Brief items

Supply chain attack on arrayref (Rust blog)

The Rust blog reports on a malicious crate, called proc-macro1, that was uploaded to the crates.io repository.

Furthermore, we discovered that the popular arrayref crate had recently been republished and made to depend on this crate, with the most recent versions yanked. We have removed the malicious version and unyanked the maliciously-yanked versions. Other crates by that author (internment, append-only-vec) were also affected so we have done the same for those, and locked the account as a precaution. We do not believe the author of arrayref to be acting maliciously, but their computer or credentials are likely compromised, and we are attempting to contact them.

Comments (3 posted)

Security quote of the week

PyPI should be considered a supply chain risk until the PSF is able to hire more engineering staff. There is a very large amount of the software industry that sits on top of our services. Feature development, a rising volume of security reports, and day to day maintenance are currently being carried by one and a half full-time employees and one full-time employee on PyPI support requests.

— Jacob Coffee, director of engineering at the Python Software Foundation

Comments (1 posted)

Kernel release status

The 7.3 merge window is still open. It can be expected to close on August 30, 2026.

Stable updates: 7.1.10, 6.18.46, 6.12.105, 6.6.153, 6.1.184, 5.15.217, and 5.10.266 were released on August 23.

The relatively small 7.2.1, 7.1.11, 6.18.47, 6.12.106, 6.6.154, 6.1.185, 5.15.218, and 5.10.267 updates are all in the review process; they are due on August 27.

Comments (none posted)

Mourning Steve French

From Jeremy Allison we have the sad news of the passing of Steve French. He was the maintainer of the kernel's SMB filesystem code for many years, having only dropped that role due to health issues in the last week. "I've known Steve for over 20 years. He was a legend in the community, and a really good friend. He will be greatly missed. Farewell Steve." He will indeed be missed.

Comments (8 posted)

mklinux-v7.0-mk2 released

For people who would like to experiment with the multi-kernel Linux concept, Cong Wang has announced the release of mklinux v7.0-mk2.

mklinux lets one machine run several independent Linux kernels at the same time on bare metal, without a hypervisor. A host kernel owns a pool of CPUs, memory and PCI devices, carves that pool into instances, and boots a spawn kernel into each instance through kexec_file_load(). Every spawn kernel runs natively on its own CPUs, its own physical memory and its own devices. Nothing is emulated and nothing is trapped; the only thing shared is what you choose to share.

Note that this is not the old MkLinux, which was a port to PowerPC Macintosh systems.

Comments (2 posted)

Quotes of the week

I expect our direction for the next release will be to tweak the reviews a little bit more, but start shifting focus to letting the LLMs take care of the busy work - managing patchwork, automating common process complaints, editing commit messages, and maybe applying patches which already got "reviewed-by" tags from people we trust...

— Jakub Kicinski

So for years we suffered through git log full of single-line commit messages with no explanation whatsoever.

Now we get a git log full of useless noise.

I'm not sure whether we won anything on that front.

— Christian Brauner

Comments (6 posted)

Armbian 26.8 released

Version 26.8 of the Armbian distribution for Arm hardware has been released.

Most releases are a long list of small improvements. This one had three larger pieces landing at roughly the same time, and all three touch parts of Armbian that people use directly rather than parts they only read about in changelogs.

The installer was rewritten. Armbian Imager reached 2.0. And our CI moved out of the repository it had outgrown into one built for the job. None of these were planned to coincide; they simply reached the point where postponing them again would have cost more than doing them.

The installer rewrite is the one I expect people to notice first. It now ships as an armbian-config module, which means it is unit-tested, the same way the rest of armbian-config is tested, rather than living as a script that everyone was slightly afraid to touch. It can target SPI and MTD, treats eMMC and NVMe as separate flows instead of pretending they are the same thing, can flash a bootloader on its own, and — this one is overdue — reports when a bootloader write fails instead of printing "Done." and leaving you to find out at the next boot.

See the release notes for a full list of changes.

Comments (none posted)

Vanilla OS 3 released

Vanilla OS 3, an immutable desktop Linux distribution, has been released. Notable changes in this release include support for Arm64, introduction of a Vanilla OS SDK, a rewrite of the Apx package manager using the new SDK, and much more. LWN covered Vanilla OS 2 in 2024.

Comments (1 posted)

Distributions quote of the week

So, does monstrous hardware solve long RPM build times? Only marginally, and at an astronomical cost.

The reality is that sheer hardware scale is fundamentally bottlenecked by the software architecture. Neither rpmbuild itself nor the maintainer code inside %build sections can efficiently map to extreme, massive parallelism. You hit Amdahl's Law incredibly fast.

A final funny observation: Knowing that even on this 224-core monster the builds would take hours, I fired them up fully intending to go watch a movie on Netflix. Instead, I found myself completely mesmerized by btop and the output of ps axf. Watching process trees expand and collapse across 224 cores turned out to be far more entertaining than a Hollywood blockbuster.

— Miroslav Suchý

Comments (none posted)

Emacs 31.1 released

Version 31.1 of the Emacs editor has been released. There is a long list of changes including the removal of the Emacs dumper, a new user Lisp directory feature, a "Send to..." menu item in context-menu-mode, and many other changes; see the NEWS file for more information. Mickey Petersen, author of Mastering Emacs, also has a rundown of some of the quality-of-life features appearing in this release.

Full Story (comments: 4)

KDE Gear 26.08 released

Version 26.08 of the KDE Gear collection of applications has been released. Notable changes in this release include improvements in the signing features of Okular, improved file-grouping features in the Dolphin file manager, and a number of enhancements to the Kdenlive video editor. See the changelog for a full list of updates, enhancements, and bug fixes.

Comments (none posted)

LibreOffice 26.8 released

Version 26.8 of the LibreOffice suite has been released.

LibreOffice 26.8 concentrates on three areas: the typographic quality of what the suite produces, the range of writing systems it handles correctly, and the fidelity with which documents survive exchange with other office suites.

The largest single body of work in this release addresses bidirectional and complex text. Writer now detects paragraph direction automatically when documents or plain text are opened or pasted. Line wrapping places end-of-line spaces according to the direction of the paragraph rather than that of the adjacent characters. Object resize handles behave correctly in right-to-left and vertical CJK documents. Bidirectional control characters are now visible alongside other formatting marks. In Calc, typing right-to-left text into an empty cell sets the direction of that cell automatically.

See the release notes for a full list of changes.

Comments (4 posted)

RPM 6.1.0 released

Version 6.1.0 of the RPM Package Manager has been released. Notable changes include the ability to provide modifiers to RPM macros at definition time, improved build and verification error handling, support for signing files with PKCS11 tokens using rpmsign, as well as the addition of several new man pages. The 6.1.0 release also debuts a new release model inspired by the Linux kernel's.

Comments (1 posted)

Development quote of the week

We need to have a set of foundational tools that are "clean" in the sense that they are built upon a community of people that understand how they are built.

Maybe that's naive or even impossible. The Linux kernel and GCC, in particular, are massive projects that have long grown past the scale of a single person's understanding. But the theory was that a community of humans can understand collectively.

Now we seem to be throwing up our hands and giving up on that community. That LLMs will just fix the problem, whatever it is. But we're all just one rug pull away from being completely incapable of managing those projects. The argument there is that we'll just switch to local models, but no one is actually doing that. All I see is people use local models as a corner case (for privacy) or as in theory, but in reality, everyone uses the centralized frontier models right now. We just can't fall back.

We're in the same situation we were, a decade or two ago, when Microsoft decided it would kill free office alternatives by making Office free for non-profits. It worked: thousands, if not millions of schools, community groups and individuals stopped looking for alternatives (including free software but also "piracy") for Office and embraced what seemed like a generous offer.

Now Microsoft pulled the plug and Over 170,000 Nonprofits Lost All Their Data.

I'm afraid the rug pull on LLMs will be much worse: never mind that Linus won't be able to use his tireless helper to fix obscure kernel bugs; we're looking at a collapse of the economy so large that we are already talking about bailing out the companies responsible.

— Antoine Beaupré

Comments (none posted)