Gentoo Archives: gentoo-gwn

From: Ulrich Plate <plate@g.o>
To: gentoo-gwn@××××××××××××.org
Subject: [gentoo-gwn] Gentoo Weekly Newsletter 22 November 2004
Date: Mon, 22 Nov 2004 02:49:06
Message-Id: 20041122033639.44df70f8.plate@gentoo.org
1 ---------------------------------------------------------------------------
2 Gentoo Weekly Newsletter
3 http://www.gentoo.org/news/en/gwn/current.xml
4 This is the Gentoo Weekly Newsletter for the week of 15 November 2004.
5 ---------------------------------------------------------------------------
6
7 ==============
8 1. Gentoo News
9 ==============
10
11 Gentoo 2004.3 x86 release on DVD
12 --------------------------------
13
14 The Gentoo Store[1] now delivers the entire 2004.3 release for the x86
15 architecture, including all binary packages for the supported
16 subarchitectures (x86, i686, Pentium 3, Pentium 4 and Athlon XP) on a
17 single bootable DVD.
18 1. store.gentoo.org
19 It also provides a set of two DVDs that contains a complete archive of the
20 2004.3 release distfiles, including all necessary source code except for
21 the games category that was omitted for space reasons. The store profits
22 go partly to the Gentoo Foundation, helping in establishing the
23 not-for-profit entity, the server infrastructure and other Gentoo
24 development-related support.
25
26 Gentoo documentation updates and extensions
27 -------------------------------------------
28
29 A flurry of activity coming from kernel developer Daniel Drake[2] has
30 enriched the Gentoo documentation last week. Aside from updates to
31 numerous kernel guides and primers, he also authored a mantelpiece for the
32 Gentoo documentation collection, a brandnew "Complete Gentoo Linux 2.6
33 Migration Guide"[3] that answers all the questions that Gentoo users
34 moving on from the 2.4 kernel series may have.
35 2. dsd@g.o
36 3. http://www.gentoo.org/doc/en/migration-to-2.6.xml
37
38 On the workflow side of things the documentation team has been preoccupied
39 with a few shortcomings of AxKit for a while, i.e. the XML preprocessor
40 responsible for converting the internal XML structure of all web-hosted
41 content at www.gentoo.org to HTML. AxKit is running only with Apache v1,
42 for example, and looks somewhat unmaintained with its lack of significant
43 updates for some time. Xavier Neys[4] and Sven Vermeulen[5] have therefore
44 started replacing AxKit with gorg[6], its promising successor capable of
45 delivering the missing features. As always, the update page[7] of the
46 documentation project has all these and other important changes, including
47 some gruesome work done on existing files to make the translators' job a
48 little easier.
49 4. neysx@g.o
50 5. swift@g.o
51 6. http://dev.gentoo.org/~neysx/gorg/gorg.html
52 7. http://www.gentoo.org/proj/en/gdp/status/status_20041121.xml
53
54 ==============
55 2. Future zone
56 ==============
57
58 Portage CVS
59 -----------
60
61 Sometimes it's nice to show to the users that there's a fair amount of
62 work going into Portage, despite the gaps between stable releases. Portage
63 2.0.51 hasn't been out more than a month, but its CVS version now has - in
64 a mostly stable fashion - the following features:
65
66 * confcache
67 * prelink (auto-prelink binaries as they are merged)
68 * verify-rdepend (verify a package links only to stated rdepends)
69 * userpriv_fakeroot (run install phase under fakeroot, removing the need
70 for root privs from all building phases but setup)
71
72 Aside from feature additions, and code cleanup that's already started,
73 --regen (checking and updating the dependency path) is now 33% faster, and
74 metadata updates (post rsync'ing) are quicker by almost half in baseline
75 tests.
76
77 Then there's the work on the environment settings. Ebuilds now should be
78 able to be completely uninstalled without anything of the tree existing.
79 Nothing but the relevant profile is needed for this, which basically means
80 that Portage developers can start modifying eclasses again without having
81 to worry about backwards compatability going back years.
82
83 Also - nifty little trick - the old "I updated ssl, libssl.so got shifted,
84 and now wget won't work and I can't fetch any sources" issue is addressed
85 via a bundled Python-based fetch implementation - if the exit code from
86 the fetch call is indicative of missing libraries or binaries, it tries
87 the bundled lib instead. In tests Brian Herring has done in a system
88 gutted of openssl, the bundled lib has soldiered on, promising that users
89 could get out of that jam.
90
91 Some work is going into sync refactoring, too: The CVS format was made
92 more flexible, and snapshot support was added in, meaning the need for
93 emerge-webrsync is vanishing.
94
95 The CVS development is a bit embryonic at the moment, with a lot of work
96 left, but these and more changes will not take long before they come your
97 way - the diff between portage-2.0.51 and the version in CVS is already
98 larger than 400KB.
99
100 ==================
101 3. Gentoo security
102 ==================
103
104 Ruby: Denial of Service issue
105 -----------------------------
106
107 The CGI module in Ruby can be sent into an infinite loop, resulting in a
108 Denial of Service condition.
109
110 For more information, please see the GLSA Announcement[8]
111 8. http://www.gentoo.org/security/en/glsa/glsa-200411-23.xml
112
113 BNC: Buffer overflow vulnerability
114 ----------------------------------
115
116 BNC contains a buffer overflow vulnerability that may lead to Denial of
117 Service and execution of arbitrary code.
118
119 For more information, please see the GLSA Announcement[9]
120 9. http://www.gentoo.org/security/en/glsa/glsa-200411-24.xml
121
122 SquirrelMail: Encoded text XSS vulnerability
123 --------------------------------------------
124
125 Squirrelmail fails to properly sanitize user input, which could lead to a
126 compromise of webmail accounts.
127
128 For more information, please see the GLSA Announcement[10]
129 10. http://www.gentoo.org/security/en/glsa/glsa-200411-25.xml
130
131 GIMPS, SETI@home, ChessBrain: Insecure installation
132 ---------------------------------------------------
133
134 Improper file ownership allows user-owned files to be run with root
135 privileges by init scripts.
136
137 For more information, please see the GLSA Announcement[11]
138 11. http://www.gentoo.org/security/en/glsa/glsa-200411-26.xml
139
140 Fcron: Multiple vulnerabilities
141 -------------------------------
142
143 Multiple vulnerabilities in Fcron can allow a local user to potentially
144 cause a Denial of Service.
145
146 For more information, please see the GLSA Announcement[12]
147 12. http://www.gentoo.org/security/en/glsa/glsa-200411-27.xml
148
149 =========================
150 4. Heard in the community
151 =========================
152
153 Web forums
154 ----------
155
156 CD burning and Gentoo kernel 2.6.9
157
158 Gentoo developer Daniel Drake[13] is soliciting testers for a replacement
159 bugfix he's done on Gentoo's development kernel (and managed to get
160 included in the official tree for 2.6.10). As CD and DVD burning has been
161 under fire since 2.6.7 because of security concerns with simulated SCSI
162 commands being sent to the devices, fixes that weren't making things any
163 better had to be replaced with a saner approach. Check this thread and
164 tell him what you think:
165 13. dsd@g.o
166
167 * Request for testing: CD/DVD writing on 2.6.9[14]
168 14. http://forums.gentoo.org/viewtopic.php?t=247459
169
170 gentoo-dev
171 ----------
172
173 RAM-voracious ebuilds?
174
175 What can be done if during installation an ebuild needs lots of RAM
176 (gtk2hs) or large amounts of disk space (OpenOffice.org)? Since the build
177 process might fail on some systems, it would be useful to have portage
178 check these resources before starting the build. Is there a sane and
179 cross-platform way of doing this? /proc/ does not exist on all platforms,
180 after all.
181
182 * what to do when an ebuild needs loads of RAM?[15]
183 15. http://thread.gmane.org/gmane.linux.gentoo.devel/23017
184
185 Handling important upgrade messages
186
187 Many ebuilds give important hints about changes in behaviour,
188 configuration files etc. These messages are spewed to the screen during
189 the installation, and therefore usually scroll away during multi-package
190 upgrades. This prevents users from seeing many important messages in an
191 easy way (and no, sitting eight hours watching the messages scroll by
192 doesn't count). This thread explores the possibilities of collecting these
193 messages so that they can be presented all at once.
194
195 * Handling important upgrade messages[16]
196 16. http://thread.gmane.org/gmane.linux.gentoo.devel/22905
197
198 =======================
199 5. Gentoo International
200 =======================
201
202 UK: Oxford Gentoo User Meeting
203 ------------------------------
204
205 Hardly surprising, coming to think of it: Since Gentoo users in "that
206 other city"[17] met two weeks ago, Oxford-based Gentooists have been
207 thinking out loud that they can't possibly let this pass. They'll be
208 meeting for the first time on Sunday afternoon, 28 November 2004 from
209 15:00, at the "Far From The Madding Crowd"[18]in 10-12 Friar's Entry. Half
210 a dozen Oxfordian Gentooists have already confirmed, with shadow Portage
211 bash-scripter Edward Catmur[19] expected at the venue, and Gentoo
212 developer robmoss[20] hiking to Oxford on a full 500 mile roundtrip just
213 for this event. Announce your participation in this Forum thread[21].
214 17. http://forums.gentoo.org/viewtopic.php?t=240032
215 18. http://www.streetmap.co.uk/newmap.srf?x=451182&y=206472&z=0&ar=Y
216 19. http://forums.gentoo.org/profile.php?mode=viewprofile&u=32906
217 20. robmoss@g.o
218 21. http://forums.gentoo.org/viewtopic.php?t=250125
219
220 ======================
221 6. Gentoo in the press
222 ======================
223
224 2004.3 Release announcements roundup
225 ------------------------------------
226
227 Last week's release of Gentoo Linux 2004.3 triggered a large number of
228 publications about Gentoo. Here's a list of some of the shinier
229 highlights, many of them with comment areas below the article:
230
231 * Austrian newspaper "Der Standard[22]
232 * German IT news Golem.de[23]
233 * German Windows (sic!) Online Magazine [24]
234 * OSzine (German language open source magazine)[25]
235 * The Japanese "PC Web" finds the G5 (ppc64) support in 2004.3 most
236 remarkable[26]
237 * French PC INpact (rightfully) points out the Gentoo 2004.3 comes out
238 just four days before the Beaujolais Primeur.[27]
239 * French PC magazine[28]
240 * Another French electronic newspaper.[29]
241 * Download sources for kazaa/eDonkey and other file sharing services [30]
242 * OS News' Eugenia Loli-Queru forwards the Gentoo 2004.3
243 announcement.[31]
244 * Linux Electrons - "Linux with a hardware slant"[32]
245 22. http://derstandard.at/?url=/?id=1858405
246 23. http://www.golem.de/0411/34691.html
247 24.
248 http://www.winfuture.de/index.php?page=wfv4/news/news-showspec.php&news_id=17583
249 25.
250 http://www.oszine.de/modules.php?op=modload&name=News&file=article&sid=2320&mode=thread&order=0&thold=0
251 26. http://pcweb.mycom.co.jp/news/2004/11/15/008.html
252 27. http://www.pcinpact.com/actu/newsg/17626.htm
253 28.
254 http://www.presence-pc.com/news/Linux-Gentoo-2004-3-disponible-n5618.html
255 29. http://www.toolinux.com/news/logiciels/gentoo_linux_2004.3_ar5518.html
256 30. http://www.ratiatum.com/logitheque.php?id_log=216
257 31. http://www.osnews.com/story.php?news_id=8867
258 32. http://www.linuxelectrons.com/article.php/20041115072740347
259
260 Business Wire (20 November 2004
261 -------------------------------
262
263 Business Wire[33] announces that the speaker list for next year's big
264 "Security Enhanced Linux" (SELinux) symposium is now confirmed, and it
265 mentions Gentoo as one of the organisations to be present and presenting
266 at the SELinux Symposium[34], scheduled for 2-4 March 2005 in Silver
267 Spring, Maryland. What the article doesn't say: The Gentooist involved in
268 this conference is Gentoo developer Joshua Brindle[35].
269 33.
270 http://home.businesswire.com/portal/site/google/index.jsp?ndmViewId=news_view&newsId=20041118005546&newsLang=en
271 34. http://www.selinux-symposium.org/
272 35.
273
274 ===========
275 7. Bugzilla
276 ===========
277
278 Summary
279 -------
280
281 * Statistics
282 * Closed bug ranking
283 * New bug rankings
284
285 Statistics
286 ----------
287
288 The Gentoo community uses Bugzilla (bugs.gentoo.org[36]) to record and
289 track bugs, notifications, suggestions and other interactions with the
290 development team. Between 07 November 2004 and 14 November 2004, activity
291 on the site has resulted in:
292 36. http://bugs.gentoo.org
293
294 * 795 new bugs during this period
295 * 548 bugs closed or resolved during this period
296 * 29 previously closed bugs were reopened this period
297
298 Of the 7397 currently open bugs: 129 are labeled 'blocker', 240 are
299 labeled 'critical', and 556 are labeled 'major'.
300
301 Closed bug rankings
302 -------------------
303
304 The developers and teams who have closed the most bugs during this period
305 are:
306
307 * AMD64 Porting Team[37], with 40 closed bugs[38]
308 * Gentoo Games[39], with 28 closed bugs[40]
309 * Gentoo's Team for Core System packages[41], with 27 closed bugs[42]
310 * Mozilla Gentoo Team[43], with 26 closed bugs[44]
311 * media-video herd[45], with 25 closed bugs[46]
312 * Paul de Vrieze[47], with 21 closed bugs[48]
313 * SpanKY[49], with 20 closed bugs[50]
314 * Gentoo Security[51], with 17 closed bugs[52]
315 37. amd64@g.o
316 38.
317 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=amd64@g.o
318 39. games@g.o
319 40.
320 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=games@g.o
321 41. base-system@g.o
322 42.
323 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=base-system@g.o
324 43. mozilla@g.o
325 44.
326 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=mozilla@g.o
327 45. media-video@g.o
328 46.
329 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=media-video@g.o
330 47. pauldv@g.o
331 48.
332 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=pauldv@g.o
333 49. vapier@g.o
334 50.
335 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=vapier@g.o
336 51. security@g.o
337 52.
338 http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&chfield=bug_status&chfieldfrom=2004-11-07&chfieldto=2004-11-14&resolution=FIXED&assigned_to=security@g.o
339
340 New bug rankings
341 ----------------
342
343 The developers and teams who have been assigned the most new bugs during
344 this period are:
345
346 * Gentoo's Team for Core System packages[53], with 23 new bugs[54]
347 * Gentoo X-windows packagers[55], with 19 new bugs[56]
348 * Java team[57], with 15 new bugs[58]
349 * Mozilla Gentoo Team[59], with 14 new bugs[60]
350 * AMD64 Porting Team[61], with 14 new bugs[62]
351 * Gentoo Linux Gnome Desktop Team[63], with 13 new bugs[64]
352 * Chris White[65], with 10 new bugs[66]
353 * Gentoo Toolchain Maintainers[67], with 9 new bugs[68]
354 53. base-system@g.o
355 54.
356 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=base-system@g.o
357 55. x11@g.o
358 56.
359 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=x11@g.o
360 57. java@g.o
361 58.
362 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=java@g.o
363 59. mozilla@g.o
364 60.
365 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=mozilla@g.o
366 61. amd64@g.o
367 62.
368 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=amd64@g.o
369 63. gnome@g.o
370 64.
371 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=gnome@g.o
372 65. chriswhite@g.o
373 66.
374 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=chriswhite@g.o
375 67. toolchain@g.o
376 68.
377 http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&chfield=assigned_to&chfieldfrom=2004-11-07&chfieldto=2004-11-14&assigned_to=toolchain@g.o
378
379 ==================
380 8. Tips and Tricks
381 ==================
382
383 Portage magic
384 -------------
385
386 /var/log/emerge.log is well-known as the central reporitory of information
387 about all emerge activity going on in system. Lesser known are some tricks
388 you can do with the content of that log file. For example, when you start
389 an upgrade, you generally don't know how much time it will take to finish
390 compiling. You probably don't remember how long your last mplayer
391 installation took, but Portage does, and if you'd decipher the Unix time
392 stamps in /var/log/emerge.log, you'd get a pretty good idea, too. Or you
393 could let app-portage/genlop do it for you. Emerge (the unstable, ~arch
394 version of) genlop with:
395
396 ---------------------------------------------------------------------------
397 | Code Listing 8.1: |
398 |Emerge |
399 genlop---------------------------------------------------------------------
400 ----
401 | |
402 |#emerge -av genlop |
403 | |
404 ---------------------------------------------------------------------------
405
406 Now run a pretended world upgrade and pipe it to genlop for an estimation
407 of your upgrade schedule:
408
409 ---------------------------------------------------------------------------
410 | Code Listing 8.2: |
411 |Estimate upgrade |
412 time-----------------------------------------------------------------------
413 --
414 | |
415 |#emerge -pu world | genlop --pretend |
416 |These are the pretended packages: (this may take a while; wait...) |
417 | |
418 | * media-libs/tiff |
419 | * x11-base/xorg-x11 |
420 | * app-sci/stellarium |
421 | * app-arch/gzip |
422 | * dev-libs/libIDL |
423 | * net-www/mozilla-firefox |
424 | * sys-boot/lilo |
425 | * app-doc/abs-guide |
426 | * app-arch/unarj |
427 | * app-emulation/wine |
428 | * app-admin/sudo |
429 | |
430 |Estimated update time: 4 hours, 38 minutes. |
431 | |
432 ---------------------------------------------------------------------------
433
434 A look at the mechanism explains how Portage can double as an oracle. It
435 uses the statistics stored in the emerge.log file, take an average of
436 compilation times for given packages, and summarize the results. There are
437 some uncertainties, of course, for example if you use the CCACHE feature,
438 then compile times for a minor version bump may be much faster than the
439 original package took compiling the first time. On the other hand, if an
440 application has been extended with new features, the old average compile
441 time can be shorter than the version you're about to emerge.
442
443 Another brilliant feature of genlop is its --current option, the perfect
444 companion to the estimated compile-time from --pretend:
445
446 ---------------------------------------------------------------------------
447 | Code Listing 8.3: |
448 |How much time spent since the beginning of an |
449 emerge---------------------------------------------------------------------
450 ----
451 | |
452 |# genlop --current |
453 | |
454 | * app-portage/splat-0.07 |
455 | |
456 | current merge time: 12 seconds. |
457 | |
458 ---------------------------------------------------------------------------
459
460 Now you can say how long time you have to wait.
461
462 ===========================
463 9. Moves, adds, and changes
464 ===========================
465
466 Moves
467 -----
468
469 The following developers recently left the Gentoo team:
470
471 * None this week
472
473 Adds
474 ----
475
476 The following developers recently joined the Gentoo Linux team:
477
478 * None this week
479
480 Changes
481 -------
482
483 The following developers recently changed roles within the Gentoo Linux
484 project:
485
486 * None this week
487
488 =====================
489 10. Contribute to GWN
490 =====================
491
492 Interested in contributing to the Gentoo Weekly Newsletter? Send us an
493 email[69].
494 69. gwn-feedback@g.o
495
496 ================
497 11. GWN feedback
498 ================
499
500 Please send us your feedback[70] and help make the GWN better.
501 70. gwn-feedback@g.o
502
503 ================================
504 12. GWN subscription information
505 ================================
506
507 To subscribe to the Gentoo Weekly Newsletter, send a blank email to
508 gentoo-gwn-subscribe@g.o.
509
510 To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to
511 gentoo-gwn-unsubscribe@g.o from the email address you are
512 subscribed under.
513
514 ===================
515 13. Other languages
516 ===================
517
518 The Gentoo Weekly Newsletter is also available in the following languages:
519
520 * Danish[71]
521 * Dutch[72]
522 * English[73]
523 * German[74]
524 * French[75]
525 * Japanese[76]
526 * Italian[77]
527 * Polish[78]
528 * Portuguese (Brazil)[79]
529 * Portuguese (Portugal)[80]
530 * Russian[81]
531 * Spanish[82]
532 * Turkish[83]
533 71. http://www.gentoo.org/news/da/gwn/gwn.xml
534 72. http://www.gentoo.org/news/be/gwn/gwn.xml
535 73. http://www.gentoo.org/news/en/gwn/gwn.xml
536 74. http://www.gentoo.org/news/de/gwn/gwn.xml
537 75. http://www.gentoo.org/news/fr/gwn/gwn.xml
538 76. http://www.gentoo.org/news/ja/gwn/gwn.xml
539 77. http://www.gentoo.org/news/it/gwn/gwn.xml
540 78. http://www.gentoo.org/news/pl/gwn/gwn.xml
541 79. http://www.gentoo.org/news/br/gwn/gwn.xml
542 80. http://www.gentoo.org/news/pt/gwn/gwn.xml
543 81. http://www.gentoo.org/news/ru/gwn/gwn.xml
544 82. http://www.gentoo.org/news/es/gwn/gwn.xml
545 83. http://www.gentoo.org/news/tr/gwn/gwn.xml
546
547 Ulrich Plate <plate@g.o> - Editor
548 Brian Herring <ferringb@g.o> - Author
549 Patrick Lauer <patrick@g.o> - Author
550 <> - Author
551
552 --
553 gentoo-gwn@g.o mailing list