- Arch-general - lists.archlinux.org

Network Issues After Pacman Upgrade
by Björn Försterling 14 Oct '24

14 Oct '24

Hello, I just ran a "pacman -Syu" and am having issues with the internet connection. I have around 10 seconds with a working connection to the internet followed by 10 seconds without being able to establish a connection. For 10 seconds I am able to curl google.com or telnet its port 443, and then I get blocked for 10 seconds. There was an update to "networkmanager": [2024-10-13T15:39:41+0200] [ALPM] upgraded networkmanager (1.48.10-1 -> 1.50.0-1) Could this be the cause? Does anyone else experience similar problems? I had the same problem a few weeks ago. Regards Björn

5 5

Strange config /etc/profile.d/utf8.sh added on recent upgrade
by Tadeas Uhlir 13 Oct '24

13 Oct '24

Hey all, Today, I noticed that my alias for "ls" is not working as usual. I alias "ll" to "LC_COLLATE=C ls -alF" to have a long listing with hidden dirs at the top. However, I noticed that the sorting doesn't work all of a sudden. After some digging around I found out that this is due to "LC_ALL" being set to "en_US.utf8". This variable is being set from a file at "/etc/profile.d/utf8.sh". Two notes about this: 1. For the life of me I cannot figure out which package upgrade/install created this file. Just going by a pacman log the file creation time corresponds to when "pacman --noconfirm -S autoconf libtool m4 automake" ran. But those packages don't seem to have much to do with locale. And googling the path of this file doesn't seem to yield much, clearly it's not a very common config file across linux distros. 2. Once I find the culprit, I would love to know what is the rationale behind explicitly setting "LC_ALL". Even the archwiki mentions that this should only be done during tests: https://wiki.archlinux.org/title/Locale#LC_ALL:_troubleshooting . And, indeed, seems like a bad idea given that it overrides all LC_ vars. -- Best Regards, Tadeáš Uhlíř

2 2

Periodic aged package report
by Genes Lists 11 Oct '24

11 Oct '24

Periodic check of Arch out of date packages. This considered are purely my opinion of those that are sufficiently 'relevant'. Apologies to any others. The really good news is that there really aren't many ! Big congrats for the hard work keeping Arch awesome and up to date. Note that, some are excluded when they are work in progress and/or involve a significant amount of work (provided they are not "too" old, which none are). Arch is doing an amazing job keeping our core/key packages like compiler tools, python, systemd, kernel and other vital packages very up to date. What remains are a few that are relevant enough (imho) to make the list. I am using 3 metrics of age: - Num-B The number of releases we are behind Some packages have frequent updates some do not. - Age The number of days between the arch version and the latest - New: How recent was the latest released (days ago from today) Package Arch Curr Date num-b Age New ------------------ ---------- ------ -------- ------ ------ ---- apparmor 3.1.7-5 4.0.3 08/15/24 4 195 55 biber 1:2.19-4 2.20 03/21/24 1 321 202 dkms 3.0.12-1 3.1.0 10/01/24 2 373 8 python-cryptography 42.0.8-1 43.0.1 09/03/24 2 91 36 python-setuptools 1:69.5.1-1 75.1.0 09/13/24 22 153 26 yubioath-desktop 5.1.0-3 7.1.0 09/25/24 12 1234 14 (1) (1) Now called yubico-authenticator -- Gene

5 7

Valgrind problem
by Frank 07 Oct '24

07 Oct '24

Good evening, I'm trying to debug an issue with Evolution and the Gnome guys asked me to use valgrind. However, when running this command I get an error I'm stuck with: valgrind --num-callers=30 --leak-check=no --track-origins=yes /usr/lib/evolution-calendar-factory -w ==4915== Memcheck, a memory error detector ==4915== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al. ==4915== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info ==4915== Command: /usr/lib/evolution-calendar-factory -w ==4915== valgrind: Fatal error at startup: a function redirection valgrind: which is mandatory for this platform-tool combination valgrind: cannot be set up. Details of the redirection are: valgrind: valgrind: A must-be-redirected function valgrind: whose name matches the pattern: strcmp valgrind: in an object with soname matching: ld-linux-x86-64.so.2 valgrind: was not found whilst processing valgrind: symbols from the object with soname: ld-linux-x86-64.so.2 valgrind: valgrind: Possible fixes: (1, short term): install glibc's debuginfo valgrind: package on this machine. (2, longer term): ask the packagers valgrind: for your Linux distribution to please in future ship a non- valgrind: stripped ld.so (or whatever the dynamic linker .so is called) valgrind: that exports the above-named function using the standard valgrind: calling conventions for this platform. The package you need valgrind: to install for fix (1) is called valgrind: valgrind: On Debian, Ubuntu: libc6-dbg valgrind: On SuSE, openSuSE, Fedora, RHEL: glibc-debuginfo valgrind: valgrind: Note that if you are debugging a 32 bit process on a valgrind: 64 bit system, you will need a corresponding 32 bit debuginfo valgrind: package (e.g. libc6-dbg:i386). valgrind: valgrind: Cannot continue -- exiting now. Sorry. THX Frank

3 4

Delayed responsiveness on resume after upgrade
by SET 07 Oct '24

07 Oct '24

Hello, I just upgraded a host and noticed a waiting of about 90s before the desktop (KDE) becomes responsive (typing to unlock the screen, the mouse cursor can be moved). This was not the case before the upgrade. This box has 3 remote shares attached via sshfs. The delay to responsiveness is near immediate if it is suspended while the remote shares are not connected. With remote shares connected on suspend: [Sat Oct 5 12:05:03 2024] OOM killer enabled. [Sat Oct 5 12:05:03 2024] Restarting tasks ... done. [Sat Oct 5 12:05:03 2024] random: crng reseeded on system resumption [Sat Oct 5 12:05:03 2024] PM: suspend exit [Sat Oct 5 12:05:03 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off [Sat Oct 5 12:06:35 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:06:35 2024] Generic FE-GE Realtek PHY r8169-0-600:00: attached PHY driver (mii_bus:phy_addr=r8169-0-600:00, irq=MAC) [Sat Oct 5 12:06:35 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:06:39 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off With remote shares disconnected on suspend: [Sat Oct 5 12:10:55 2024] OOM killer enabled. [Sat Oct 5 12:10:55 2024] Restarting tasks ... done. [Sat Oct 5 12:10:55 2024] random: crng reseeded on system resumption [Sat Oct 5 12:10:55 2024] PM: suspend exit [Sat Oct 5 12:10:55 2024] Generic FE-GE Realtek PHY r8169-0-600:00: attached PHY driver (mii_bus:phy_addr=r8169-0-600:00, irq=MAC) [Sat Oct 5 12:10:56 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:10:58 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off It seems that the network link remains 'up' when the remote shares are connected, then has to go down and that's where the delay lies. Afterwards, it quickly returns to the up state. 'modinfo r8169' does not expose any option at all. I wish to know if there's a simple known solution to quickly resume the host. The root cause could also lie deep in the kernel and may perhaps disappear on a future upgrade. I can live with it, it's just annoying. Thanks for any input.

2 2

Re: Future of salt in our repositories
by Genes Lists 05 Oct '24

05 Oct '24

On Sat, 2024-10-05 at 17:36 +0200, Morten Linderud wrote: > Yo, > > `salt` is a framework for server provisioning, change management and > ... > `salt` as of version `3007` does not support Python 3.12, and the > release `3008` > seems far away, ... > salt is going for the vendor > approach they call `onedir` and instead bundle *everyting*, including > their own > Python runtime, into a directory. This is going to be a mess to > properly support > ... ... > As long as there are not any major issues I intend to drop this > package ahead of > our Python 3.13 release and prep work. Replying via general. This does indeed make a lot of sense. 'onedir' sounds pretty horrible. It might worthwhile noting that salt was acquired by VMware which in turn was acquired by broadcom a couple years ago. I have no views if this is significant for its future trajectory or not. I wonder if some people might be considering migrating to Ansible or another alternative? thanks for staying on top of things and keeping us informed. gene -- Gene

1 0

Estimate for Linux 6.11 to move from testing to core?
by David C. Rankin 02 Oct '24

02 Oct '24

All, Devs, I've been watching https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues to try and get a handle on when to expect the 6.11 kernel. I can't read the tea-leaves very well. Does anyone involved in the process have an estimate of when we should look for the new kernel to be released? I ask because I have one production box to update and want to set aside time in case I have to troubleshoot. Though thankfully, the 6.10 -> 6.11 update looks benign from a server standpoint. Are we just waiting on the i915 shadow frame-buffer issue or one of the other audio issues? -- David C. Rankin, J.D.,P.E.

4 4

Wayland performance issues after upgrading linux and nvidia
by Edward Toroshchyn 02 Oct '24

02 Oct '24

All, Just wanted to drop a short FYI here, in case you've also encountered issues running Wayland after updating linux (6.10.10.arch1-1 -> 6.11.1.arch1-1) and nvidia (560.35.03-6 -> 560.35.03-9). For me, downgrading helped: # cd /var/cache/pacman/pkg/; pacman -U nvidia-560.35.03-3-x86_64.pkg.tar.zst linux-6.10.8.arch1-1-x86_64.pkg.tar.zst I've reported the issue here: https://gitlab.archlinux.org/archlinux/packaging/packages/nvidia/-/issues/9 Worm regards, -- Edward

1 0

Recommended setup for synced password manager
by Georg 27 Sep '24

27 Sep '24

Dear list crowd, I'm looking for a synced password manager solution that connects my Arch PC with my android phone, and a Windows PC. I'd like to use my arch server as the nexus, and want to avoid commercial services by all means. One option I heard is using one or more keepass databases and keeping them in sync via syncthing. Another option seems to be bitwarden. Are there more good options? What do people use, that works well and painfree? What other options for automatic syncing of the keepass database would there be? I'd prefer short and on point answers without too much detail, but just a conceptual sketch. Thanks in advance, and maybe this benefits someone else as well. Georg

17 18

Re: Kernel with IMA and "better" secure boot / MOK support
by Johan Dahlberg 26 Sep '24

26 Sep '24

On 2024-09-26 16:52, simon-b(a)murena.io wrote: > Hi, > Hi, thanks for replying! Just to avoid any confusion, the setup I'm using already works the way I want, I'm just hoping to find a way to avoid custom kernels. > you can add public keys to the kernel keyring which are stored in a > hardware store (e.g. the UEFI key database). [0] This is mostly what I've been doing, using mokutil to store the mok cert in an efivar with shim. shim then pulls them in to the MokListRT efivar, which the kernel then validates against (if I understood it all correctly). But that is only as long as IMA is enabled in the kernel.. without IMA the .machine keyring never gets populated. The MOK keys will however end up in the .platform keyring even without IMA, but it will not trust them since they're not part of the chain the kernel trusts (.builtin_trusted_keys, or .secondary_trusted_keys). One would need to add one's own CA cert in the kernel build (and sign the modules with the same CA to make this work, I think. Documentation has left me a bit confused on this. > > You can also sign the modules with a MOK. [1] > I've also tried to do this, adding my MOK cert next to the Database cert from the UEFI secure boot setup, and then signing the the modules with the corresponding key. But the kernel still didn't want to trust this cert. Again I assume because the kernels chain of trust requires the MOK cert to come from the same CA as one of the .builtin_trusted_keys. Arch uses auto-generated keys on their kernel builds, so this can't work as far as I understand. And even they signed with their own keys, I'd need to sign my modules with the same key as them, which obviously wouldn't be possible. Perhaps there are facilities in the kernel I'm unaware of here but it seems to me the only way for a user to validate out-of-tree module signatures are with MOKs. Which is why I started thinking maybe there needs to be another official kernel that supports this. > Since I don't use external modules, I have not tested any of these > methods. Any modules that comes with the kernel will always pass validation and load since they share the same auto-generated key/cert. > > I am not sure how you use the IMA (e.g. wether you verify the PCR10 > from a TPM2), but an alternative could be > > a dm-verity signed root-fs, e.g. created with verity-squash-root [2]. > I believe the more advanced features of IMA are not needed in this scenario. In the case of being able to validate out-of-tree modules against MOK signatures all that is needed is CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT (as far as I can tell at least). > Best, > > Simon > > [0] > https://www.kernel.org/doc/html/v6.11/admin-guide/module-signing.html > > [1] > > https://gist.github.com/lijikun/22be09ec9b178e745758a29c7a147cc9 > > [2] > > https://aur.archlinux.org/packages/verity-squash-root > Regards, Johan > September 26, 2024 at 12:09 PM, "Johan Dahlberg" <joda(a)nejomi.net> > wrote: > >> For the last couple of years I've been rolling my own kernels on a >> couple of machines in order to have better support for secure boot >> and especially mok keys. This has been necessary for being able to >> boot with lockdown=confidentiality/integrity and still be able to >> load any signed out-of-tree (dkms) modules. The official kernels in >> arch is built without IMA support as it would break the ability to >> kexec to another kernel when secure boot is on (since the kernels >> are built with auto-generated keys, they would fail validation). >> There are some bug reports on the subject, see [1] and [2]. >> >> How I'm validating signed out-of-tree modules goes as following: >> >> - uefi to setup mode >> >> - create my own EFI keys, and enroll them >> >> - roll my own uki kernel (built with IMA) and sign it and it's >> modules and any out-of-tree modules >> >> - set uefi to boot shim.efi, which then calls grubx64.efi (which is >> just a renamed systemd-boot in my case) >> >> - shim passes on mok keys >> >> - systemd-boot boots the kernel with lockdown=confidentiality >> >> - kernel adds the keys passed from shim to the (.machine) keyring >> and successfully loads any modules signed with a key listed in mok >> >> It's been a while since I set it up so I might have misremembered >> some step there. >> >> Anyway to my question, since the situation with kexec and IMA is >> probably not going to change, and since there probably (?) are more >> people out there who would like to use the whole secure boot chain >> with MOKs and all, perhaps it would be possible to discuss providing >> another official kernel which is built to support the above >> scenario? I'm not too deep into the arch dev system and tools, but >> considering what I'm doing - just pulling the PKGBUILD and doing >> some minimal changes to the config and then building it, it seems it >> would not add too much of a maintenance overhead. >> >> Perhaps there are other ways of achieving the same results that I'm >> not aware of.. if so I'm curious to hear about it. Mostly I'm just >> trying to get out of having to use custom kernels. :-) >> >> Thanks for reading, >> >> Johan >> >> [1] https://bugs.archlinux.org/task/75102 >> >> [2] https://bugs.archlinux.org/task/75041

1 0