- Arch-general - lists.archlinux.org

Periodic aged package report
by Genes Lists 11 Oct '24

11 Oct '24

Periodic check of Arch out of date packages. This considered are purely my opinion of those that are sufficiently 'relevant'. Apologies to any others. The really good news is that there really aren't many ! Big congrats for the hard work keeping Arch awesome and up to date. Note that, some are excluded when they are work in progress and/or involve a significant amount of work (provided they are not "too" old, which none are). Arch is doing an amazing job keeping our core/key packages like compiler tools, python, systemd, kernel and other vital packages very up to date. What remains are a few that are relevant enough (imho) to make the list. I am using 3 metrics of age: - Num-B The number of releases we are behind Some packages have frequent updates some do not. - Age The number of days between the arch version and the latest - New: How recent was the latest released (days ago from today) Package Arch Curr Date num-b Age New ------------------ ---------- ------ -------- ------ ------ ---- apparmor 3.1.7-5 4.0.3 08/15/24 4 195 55 biber 1:2.19-4 2.20 03/21/24 1 321 202 dkms 3.0.12-1 3.1.0 10/01/24 2 373 8 python-cryptography 42.0.8-1 43.0.1 09/03/24 2 91 36 python-setuptools 1:69.5.1-1 75.1.0 09/13/24 22 153 26 yubioath-desktop 5.1.0-3 7.1.0 09/25/24 12 1234 14 (1) (1) Now called yubico-authenticator -- Gene

5 7

Valgrind problem
by Frank 07 Oct '24

07 Oct '24

Good evening, I'm trying to debug an issue with Evolution and the Gnome guys asked me to use valgrind. However, when running this command I get an error I'm stuck with: valgrind --num-callers=30 --leak-check=no --track-origins=yes /usr/lib/evolution-calendar-factory -w ==4915== Memcheck, a memory error detector ==4915== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al. ==4915== Using Valgrind-3.23.0 and LibVEX; rerun with -h for copyright info ==4915== Command: /usr/lib/evolution-calendar-factory -w ==4915== valgrind: Fatal error at startup: a function redirection valgrind: which is mandatory for this platform-tool combination valgrind: cannot be set up. Details of the redirection are: valgrind: valgrind: A must-be-redirected function valgrind: whose name matches the pattern: strcmp valgrind: in an object with soname matching: ld-linux-x86-64.so.2 valgrind: was not found whilst processing valgrind: symbols from the object with soname: ld-linux-x86-64.so.2 valgrind: valgrind: Possible fixes: (1, short term): install glibc's debuginfo valgrind: package on this machine. (2, longer term): ask the packagers valgrind: for your Linux distribution to please in future ship a non- valgrind: stripped ld.so (or whatever the dynamic linker .so is called) valgrind: that exports the above-named function using the standard valgrind: calling conventions for this platform. The package you need valgrind: to install for fix (1) is called valgrind: valgrind: On Debian, Ubuntu: libc6-dbg valgrind: On SuSE, openSuSE, Fedora, RHEL: glibc-debuginfo valgrind: valgrind: Note that if you are debugging a 32 bit process on a valgrind: 64 bit system, you will need a corresponding 32 bit debuginfo valgrind: package (e.g. libc6-dbg:i386). valgrind: valgrind: Cannot continue -- exiting now. Sorry. THX Frank

3 4

Delayed responsiveness on resume after upgrade
by SET 07 Oct '24

07 Oct '24

Hello, I just upgraded a host and noticed a waiting of about 90s before the desktop (KDE) becomes responsive (typing to unlock the screen, the mouse cursor can be moved). This was not the case before the upgrade. This box has 3 remote shares attached via sshfs. The delay to responsiveness is near immediate if it is suspended while the remote shares are not connected. With remote shares connected on suspend: [Sat Oct 5 12:05:03 2024] OOM killer enabled. [Sat Oct 5 12:05:03 2024] Restarting tasks ... done. [Sat Oct 5 12:05:03 2024] random: crng reseeded on system resumption [Sat Oct 5 12:05:03 2024] PM: suspend exit [Sat Oct 5 12:05:03 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off [Sat Oct 5 12:06:35 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:06:35 2024] Generic FE-GE Realtek PHY r8169-0-600:00: attached PHY driver (mii_bus:phy_addr=r8169-0-600:00, irq=MAC) [Sat Oct 5 12:06:35 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:06:39 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off With remote shares disconnected on suspend: [Sat Oct 5 12:10:55 2024] OOM killer enabled. [Sat Oct 5 12:10:55 2024] Restarting tasks ... done. [Sat Oct 5 12:10:55 2024] random: crng reseeded on system resumption [Sat Oct 5 12:10:55 2024] PM: suspend exit [Sat Oct 5 12:10:55 2024] Generic FE-GE Realtek PHY r8169-0-600:00: attached PHY driver (mii_bus:phy_addr=r8169-0-600:00, irq=MAC) [Sat Oct 5 12:10:56 2024] r8169 0000:06:00.0 eth0: Link is Down [Sat Oct 5 12:10:58 2024] r8169 0000:06:00.0 eth0: Link is Up - 1Gbps/ Full - flow control off It seems that the network link remains 'up' when the remote shares are connected, then has to go down and that's where the delay lies. Afterwards, it quickly returns to the up state. 'modinfo r8169' does not expose any option at all. I wish to know if there's a simple known solution to quickly resume the host. The root cause could also lie deep in the kernel and may perhaps disappear on a future upgrade. I can live with it, it's just annoying. Thanks for any input.

2 2

Re: Future of salt in our repositories
by Genes Lists 05 Oct '24

05 Oct '24

On Sat, 2024-10-05 at 17:36 +0200, Morten Linderud wrote: > Yo, > > `salt` is a framework for server provisioning, change management and > ... > `salt` as of version `3007` does not support Python 3.12, and the > release `3008` > seems far away, ... > salt is going for the vendor > approach they call `onedir` and instead bundle *everyting*, including > their own > Python runtime, into a directory. This is going to be a mess to > properly support > ... ... > As long as there are not any major issues I intend to drop this > package ahead of > our Python 3.13 release and prep work. Replying via general. This does indeed make a lot of sense. 'onedir' sounds pretty horrible. It might worthwhile noting that salt was acquired by VMware which in turn was acquired by broadcom a couple years ago. I have no views if this is significant for its future trajectory or not. I wonder if some people might be considering migrating to Ansible or another alternative? thanks for staying on top of things and keeping us informed. gene -- Gene

1 0

Estimate for Linux 6.11 to move from testing to core?
by David C. Rankin 02 Oct '24

02 Oct '24

All, Devs, I've been watching https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/issues to try and get a handle on when to expect the 6.11 kernel. I can't read the tea-leaves very well. Does anyone involved in the process have an estimate of when we should look for the new kernel to be released? I ask because I have one production box to update and want to set aside time in case I have to troubleshoot. Though thankfully, the 6.10 -> 6.11 update looks benign from a server standpoint. Are we just waiting on the i915 shadow frame-buffer issue or one of the other audio issues? -- David C. Rankin, J.D.,P.E.

4 4

Wayland performance issues after upgrading linux and nvidia
by Edward Toroshchyn 02 Oct '24

02 Oct '24

All, Just wanted to drop a short FYI here, in case you've also encountered issues running Wayland after updating linux (6.10.10.arch1-1 -> 6.11.1.arch1-1) and nvidia (560.35.03-6 -> 560.35.03-9). For me, downgrading helped: # cd /var/cache/pacman/pkg/; pacman -U nvidia-560.35.03-3-x86_64.pkg.tar.zst linux-6.10.8.arch1-1-x86_64.pkg.tar.zst I've reported the issue here: https://gitlab.archlinux.org/archlinux/packaging/packages/nvidia/-/issues/9 Worm regards, -- Edward

1 0

Recommended setup for synced password manager
by Georg 27 Sep '24

27 Sep '24

Dear list crowd, I'm looking for a synced password manager solution that connects my Arch PC with my android phone, and a Windows PC. I'd like to use my arch server as the nexus, and want to avoid commercial services by all means. One option I heard is using one or more keepass databases and keeping them in sync via syncthing. Another option seems to be bitwarden. Are there more good options? What do people use, that works well and painfree? What other options for automatic syncing of the keepass database would there be? I'd prefer short and on point answers without too much detail, but just a conceptual sketch. Thanks in advance, and maybe this benefits someone else as well. Georg

17 18

Re: Kernel with IMA and "better" secure boot / MOK support
by Johan Dahlberg 26 Sep '24

26 Sep '24

On 2024-09-26 16:52, simon-b(a)murena.io wrote: > Hi, > Hi, thanks for replying! Just to avoid any confusion, the setup I'm using already works the way I want, I'm just hoping to find a way to avoid custom kernels. > you can add public keys to the kernel keyring which are stored in a > hardware store (e.g. the UEFI key database). [0] This is mostly what I've been doing, using mokutil to store the mok cert in an efivar with shim. shim then pulls them in to the MokListRT efivar, which the kernel then validates against (if I understood it all correctly). But that is only as long as IMA is enabled in the kernel.. without IMA the .machine keyring never gets populated. The MOK keys will however end up in the .platform keyring even without IMA, but it will not trust them since they're not part of the chain the kernel trusts (.builtin_trusted_keys, or .secondary_trusted_keys). One would need to add one's own CA cert in the kernel build (and sign the modules with the same CA to make this work, I think. Documentation has left me a bit confused on this. > > You can also sign the modules with a MOK. [1] > I've also tried to do this, adding my MOK cert next to the Database cert from the UEFI secure boot setup, and then signing the the modules with the corresponding key. But the kernel still didn't want to trust this cert. Again I assume because the kernels chain of trust requires the MOK cert to come from the same CA as one of the .builtin_trusted_keys. Arch uses auto-generated keys on their kernel builds, so this can't work as far as I understand. And even they signed with their own keys, I'd need to sign my modules with the same key as them, which obviously wouldn't be possible. Perhaps there are facilities in the kernel I'm unaware of here but it seems to me the only way for a user to validate out-of-tree module signatures are with MOKs. Which is why I started thinking maybe there needs to be another official kernel that supports this. > Since I don't use external modules, I have not tested any of these > methods. Any modules that comes with the kernel will always pass validation and load since they share the same auto-generated key/cert. > > I am not sure how you use the IMA (e.g. wether you verify the PCR10 > from a TPM2), but an alternative could be > > a dm-verity signed root-fs, e.g. created with verity-squash-root [2]. > I believe the more advanced features of IMA are not needed in this scenario. In the case of being able to validate out-of-tree modules against MOK signatures all that is needed is CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT (as far as I can tell at least). > Best, > > Simon > > [0] > https://www.kernel.org/doc/html/v6.11/admin-guide/module-signing.html > > [1] > > https://gist.github.com/lijikun/22be09ec9b178e745758a29c7a147cc9 > > [2] > > https://aur.archlinux.org/packages/verity-squash-root > Regards, Johan > September 26, 2024 at 12:09 PM, "Johan Dahlberg" <joda(a)nejomi.net> > wrote: > >> For the last couple of years I've been rolling my own kernels on a >> couple of machines in order to have better support for secure boot >> and especially mok keys. This has been necessary for being able to >> boot with lockdown=confidentiality/integrity and still be able to >> load any signed out-of-tree (dkms) modules. The official kernels in >> arch is built without IMA support as it would break the ability to >> kexec to another kernel when secure boot is on (since the kernels >> are built with auto-generated keys, they would fail validation). >> There are some bug reports on the subject, see [1] and [2]. >> >> How I'm validating signed out-of-tree modules goes as following: >> >> - uefi to setup mode >> >> - create my own EFI keys, and enroll them >> >> - roll my own uki kernel (built with IMA) and sign it and it's >> modules and any out-of-tree modules >> >> - set uefi to boot shim.efi, which then calls grubx64.efi (which is >> just a renamed systemd-boot in my case) >> >> - shim passes on mok keys >> >> - systemd-boot boots the kernel with lockdown=confidentiality >> >> - kernel adds the keys passed from shim to the (.machine) keyring >> and successfully loads any modules signed with a key listed in mok >> >> It's been a while since I set it up so I might have misremembered >> some step there. >> >> Anyway to my question, since the situation with kexec and IMA is >> probably not going to change, and since there probably (?) are more >> people out there who would like to use the whole secure boot chain >> with MOKs and all, perhaps it would be possible to discuss providing >> another official kernel which is built to support the above >> scenario? I'm not too deep into the arch dev system and tools, but >> considering what I'm doing - just pulling the PKGBUILD and doing >> some minimal changes to the config and then building it, it seems it >> would not add too much of a maintenance overhead. >> >> Perhaps there are other ways of achieving the same results that I'm >> not aware of.. if so I'm curious to hear about it. Mostly I'm just >> trying to get out of having to use custom kernels. :-) >> >> Thanks for reading, >> >> Johan >> >> [1] https://bugs.archlinux.org/task/75102 >> >> [2] https://bugs.archlinux.org/task/75041

1 0

Re: strange Adwaita tray icon difficulties
by Abraham S.A.H. 26 Sep '24

26 Sep '24

Sep 26, 2024, 07:26 by daniel.ranc(a)telecom-sudparis.eu: > > Abraham, > > Thank you for this rant which i would have been too shy to write > myself on the list, but i am completely with you on that issue. I > would even add that major applications such as Thunderbird are, > at times, subject to very strange bugs and behaviors related to > "new features to make it slick", slickness in which i am not > interested at all, so that i always install Seamonkey as plan B. > > I relate these problems to project governance issues rather than > budget problems (which they are constantly invoking). Sad. > > Copy to my friend Tarus, who's involved in Open Source matters. > > Cheers > Daniel > > ps. i confess between us that the dinosaur that i am uses FVWM :-) > > > On 26/09/2024 03:02, Abraham S.A.H. wrote: > >> I have bitten by that too, on three systems that I maintain. Even on >> the one which uses Xfce desktop. This random breaking changes to GTK >> and Gnome related stuff is disrespectful to users. And the usuall >> answer is that “If you don’t like it, use something else!”; but they >> are damn everywhere. Gtk used to be the goto universal toolkit on >> GNU/Linux platform that everyone would use to make his/her app; now >> they are maintaining and developing it only for Gnome and Adwaita >> adhering apps. Anything based on GTK keeps not fitting in any other >> DE or any machine that Gnome project doesn’t like or care to support. >> >> And worst is, that any complaint anywhere usually results in aggressive >> or hostile responses. >> >> >> -- >> Best Regards, >> Abraham >> Sent with Tutanota; >> https://tuta.com >> Well, as far as I know, Gnome is one of the most sponsored Free Software projects. And The most sponsored open source desktop environment. And developers are mainly employees of the sponsers (mostly by Red Hat). It's often claimed that Gnome is a community project. Compare it with Emacs, which has about 19 mailing lists; one of them being the development mailing list (emacs-devel) that all development discussions happen openly there. And one can submit his/her patch or code to be included in Emacs! — and unlike Gnome, they even don't scream being a community software project. Actually, many of Emacs features are from the free volunteers that donated their code; just through this mailing list. In contrast, in Gnome, even major bug reports get closed as not planned or not supported, or that it’s not a bug in Gnome software, because you installed that package from your distro rather than Flatpak, or you installed that extension from AUR instead of web interface. And basically, there is no easy way for user-developers to change GTK or Gnome DE out of what Gnome project foresees. If a feature is not planned you are not allowed to implement it, even with two or three developers. — Well, seems fair, since you just implement it, but they have to maintain it. All that aside, Gnome project has its board and its developers and sponsors, and they have the right to decide about the direction. All okay. Problem arises when you have to pull in gtk4 and gtk3 packages only for installing ‘ibus’! Now, that one is ridiculous. And that is my whole point; gtk is everywhere because it was there from when none of these were an issue. -- Best Regards, Abraham Sent with Tutanota; https://tuta.com

1 0

Kernel with IMA and "better" secure boot / MOK support
by Johan Dahlberg 26 Sep '24

26 Sep '24

For the last couple of years I've been rolling my own kernels on a couple of machines in order to have better support for secure boot and especially mok keys. This has been necessary for being able to boot with lockdown=confidentiality/integrity and still be able to load any signed out-of-tree (dkms) modules. The official kernels in arch is built without IMA support as it would break the ability to kexec to another kernel when secure boot is on (since the kernels are built with auto-generated keys, they would fail validation). There are some bug reports on the subject, see [1] and [2]. How I'm validating signed out-of-tree modules goes as following: - uefi to setup mode - create my own EFI keys, and enroll them - roll my own uki kernel (built with IMA) and sign it and it's modules and any out-of-tree modules - set uefi to boot shim.efi, which then calls grubx64.efi (which is just a renamed systemd-boot in my case) - shim passes on mok keys - systemd-boot boots the kernel with lockdown=confidentiality - kernel adds the keys passed from shim to the (.machine) keyring and successfully loads any modules signed with a key listed in mok It's been a while since I set it up so I might have misremembered some step there. Anyway to my question, since the situation with kexec and IMA is probably not going to change, and since there probably (?) are more people out there who would like to use the whole secure boot chain with MOKs and all, perhaps it would be possible to discuss providing another official kernel which is built to support the above scenario? I'm not too deep into the arch dev system and tools, but considering what I'm doing - just pulling the PKGBUILD and doing some minimal changes to the config and then building it, it seems it would not add too much of a maintenance overhead. Perhaps there are other ways of achieving the same results that I'm not aware of.. if so I'm curious to hear about it. Mostly I'm just trying to get out of having to use custom kernels. :-) Thanks for reading, Johan [1] https://bugs.archlinux.org/task/75102 [2] https://bugs.archlinux.org/task/75041

1 0