Sync Updates for Week 14, 2024

EbonJaeger

If you are a Plasma user and are experiencing issues since the KDE Plasma 6 update, please head on over to the Plasma 6 Megathread. Your issue may have already been posted and addressed there.

brent

EbonJaeger xz was updated to 5.4.6-37

We regressed with xz instead of 5.6.1-2. Interesting strategy. I've read many are doing it. Was 5.6.1-2 ineffective?
Rebooting now, thanks.

Harvey

brent
I double checked my VM that uses the stable repo before updating, this is not new we downgraded to 5.4.6 last week.

The additional change was making it so other applications can not statically link against xz as an extra precaution given recent events.

riffer

brent

I think they are trying to get a version before the bad actors became involved. All of 5.6.x apparently is being considered "untrusted".

brent

Harvey yeah I read way too much about that one. you guys see wild cve's all the time and have way better context than me. this to me seems like the entire linux world dodged a bullet--this looks a milestone event. or an over-hyped one? I don't know.

FAb7D

EbonJaeger ...Poppler is now built with additional advanced...
I would like to point out here that I believe that Propler needs to be updated again(to 24.04) due to problems with some PDFs.
https://github.com/getsolus/packages/issues/2095.

FAb7D

riffer ...I had read about a backdor on 5.6 that maybe involved the developer himself... https://nvd.nist.gov/vuln/detail/CVE-2024-3094, a risk for a couple of months, especially for servers I heard... the downside of being so up to date.

brent

riffer 5-6-2 was supposed to be the answer last week--even Arch used 5-6-2 as a patch-- but apparently some of the linux world reconsidered this b/c more sytemd libraries may have been targeted (beyond libzma or whatever its called).

FAb7D
one of those .gov links goes to the creator Lasse Collin himself, who has revised his page a handful of times to reflect new info: https://tukaani.org/xz-backdoor/

you are right. skip down to the last line. He's wrote the 5.6.X line off, it appears.

hakimjonas

But python 2.7 is still default? When will that change?

alfisya

hakimjonas AFAIK when these tasks are done :

hakimjonas

alfisya thank you!

Stumbled-Upon

I see no issues with the update(*) and am very glad by the keyboard layout indicator on XFCE. (Also manually enabled system sound and feedback.) Thank you 🙂

P.S. Thank you for taking a consideratably and careful care of the security issue(s). It's appreciated.

(*) I have some difference with how FF handles CTL/BiDi on this XFCE install compared to previous other DE's, which affects learning on a local site, but that's from before the update and unsure what the cause/nature of it. I am aware the XFCE is in beta and as said the difference could be due to something I did or "didn't".
Update on the firefox localization/CTL/BiDi issue on a local site: after some trial and error, replaced fonts to the local version for my local language. This seemed to work.

Harvey

discord 0.0.48 and keybase permissions fix cherry-picked.

zmaint

Plasma, just did updates. Saw this.
Failed to record path /usr/share/fonts/conf.d/66-noto-color-emoji.conf.newconfig

sudo eopkg check shows all OK.

Thought I remembered someone posting after the 6 upgrade that there were emoji issues so I thought I'd share.

SilverBird775

zmaint
It was probably me because it looks like everyone else is unaffected.
Yes, Noto Color Emoji fallback config was removed:
https://github.com/getsolus/packages/commit/d72a6ca0526022c426ba1fdf29af9a018cc47868
To get back Emojis for Plasma and Qt applications instead of blank boxes you had to put the removed config 66-noto-color-emoji.conf and symlink where they was. That's how i fixed it.

zmaint

SilverBird775 Oddly enough my emojis are working without issue. I can't say I emoji a whole lot tho lol.

Axios

Synced an old install of mate everything went ok and is working fine.

Harvey

discord 0.0.49 cherry-picked.