lwn.net

lwn.net 피드 구독하기
LWN.net is a comprehensive source of news and opinions from and about the Linux community. This is the main LWN.net feed, listing all articles which are posted to the site front page.
업데이트: 1시간 10분 지남

A new kernel testing tree

화, 2024/10/22 - 3:20오전
Sasha Levin has announced a new tree that is intended to perform continuous-integration tests of pull requests aimed at the mainline. The plan is for this tree to hold more finished work than sometimes ends up in linux-next; in a name that seems destined to create typographical confusion, it is called "linus-next".

The linus-next tree aims to provide a more stable and testable integration point compared to linux-next, addressing the runtime issues that make testing linux-next challenging and focusing on code that's about to be pulled by Linus.

카테고리:

Bootc 1.1.0 released

화, 2024/10/22 - 1:47오전

Version 1.1.0 of the bootc utility for performing transactional, in-place operating system updates using Open Container Initative (OCI) images, has been released. This release "officially stabilizes all APIs" for bootc and includes a number of bug fixes. LWN covered bootc in June.

카테고리:

[$] Python PGP proposal poses packaging puzzles

화, 2024/10/22 - 12:08오전

Sigstore is a project that is meant to simplify and improve the process of signing, verifying, and protecting software. It is a relatively new project, declared "generally available" in 2022. Python is an early adopter of sigstore; it started providing signatures for CPython artifacts with Python 3.11 in 2022. This is in addition to the OpenPGP signatures it has been providing since at least 2001. Now, Seth Michael Larson—the Python Software Foundation (PSF) security developer-in-residence—would like to deprecate the PGP signature and move to sigstore exclusively by next year. If that happens, it will involve some changes in the way that Linux distributions verify Python releases, since none of the major distributions have processes for working with sigstore.

카테고리:

Security updates for Monday

월, 2024/10/21 - 11:16오후
Security updates have been issued by Debian (asterisk, chromium, php-horde-mime-viewer, and php-horde-turba), Fedora (apache-commons-io, buildah, chromium, containers-common, libarchive, libdigidocpp, oath-toolkit, podman, rust-hyper-rustls, rust-reqwest, rust-rustls-native-certs, rust-rustls-native-certs0.7, rust-tonic, rust-tonic-build, rust-tonic-types, rust-tower, rust-tower-http, rust-tower-http0.5, rust-tower0.4, thunderbird, and unbound), SUSE (buildah, chromedriver, chromium, element-desktop, element-web, jetty-annotations, nodejs-electron, php7, php74, php8, podman, python3-virtualbox, qemu, thunderbird, and valkey), and Ubuntu (amd64-microcode).
카테고리:

A vulnerability in the Guix build system

월, 2024/10/21 - 10:40오후

The Guix project has disclosed a security vulnerability in the build daemon that the distribution uses to build and install software locally. The vulnerability allows an existing unprivileged user to get access to a setuid binary, and from there potentially interfere with any other software built or installed on the computer. The project recommends upgrading the guix daemon now, to avoid the issue.

This exploit requires the ability to start a derivation build and the ability to run arbitrary code with access to the store in the root PID namespace on the machine the build occurs on. As such, this represents an increased risk primarily to multi-user systems and systems using dedicated privilege-separation users for various daemons: without special sandboxing measures, any process of theirs can take advantage of this vulnerability.
카테고리:

Kernel prepatch 6.12-rc4

월, 2024/10/21 - 7:48오전
Linus has released 6.12-rc4 for testing. "I'm not happy with how big this is - it's probably far from the biggest rc4 ever, but it _is_ the biggest rc4 we've had in the 6.x series at least in number of commits."
카테고리:

페이지