devel-announce June 2018

devel-announce@lists.fedoraproject.org

5 participants
30 discussions

License change notification for Eclipse Plugins
by Mat Booth 13 Jun '18

13 Jun '18

Some Eclipse Foundation plug-ins have already made the switch from EPL to EPL-2.0 and I have updated the licence field in the corresponding Rawhide RPMs where I am aware of the change. I expect that most plug-ins from the Foundation and the Eclipse Platform itself will make the switch over the coming year. I don't plan to announce each change individually so if you are interested in Eclipse Platform or plug-in licensing, please pay special attention going forward. Thanks -- Mat Booth http://fedoraproject.org/get-fedora

1 0

F29 System Wide Change: Golang 1.11
by Jan Kurik 13 Jun '18

13 Jun '18

= Proposed System Wide Change: Golang 1.11 = https://fedoraproject.org/wiki/Changes/golang1.11 Owner(s): * Jakub Čajka <jcajka at redhat dot com> Rebase of Golang package to upcoming version 1.11 in Fedora 29, including rebuild of all dependent packages(pre-release version of Go will be used for rebuild, if released version will not be available at the time). == Detailed description == Rebase of Golang package to upcoming version 1.11 in Fedora 29. Golang 1.11 is schedule to be released in Aug. Due to current nature of Go packages, rebuild of dependent package will be required to pick up the changes. == Scope == * Proposal owners: Rebase golang package in f29, help with resolving possible issues found during package rebuilds. * Other developers: fix possible issues with help from golang maintainers * Release engineering: Rebuild of dependent packages in side tag. RelEng tracking issue https://pagure.io/releng/issue/7569 ** List of deliverables: N/A * Policies and guidelines: N/A * Trademark approval: N/A -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

F29 Self Contained Change: User PATH Prioritization
by Jan Kurik 07 Jun '18

07 Jun '18

= Proposed Self Contained Change: User PATH Prioritization = https://fedoraproject.org/wiki/Changes/UserPathPrioritization Owner(s): * Sorin Sbarnea <ssbarnea at redhat dot com> * Till Maas <opensource at till dot name> * Miro Hrončok <mhroncok at redhat dot com> Changing user PATH '''~/.local/bin''' to be moved to the top of the PATH list instead of the end. This will bring Fedora in sync with other distributions which already fixed this issues (Debian/Ubuntu) and will allow users to install and use their own command line tools, also fixing multiple bugs where user installed tools cannot be accessed because the system installed ones took precedence. == Detailed description == Currently if user is installing his own tools with installers like (pip), they will be installed inside ~/.local/bin but if the same CLI tools are installed at system level the user would not be able to use his own tools because the system one would be picked instead. This happens because .bashrc file adds user PATH to the end instead of the top of PATH list variable. Same problem was happening with other distributions but they fixed it (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839155 Debian bug) Example: "pip install --user virtualenv" would install virtualenv at user level, adding ~/.local/bin/virtualenv executable. Still, if virtualenv happens to be installed at system level, this would currently be used instead of user installed one. On the other hand, python itself already knows to prefer user installed modules which means that "python -m virtualenv" will call user installed module instead of the system one. This may result in undefined behavior, where user installs foo, than run foo, but /usr/bin/foo is run and that import from Python modules in home. Those modules might have different API. If we change the order and to assure the user folders do take precedence, we would assure that python modules and shell scripts would use the same modules, avoiding weird bugs where what you call is not what you installed. The issue is not unique to pip installed and applies to any tools that are installed in de facto default XDG folder locations. There should be '''no security concerns''' due to this change because any user is already able to add executables and to alter its own PATH, which means that if someone wants to trick a user to use another executable, they are already able to do that. This has already been proved several times in the https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org… initial discussions about this change. The change itself technically is in /etc/skel/.bash_profile from bash. Currently: PATH=$PATH:$HOME/.local/bin:$HOME/bin After the change: PATH=$HOME/.local/bin:$HOME/bin:$PATH (Note that whether we move $HOME/bin or not has not yet been decided.) Note that this change will only affect new user accounts, we cannot change PATH for already existing accounts without crazy and undesired hacks. == Scope == * Proposal owners: change /etc/skel/.bash_profile to have local folders before the system ones in default PATH * Other developers: N/A (not a System Wide Change) * Release engineering: https://pagure.io/releng/issue/7554 #7554 ** List of deliverables: N/A (not a System Wide Change) * Policies and guidelines: N/A (not a System Wide Change) * Trademark approval: N/A (not needed for this Change) -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

Elections for Mindshare - May 2018 - Result announcement
by Jan Kurik 06 Jun '18

06 Jun '18

Greetings, all! The elections for Mindshare - May 2018 [1] have concluded, and the results are shown below. Mindshare committee is electing 1 seat this time. A total of 107 ballots were cast, meaning a candidate could accumulate up to 321 votes (107 * 3). The results for the elections are as follows: # votes | name - --------+---------------------- 205 | Sumantro Mukherjee (sumantrom) - --------+---------------------- 188 | Nick Bebout (nb) 114 | Itamar Peixoto (itamarjp) Congratulations to the winning candidate, and thank you all candidates for running this elections! [1] https://admin.fedoraproject.org/voting/about/mindshare-may-2018 -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

Elections for Council - May 2018 - Result announcement
by Jan Kurik 06 Jun '18

06 Jun '18

Greetings, all! The elections for Council - May 2018 [1] have concluded, and the results are shown below. Fedora Council is electing 1 seat this time. A total of 110 ballots were cast, meaning a candidate could accumulate up to 220 votes (110 * 2). The results for the elections are as follows: # votes | name - --------+---------------------- 164 | Till Maas (till) - --------+---------------------- 115 | Nick Bebout (nb) Congratulations to the winning candidate, and thank you all candidates for running this elections! [1] https://admin.fedoraproject.org/voting/about/council-may-2018 -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

Fedora Elections May 2018 - Voting period of FESCo elections has started
by Jan Kurik 06 Jun '18

06 Jun '18

Hi, the Voting period of the currently running Fedora Elections [0] has just started. Please vote for your candidates to FESCo [1]. You can vote till June 13th, 2018 when the voting ends at 23:59:59 UTC. On Community blog [2] you can also find interviews with all the candidates. Please have a look at it. [0] https://fedoraproject.org/wiki/Elections [1] https://admin.fedoraproject.org/voting/vote/fesco-may-2018 [2] https://communityblog.fedoraproject.org/tag/may-2018-elections-fesco/ [2.1] Justin Forbes: https://communityblog.fedoraproject.org/fesco-election-interview-justin-for… [2.2] Stephen Gallagher: https://communityblog.fedoraproject.org/fesco-election-interview-stephen-ga… [2.3] Till Maas: https://communityblog.fedoraproject.org/fesco-election-interview-till-maas-… [2.4] Randy Barlow: https://communityblog.fedoraproject.org/fesco-election-interview-randy-barl… [2.5] Petr Šabata: https://communityblog.fedoraproject.org/fesco-election-interview-petr-sabat… Thanks for your support. Regards, Jan -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

F29 Self Contained Change: Changes/Update festival to 2.5
by Jan Kurik 05 Jun '18

05 Jun '18

= Proposed Self Contained Change: Changes/Update festival to 2.5 = https://fedoraproject.org/wiki/Changes/Update_festival_to_2.5 Owner(s): * Lukáš Tyrychtr <lukastyrychtr at gmail dot com> Update the packaged festival speech synthesis system to the latest upstream version. And just as a bonus make it actually work. == Detailed description == Festival provides capabilities for speech synthesis and a framework for synthetic voice creation. It generally provides higher quality voices than Espeak. == Scope == * Proposal owners: Actually do the package updates (almost done) and get them in to Fedora. * Other developers: N/A (not a System Wide Change) * Release engineering: https://pagure.io/releng/issue/7551 #7551 ** List of deliverables: N/A (not a System Wide Change) * Policies and guidelines: N/A (not a System Wide Change) * Trademark approval: N/A (not needed for this Change) -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

F29 System Wide Change: NSS load p11-kit modules by default
by Jan Kurik 04 Jun '18

04 Jun '18

= Proposed System Wide Change: NSS load p11-kit modules by default = https://fedoraproject.org/wiki/Changes/NSSLoadP11KitModules Owner(s): * Daiki Ueno <dueno at redhat dot com> When NSS database is created, PKCS#11 modules configured in the system's p11-kit will be automatically registered and visible to NSS applications. == Detailed description == Fedora provides a mechanism to configure PKCS#11 modules system wide, allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11 modules in a consistent manner. Until now NSS applications haven't benefit from it as NSS uses a different configuration mechanism which requires users to register PKCS#11 modules in NSS databases. This change makes the manual procedure unnecessary, by registering the p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in NSS databases with the default configuration. See also: * https://bugzilla.redhat.com/show_bug.cgi?id=1173577 == Scope == * Proposal owners: ** Enable p11-kit-proxy in the newly created NSS database, through the crypto-policies package. ** Modify the opensc package not to register itself to the NSS database upon installation. * Other developers: ** Make sure that this change doesn't cause any regression with the existing applications. * Release engineering: [https://pagure.io/releng/issue/7548 #7548] ** List of deliverables: N/A * Policies and guidelines: PackageMaintainers/PKCS11 needs changes basically to eliminate NSS specific stuff * Trademark approval: N/A (not needed for this Change) -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

F29 System Wide Change: i686 Is For x86-64
by Jan Kurik 04 Jun '18

04 Jun '18

= Proposed System Wide Change: i686 Is For x86-64 = https://fedoraproject.org/wiki/Changes/i686_Is_For_x86-64 Owner(s): * Florian Weimer <fweimer at redhat dot com> Fedora builds its i686 packages for use on x86-64 systems as multi-lib RPMs. == Detailed description == Currently, the i686 RPM packages are built in such a way that they are compatible with very old i686 systems, such as the Pentium III. The only addition over the i686/Pentium Pro baseline is a requirement to support long NOPs, for Intel CET. However, the majority of installations of i686 packages is for use on x86_64 systems, as multi-lib RPMs. Furthermore, there are reports that the i686 kernel does not run stable on old hardware which is not x86-64-capable ( https://lists.fedoraproject.org/archives/list/x86@lists.fedoraproject.org/t… ). This proposal suggests to accept this reality and build the i686 packages in such a way that they require the ISA level of (early) x86-64 CPUs. == Scope == * Proposal owners: Adjust the redhat-rpm-config, gcc, and glibc packages to switch to the new compiler flags. Except for mstackrealign, there is substantial experience with this configuration downstream. * Other developers: Other developers can enable SSE2 optimization in their packages if they want, where this has been a compile-time option only. * Release engineering: https://pagure.io/releng/issues/7543 #7543 ** List of deliverables: TBD * Policies and guidelines: i686 is no longer a primary architecture. The Packaging Guidelines do not currently require support for non-SSE2 x86 systems, so no change is required there. * Trademark approval: N/A (not needed for this Change) -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

F29 System Wide Change: Strong crypto settings: phase 2
by Jan Kurik 01 Jun '18

01 Jun '18

= Proposed System Wide Change: Strong crypto settings: phase 2 = https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2 Owner(s): * Tomáš Mráz <tmraz at redhat dot com> We update the current system-wide crypto policy to further disable legacy cryptographic protocols (TLS 1.0 and TLS 1.1) and weak Diffie-Hellman key exchange sizes (1024 bit) == Detailed description == Fedora includes several cryptographic components who's security doesn't remain constant over time. Algorithms such as (cryptographic) hashing and encryption typically have a lifetime after which they are considered either too risky to use or plain insecure. That would mean we need to phase out such algorithms from the default settings, or completely disable if they could cause irreparable issue. While in the past we did not disable algorithms in a consistent way (different applications utilized different policies), today we have a system-wide policy followed by a large part of Fedora components. That allows us to move consistently and deprecate algorithms system-wide. For rationale see RFC 7457 for a more complete list of attacks taking advantage of legacy crypto algorithms. The changes for default policy are: * Keep only TLS 1.2 (and TLS 1.3 when available) as enabled protocols and move the TLS 1.x, x<=1 to legacy level. * Require finite field parameters (RSA, Diffie-Hellman) of 2048 and more in the default settings That is a policy of: LEGACY MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc) Curves: all prime >= 255 bits (including bernstein curves) Signature algorithms: SHA-1 hash or better (not RIPEMD) Ciphers: all available > 112-bit key, >= 128-bit block (no rc4, but with 3DES) key exchange: ECDHE, RSA, DHE DH params size: >=1023 RSA params size: >=1023 TLS protocols: TLS >= 1.0 DEFAULT MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc) Curves: all prime >= 255 bits (including bernstein curves) Signature algorithms: with SHA-1 hash or better (not DSA) Ciphers: >= 128-bit key, >= 128-bit block (aes, camellia, chacha20, including aes-cbc) key exchange: ECDHE, RSA, DHE DH params size: >= 2048 RSA params size: >= 2048 TLS protocols: TLS >= 1.2 FUTURE MACs: All HMAC with SHA256 or better + all modern MACs (poly1305 etc) Curves: all prime >= 384 bits (including bernstein curves) Signature algorithms: SHA-384 hash or better (not DSA) Ciphers: >= 256-bit key, >= 128-bit block, only Authenticated Encryption (AE) ciphers key exchange: ECDHE, DHE DH params size: >= 3072 RSA params size: >= 3072 TLS protocols: TLS >= 1.2 == Scope == * Proposal owners: The policies include in crypto-policies package need to be updated. * Other developers: * Crypto policies are updated to the settings above * https://bugzilla.redhat.com/show_bug.cgi?id=1487607 OpenSSL is updated to allow setting policies for TLS versions * Release engineering: Copied from F28 change - no impact https://pagure.io/releng/issue/7235 #7235 ** List of deliverables: * Crypto policies are updated to the settings above * OpenSSL, NSS, GnuTLS and all applications covered under the Fedora Crypto Policies follow the new crypto settings. * Policies and guidelines: No changes to packaging or other guidelines is needed. * Trademark approval: N/A (not needed for this Change) -- Jan Kuřík JBoss EAP Program Manager Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

devel-announce June 2018