added in later Unicode versions are missing and not sorted
at all which causes bugs like [[1]]. This change is about updating
that iso146541_t1_common file to the latest available version from ISO
which is from 2015 and up-to-date with Unicode 8.0.0. Because
additions and changes in the syntax of the new iso146541_t1_common
file, updating that file requires changing the collation rules of
almost all locales. Because all these collation rules have to be
touched anyway, this is a good opportunity to fix bugs in the
collation ruies and sync them with the collation rules in CLDR.
== Scope ==
* Proposal owners:
Work with upstream, file bugs and provide patches where required.
* Other developers:
This change will impact glibc and everything which sorts strings using
the collation functions from glibc. Other Developers do not need to
make any changes from their end, but they need to watch how their
application behaves with improved localedata. We need proper testing
to see that it does not break any application.
* Release engineering:
#7234: https://pagure.io/releng/issue/7234
List of deliverables:
N/A (not a System Wide Change)
Policies and guidelines:
No, this change does not require any updates to Policies or packaging
guideline updates.
Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 System Wide Change: Strong crypto settings
by Jan Kurik
= System Wide Change: Strong crypto settings =
https://fedoraproject.org/wiki/Changes/StrongCryptoSettings
Change owner(s):
* Nikos Mavrogiannopoulos <nmav AT redhat DOT com>
This change is about updating the current system-wide crypto policy to
disable legacy and unused cryptographic protocols.
== Detailed Description ==
Fedora includes several cryptographic components who's security
doesn't remain constant over time. Algorithms such as (cryptographic)
hashing and encryption typically have a lifetime after which they are
considered either too risky to use or plain insecure. That would mean
we need to phase out such algorithms from the default settings, or
completely disable if they could cause irreparable issue.
While in the past we did not disable algorithms in a consistent way
(different applications utilized different policies), today we have a
system-wide policy followed by a large part of Fedora components. That
allows us to move consistently and deprecate algorithms system-wide.
For rationale see RFC 7457 for a more complete list of attacks taking
advantage of legacy crypto algorithms.
The propose changes for default policy are:
* Keep only TLS 1.2 (and TLS 1.3 when available) as enabled protocols
and move the TLS 1.x, x<=1 to legacy level.
* Require finite field parameters (RSA, Diffie-Hellman) of 2048 and
more in the default settings
That is a policy of:
LEGACY
MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 255 bits (including bernstein curves)
Signature algorithms: SHA-1 hash or better (not RIPEMD)
Ciphers: all available > 112-bit key, >= 128-bit block (no rc4, but with 3DES)
key exchange: ECDHE, RSA, DHE
DH params size: >=1024
RSA params size: >=1024
TLS protocols: TLS >= 1.0
DEFAULT
MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 255 bits (including bernstein curves)
Signature algorithms: with SHA-1 hash or better
Ciphers: >= 128-bit key, >= 128-bit block (aes, camellia, chacha20,
including aes-cbc)
key exchange: ECDHE, RSA, DHE
DH params size: >= 2048
RSA params size: >= 2048
TLS protocols: TLS >= 1.2
FUTURE
MACs: All HMAC with SHA256 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 384 bits (including bernstein curves)
Signature algorithms: SHA-384 hash or better
Ciphers: >= 256-bit key, >= 128-bit block, only Authenticated
Encryption (AE) ciphers
key exchange: ECDHE, DHE
DH params size: >= 3072
RSA params size: >= 3072
TLS protocols: TLS >= 1.2
== Scope ==
* Proposal owners:
The policies include in crypto-policies package need to be updated.
* Other developers:
* Crypto policies are updated to the settings above
* OpenSSL is updated to allow setting policies for TLS versions
* Release engineering:
#7235: https://pagure.io/releng/issue/7235
* List of deliverables:
* Crypto policies are updated to the settings above
* OpenSSL, NSS, GnuTLS and all applications covered under the Fedora
Crypto Policies follow the new crypto settings.
* Policies and guidelines:
No changes to packaging or other guidelines is needed.
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 System Wide Change: Hardening Flags Updates for Fedora 28
by Jan Kurik
= System Wide Change: Hardening Flags Updates for Fedora 28 =
https://fedoraproject.org/wiki/Changes/HardeningFlags28
Change owner(s):
* Florian Weimer <fweimer AT redhat DOT com>
This system-wide change covers changes to the hardening flags in Fedora 28.
== Detailed Description ==
* Compile all binaries with stack clash protection
(-fstack-clash-protection). As a result, all stack overflows (i.e.,
situations where the allocated stack is completely exhausted) will
reliably result in crashes.
* Enable C++ standard library hardening with -D_GLIBCXX_ASSERTIONS.
This turns on cheap range checks for C++ arrays, vectors, and strings.
* Enable control flow protection on x86-64 using -fcf-protection=full -mcet.
* Enable .got.plt isolation in binutils, to support a read-only GOT
with lazy binding on systems which provide support for memory
protection keys.
== Scope ==
* Proposal owners:
Propose changes to redhat-rpm-config to implement the new flags.
redhat-rpm-config: Enable -fstack-clash-protection
* Other developers:
The redhat-rpm-config changes need to be merged. For packages which
bypass the RPM compiler flags injection mechanism, developers need to
manually implement the new flags.
* Release engineering:
#7220: https://pagure.io/releng/issue/7220
* List of deliverables: Not affected
* Policies and guidelines:
N/A (not needed for this Change; covered by the existing Packaging Guidelines)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 System Wide Change: GHC 8.2
by Jan Kurik
= System Wide Change: GHC 8.2 =
https://fedoraproject.org/wiki/Changes/GHC_8.2
Change owner(s):
* Jens Petersen <petersen AT redhat DOT com>
* Haskell_SIG <haskell AT lists DOT fedoraproject DOT org>
Update the Haskell GHC compiler from major version 8.0.2 to 8.2.2.
== Detailed Description ==
This change involves updating the GHC Haskell compiler in Fedora to
the latest major version and rebuilding all the Haskell packages in
Fedora with it.
GHC 8.2 bring a number of important performance improvements and new
features, including improved DWARF support and support for the
Backpack modular packaging system. There are more details the upstream
release notes linked below.
== Scope ==
* Proposal owners: rebuild updated Haskell packages in f28-ghc
- we will base package versions off [LTS 10]
- installation of shared libraries in common directory to speed up
startup of executables
* Other developers:
None really, Haskell SIG can rebuild all packages as far as possible
* Release engineering:
https://pagure.io/releng/issue/7216
* List of deliverables:
Updated Fedora packages
* Policies and guidelines:
None planned, but will review
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 Self Contained Change: VirtualBox Guest Integration
by Jan Kurik
= Proposed Self Contained Change: VirtualBox Guest Integration =
https://fedoraproject.org/wiki/Changes/VirtualBox_Guest_Integration
Change owner(s):
* Hans de Goede <hdegoede AT redhat DOT com>
VirtualBox is popular, easy to use virtual-machine software. The
purpose of this change is to ship the VirtualBox guest-drivers and
-tools by default in the Fedora workstation product.
== Detailed Description ==
VirtualBox runs on Windows. MacOS and Linux and is used by many users
to try it Linux for the first time. As such it is important for Fedora
to work well in VirtualBox virtual-machines. Like other
virtual-machines VirtualBox virtual-machines can offer an enhanced
user-experience when some VirtualBox specific guest-drivers and
guest-tools are installed. This change is about adding the
guest-drivers to the Fedora kernel package, packaging the
userspace-tools (VirtualBox Guest Additions) and adding the VirtualBox
Guest Additions package to the default package list for the
Workstation product.
== Scope ==
* Proposal owners:
- The VirtualBox guest drivers have been merged into linux-next and
will be in 4.16, the kernel-release with which F28 will ship. The
separate vboxsf kernel-driver has been submitted upstream and is
awaiting review upstream. If the vboxsf driver does not get accepted
upstream in time we can ship with VirtualBox guest integration without
shared-folder support.
- Package VirtualBox Guest Additions userspace parts (Review Request)
- Add VirtualBox Guest Additions package to the default package list
for the Workstation product
* Other developers:
N/A (not a System Wide Change)
* Release engineering:
https://pagure.io/releng/issue/6880
* List of deliverables:
N/A (not a System Wide Change)
* Policies and guidelines:
N/A (not a System Wide Change)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 Self Contained Change: Korean Default Fonts to Google Noto
by Jan Kurik
= Proposed Self Contained Change: Korean Default Fonts to Google Noto =
https://fedoraproject.org/wiki/Changes/KRDefaultFontsToNoto
Change owner(s):
* Akira TAGOH <tagoh AT redhat DOT com>
Changes the default fonts for Korean to Google Noto.
== Detailed Description ==
Changes the default fonts for Korean to Google Noto. each typefaces
will be changed as the following:
* sans-serif
* * VL Gothic -> Noto Sans KR
* serif
* * (No default serif) -> Noto Serif KR
* monospace
* * VL Gothic -> Noto Sans Mono CJK KR
== Scope ==
* Proposal owners:
- Update packages with proper priority of fontconfig config file
(naver-nanum-gothic*fonts and google-cjk-noto-*-kr-fonts)
- Update comps
* Other developers:
N/A (not a System Wide Change)
* Release engineering:
#7225: https://pagure.io/releng/issue/7225
* List of deliverables:
N/A (not a System Wide Change)
* Policies and guidelines:
N/A (not a System Wide Change)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 Self Contained Change: Japanese Default Fonts to Google Noto
by Jan Kurik
= Proposed Self Contained Change: Japanese Default Fonts to Google Noto =
https://fedoraproject.org/wiki/Changes/JPDefaultFontsToNoto
Change owner(s):
* Akira TAGOH <tagoh AT redhat DOT com>
Changes the default fonts for Japanese to Google Noto.
== Detailed Description ==
Changes the default fonts for Japanese to Google Noto. each typefaces
will be changed as the following:
* sans-serif
* * VL Gothic -> Noto Sans JP
* serif
* * (No default serif) -> Noto Serif JP
* monospace
* * VL Gothic -> Noto Sans Mono CJK JP
== Scope ==
* Proposal owners:
- Update packages with the proper priority of fontconfig config file
(vlgothic*fonts and google-cjk-noto-*-jp-fonts)
- Update comps
* Other developers:
N/A (not a System Wide Change)
* Release engineering:
#7224: https://pagure.io/releng/issue/7224
* List of deliverables:
N/A (not a System Wide Change)
* Policies and guidelines:
N/A (not a System Wide Change)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months
F28 Self Contained Change: Fontconfig 2.13
by Jan Kurik
= Proposed Self Contained Change: Fontconfig 2.13 =
https://fedoraproject.org/wiki/Changes/Fontconfig_2.13
Change owner(s):
* Akira TAGOH <tagoh AT redhat DOT com>
Update fontconfig package to the latest version.
== Detailed Description ==
Update fontconfig package to the latest version which contains the
following features and bug fixes:
* config file description support
* allow sharing caches under the bind-mounted dirs
* improve footprint on creating caches
* variable fonts suppport
== Scope ==
* Proposal owners:
Package new version of fontconfig bug fixes (if any)
Other developers:
N/A (not a System Wide Change)
Release engineering:
#7223: https://pagure.io/releng/issue/7223
List of deliverables:
N/A (not a System Wide Change)
Policies and guidelines:
N/A (not a System Wide Change)
Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
6 years, 3 months