Sync Update for Week 41, 2023

EbonJaeger

Heya folks! We have a lot of items to share this week. Let’s start off with yet more CVE security fixes.

First up is curl, which had two CVE fixes this week, CVE-2023-38545 and CVE-2023-38546. These issues have a severity of HIGH. You can read this blog post for more information. Secondly, we have a security fix for libcue, a library for parsing and extracting data from CUE sheets. CVE-2023-43641 enables GNOME users to be exploited by downloading a malicious cue sheet from a webpage. See this article for more information. Both fixes were cherry-picked to Stable during the week. As always, please make sure you are fully updated!

@ReillyBrogan switched Solus to using systemd-resolved by default, following other distributions. This enables the use of a centralized DNS cache, improving compatibility with VPNs that push DNS servers via NetworkManager integration. The NCSD cache has been disabled, since it is superseded by systemd-resolved. Detailed information about these changes in Fedora can be found here and here. Due to positive feedback in testing, the BORE scheduler has also been enabled by default in this week’s kernel update.

We’ve made some changes to our Firefox package, in addition to updating it to 118.0.2:

Launch in Wayland by default (does not affect Budgie or MATE)
Switch to managing langpacks similar to Fedora
- This should hopefully fix issues with language preferences being reset after updates.
- If it does not fix the issue, then please let us know here.
Use more shared system libraries instead of bundled ones
Fix default browser detection

@ZachBacon has been hard at work updating our GNOME stack to 45.0. As always, the GNOME stack has taken a lot of work, but it is nearing completion. Keep an eye out for more information regarding this upgrade in Solus Soon:™:! It’s anticipated that this will land in Unstable over the weekend, which means that sync will be deferred next week for testing!

We’re almost halfway through Hacktoberfest already, and we have received and merged almost 60 pull requests adding homepages to packages! If you would like to help out, there’s still plenty of time left, and these tasks aren’t going away! If you’ve never done packaging before, check out our Help Center packaging articles to get started, and check out the issues labeled Good First Issue on our issue tracker.

Other changes this week:

Core system

Linux-current 6.5.7 and linux-lts 5.15.135
Pipewire v0.3.82
Our glibc package had the way it did hwcaps changed to the newer method. Hwcaps are special libraries compiled for newer processors that are loaded on-demand for CPUs that support those instructions. This won’t have any user-facing impact but it does open up the update to a newer glibc!
Network-manager saw an overhaul land this sync. It should now use the internal dhcp client rather than the deprecated ISC dhclient, let us know if you have any issues with this. It should also now integrate better with systemd for the network-online target.
libicu 73.2 (Thanks Zach!)
libwebkit-gtk 2.42.1 (Thanks Zach!)
Libvirt now supports firewalld (optional) (Thanks Evan!)
sqlite 3.43.2
containerd 1.7.7
curl 8.4.0 (Thanks Silke!)
modem-manager 1.20.6 (Thanks Zach!)
libblockdev 3.0.4!<

Codecs (All done by ReillyBrogan except for gstreamer)

dav1d 1.3.0
aom 3.7.0
libvpx 1.13.1
X264 and x265 drivers updated to latest stable
svt-av1 1.7.0
libpng v1.6.40
libjpeg-turbo 2.1.5.1
avidemux 2.8.1
libavif 1.0.1
rav1e 0.6.6
gstreamer 1.22.6 (Thanks Zach!)!<

Apps

Yubico-authenticator 6.3.0
bitwarden-desktop v2023.9.2
signal-desktop v6.33.0
font-util 1.4.1
freecad 0.21.1 (Thanks Algent!)
texstudio 4.6.3 (Thanks Algent!)
Seafile 9.0.4 (Thanks FriesischScott!)
cinelerra-gg 2023.09.30
darktable 4.4.2
kitty 0.30.1 (Thanks Nazar!)
heaptrack 1.5.0 (Thanks Joey!)
lagrange 1.17.0 (Thanks David!)
rymdport 3.5.1 (Thanks David!)
neovim 0.9.4 (Thanks Evan!)
languagetool 6.3 (Thanks Nazar!)
go-task 3.31.0
yubikey-manager 5.2.1
rstudio 2023.09.0.463 (Thanks Joey!)
thunderbird 115.3.2 (Thanks Harvey!)
firefox 118.0.2 (Thanks Harvey!)
element 1.11.46 (Thanks Silke!)
hydrogen 1.2.2 (Thanks Algent!)
conky 1.19.5 (Thanks Algent!)
carla 2.5.7 (Thanks Algent!)
eza 0.14.1 (Thanks Evan!)
caddy 2.7.5 (Thanks Evan!)
mixxx 2.3.6 (Thanks Evan!)
brave 1.59.117 (Thanks Algent!)
bat 0.24.0 (Thanks Algent!)
openimageio 2.4.16.0 (Thanks Joey!)
matplotlib 3.8.0 (Thanks Algent!)
amdgpu_top 0.2.1
poedit 3.4 (Thanks Algent!)
yt-dlp 2023.10.13 (Thanks Harvey!)
neovide added to the repos! This is a graphical client for neovim written in Rust (Thanks Achilleshiel!)
zellij added to the repos! This is a terminal multiplexer like tmux written in Rust (Thanks Evan!)!<

Gaming

wesnoth 1.16.10 (Thanks Joey!)
ppsspp 1.16.6!<

Theming/Fonts

numix-icon-theme-circle 23.10.09 (Thanks Algent!)
numix-icon-theme-square 23.10.09 (Thanks Algent!)
adw-gtk3-theme 5.0 (Thanks Evan!)
font-iosevka-ttf 27.2.0 (Thanks Malfisya!)
font-tlwg-ttf 0.7.3 (Thanks Malfisya!)!<

Languages

Golang 1.21.2
networkx v3.1
Rust package now contains rustdoc
nodejs 18.18.0
graph-tool 2.58
yarn 1.22.19
cmake 3.27.7 (Thanks Staudey!)
meson 1.2.2 (Thanks Zach!)!<

That’s it for this week, folks! Keep a look-out for more news next week! And remember, there will be no sync next week.

unclemez

EbonJaeger
I Love this presentation.
Would be cool if the contributor name could be clickable or we just over mouse pointer on it and see avatar and info about the person who worked to make us all proud and cool!
Good job Y'all!

EbonJaeger

RESERVED FOR CELTIC MAGIC

MintSpider

EbonJaeger But I am a Rangers fan! 😃

EbonJaeger

I tried a new thing with spoiler tags, but adding them is a pain because they have to be in just the right place. Still didn't quite get it right. Hrm...

ermo

EbonJaeger I tried a new thing with spoiler tags, but adding them is a pain because they have to be in just the right place. Still didn't quite get it right. Hrm...

I find them super useful, so if you get them working eventually, I feel it will have been worth it! 😍

Solarmass

EbonJaeger I tried a new thing with spoiler tags, but adding them is a pain because they have to be in just the right place. Still didn't quite get it right. Hrm...

It's fine without spoilers! I read everything anyway! 😛

brent

thanks for the CVE info and VERY interesting about firefox/wayland (I don't remember a discussion about that one but things get by me) plus this "Use more shared system libraries instead of bundled ones."

You guys and girls have been busy. I had 1GB of updates, can't remember that in a while. 106 packages plus a reboot. Everything checks out. Themes, folders, apps all seem ok.

ReillyBrogan

brent Specifically it now uses the system versions of libaom, libdav1d, libvpx, libwebp, and libwebpdemux.

ermo

ReillyBrogan brent Specifically it now uses the system versions of libaom, libdav1d, libvpx, libwebp, and libwebpdemux.

Oh, wait, does that imply that these new libs uses joey's new glibc hwcaps work? I.e., they will support AVX2 and whatnot if the CPU supports it and mesa/nvidia hwdecode of the GPU supports it?

brent

( : @EbonJaeger but to anyone) the daniel sternberg (curl creator orcurl el jefe) explanation was fascinating. he apologized. "I can't believe I didnt see it before" he says. The old way of doing things was to switch the state of things when I filename length (as I understand it) couldn't be resolved instead of adhering to policy and failing to resolve. In that I can see the CVE. this stuff is always buried deep in the catalogs they say.
This caught my eye:

bounty hunting is part of your gig?

@ReillyBrogan thank you for specifics I want to read more about this FF makeover at mozilla later although Brinkman probably has 4 pages about but I've outgrown ghacks. I digress🙂

ReillyBrogan

ermo Yes, if they're built with that option. Some of the referenced libs are.

elusian

With the new update conky seems to be segfaulting inside libcairo

algent

elusian Please report your issue here: https://github.com/getsolus/packages/issues/new/choose

olivir

elusian I don't have segdefault as you mentionned on github but my conky desn't boot, I suppose lua script is not loaded too.

presianbg

Hi,

Nice, having such informative posts is really awesome.
Just an idea: bring them to the main website as a regular blog post as it was used to be:
https://getsol.us/2017/05/08/this-week-in-solus-install-44/
and link the discussion here.

Not every newcomer is checking the forums (not sure about that), but everyone considering switching / trying Solus will take a look at the main website / blog. Having more posts there is proving the project is VERY VERY active, which will lead to more users (again not sure about this statement, just thinking aloud).

PS: for those of us using dnscrypt and pi-holes at home, what would be the best way to disable the systemd-resolved ? I tried to disable and mask the service, but something keeps removing my custom /etc/resolv.conf ?
I really appreciate having one more option to choose from, systemd-resolved is not my thing.

Cheers,
PY

ReillyBrogan

presianbg

sudo mkdir -p /etc/tmpfiles.d/
sudo ln -sv /dev/null /etc/tmpfiles.d/systemd-resolve.conf

This will disable tmpfilesd from re-creating the /etc/resolve symlink on boot. Although, why not just configure systemd-resolve to use your pi-hole as the DNS server? That would work just as well.

presianbg

ReillyBrogan

Thanks, I will try that.
I would like to use the dnscrypt-proxy as my local resolver. (for many reasons and functionalities, which are not covered by systemd-resolved).

Cheers,
PY

elusian

olivir

The segfault is only visible if you open conky in the debugger, but yes, the visible symptom is conky not opening (because the segfault causes it to crash on startup).

ReillyBrogan

presianbg Ah, I assume you need DNSSEC support then? It's a shame that systemd-resolve doesn't have good support for it yet, that was a huge point of contention when we were discussing integrating it. systemd-resolve is a huge QOL feature for most users however which is why it won out it the end. It integrates quite seamlessly with NetworkManager which means that VPNs that push out DNS servers work pretty much as users expect them to (combined with DNS routes received when roaming between different networks). I've got a bunch of DNSSEC-related issues followed on the systemd tracker so hopefully once the issues are resolved we can enable DNSSEC again by default.

Side-note, would you be interested in becoming the maintainer for dnsscrypt-proxy? I notice it hasn't been updated in a while and usually it's best if people who are actively using a package are the ones who keep it updated.