Brief items

The "branch history injection" hardware vulnerability

The mainline kernel has just received a set of commits mitigating the latest x86 hardware vulnerability, known as "branch history injection". From this commit:

Branch History Injection (BHI) attacks may allow a malicious application to influence indirect branch prediction in kernel by poisoning the branch history. eIBRS isolates indirect branch targets in ring0. The BHB can still influence the choice of indirect branch predictor entry, and although branch predictor entries are isolated between modes when eIBRS is enabled, the BHB itself is not isolated between modes.

See this commit for documentation on the command-line parameter that controls this mitigation. There are stable kernel releases (6.8.5, 6.6.26, 6.1.85, and 5.15.154) in the works that also contain the mitigations.

Comments (10 posted)

OpenSSL 3.3.0 released

Version 3.3.0 of the OpenSSL SSL/TLS implementation has been released. Changes include a number of additions to its QUIC protocol support, some year-2038 improvements for 32-bit systems, and a lot of cryptographic features with descriptions like "Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple times with different output sizes." See the release notes for details.

Full Story (comments: none)

Kernel release status

The current development kernel is 6.9-rc3, released on April 7. According to Linus:

Ok, so this rc3 looks a bit different than the usual ones, because there's a large series to bcachefs to do filesystem repair after corruption. Not normally something we'd see in an rc kernel, but hey, if you had a corrupted bcachefs filesystem you'd probably want this, and if you thought bcachefs was stable already, I have a bridge to sell you. Special deal only for you, real cheap.

Stable updates: 6.8.4 and 6.6.25, consisting solely of 11 workqueue-related reverts, were released on April 4. The larger 6.8.5, 6.6.26, 6.1.85, and 5.15.154 updates, containing (among other things) the mitigations for the recently disclosed branch history injection hardware vulnerability, followed on April 10.

Comments (none posted)

Gentoo Linux becomes an SPI Associated Project

The Gentoo Linux project has announced that it is now an Associated Project of Software in the Public Interest (SPI), which will allow it to accept tax deductible donations in the US and reduce its "non-technical workload":

The current Gentoo Foundation has bylaws restricting its behavior to that of a non-profit, is a recognized non-profit only in New Mexico, but a for-profit entity at the US federal level. A direct conversion to a federally recognized non-profit would be unlikely to succeed without significant effort and cost.

[...] SPI is already now recognized at US federal level as a full-[fledged] non-profit 501(c)(3). It also handles several projects of similar type and size (e.g., Arch and Debian) and as such has exactly the experience and background that Gentoo needs.

According to the announcement, the goal is to "eventually transfer the existing assets to SPI and dissolve the Gentoo Foundation". How to do that is still under discussion. This will not affect Förderverein Gentoo e.V., which has public-benefit status in Germany and can accept tax deductible donations in Europe.

Comments (13 posted)

OpenBSD 7.5 released

OpenBSD 7.5 has been released. The list of changes and improvements is, as usual, long; it includes the pinsyscalls() functionality covered here in January.

Full Story (comments: none)

Distributions quote of the week

As the maintainer of a package with expert knowledge of it you might think that there is nothing to do but you while you are the expert for that package, you might not be the expert on topics like cross building, reproducible builds, multiarch, build profiles, merged-/usr, build hardening and many other topics which span the whole distribution. There are people who are heavily invested in these topics and who will want to touch very many packages to fix things. It should be made easy for them to make these contributions without them bit-rotting as a patch in the BTS for months or years.

— Johannes Schauer Marin Rodrigues

Comments (none posted)

Eclipse Foundation announces collaboration for CRA compliance

The Eclipse Foundation, the organization behind the Eclipse IDE and many other software projects, announced a collaboration between several different open-source-software foundations to create a specification describing secure software development best practices. This work is motivated by the European Union's Cyber Resilience Act (CRA).

The leading open source communities and foundations have for years developed and practised secure software development processes. These are processes that have often defined or set industry best practices around things such as coordinated disclosure, peer review, and release processes. These processes have been documented by each of these communities, albeit sometimes using different terminology and approaches. We hypothesise that the cybersecurity process technical documentation that already exists amongst the open source communities can provide a useful starting point for developing the cybersecurity processes required for regulatory compliance.

(Thanks to Martin Michlmayr.)

Comments (35 posted)

FFmpeg 7.0 released

Version 7.0 of the FFmpeg audio/video toolkit is out. "The most noteworthy changes for most users are a native VVC decoder (currently experimental, until more fuzzing is done), IAMF support, or a multi-threaded ffmpeg CLI tool". There's also the usual list of new formats and codecs, and a few deprecated features have been removed.

Comments (22 posted)

Incus 6.0 LTS released

Version 6.0 LTS of the Incus container management system has been released. "This is a major milestone for Incus as it marks our first release with extended support, suitable for use in production environments where monthly feature releases aren't suitable." Changes include swap limits for containers, a new shell completion mechanism, support for the creation of VLAN interfaces, improved live migration, and more.

Comments (1 posted)

Introducing Jpegli: A New JPEG Coding Library (Google Open Source Blog)

The Google Open Source Blog is carrying an announcement for a new JPEG library called "Jpegli". There are a number of advantages claimed, including:

Jpegli can be encoded with 10+ bits per component. Traditional JPEG coding solutions offer only 8 bit per component dynamics causing visible banding artifacts in slow gradients. Jpegli's 10+ bits coding happens in the original 8-bit formalism and the resulting images are fully interoperable with 8-bit viewers. 10+ bit dynamics are available as an API extension and application code changes are needed to benefit from it.

The library is BSD-licensed.

Comments (31 posted)

Rivendell v4.2.0 released

Version 4.2.0 of the Rivendell radio automation system has been released. Changes include a new data feed for 'next' data objects, improvements to its podcast system, numerous bug fixes, and more.

Full Story (comments: none)

Tridge returns to rsync

Wayne Davison has announced the release of rsync version 3.3.0, which contains a number of bug fixes and minor enhancements. Davison has also announced a change in maintainers and a move to a new GitHub project:

The github repos have moved to a new RsyncProject organization. Because various life events have been monopolizing my time, I reached out to Tridge [Andrew Tridgell] (the original author) and he has graciously agreed to get back into rsync work, along with Paul Mackerras, who was also an early contributor to rsync. This new team will be working mainly on maintenance tasks, and not so much on new features. If you want to get involved, feel free to reach out on the new discord RsyncProject channels.

The new GitHub organization is here.

Comments (139 posted)

GNU Stow 2.4.0 released

Version 2.4.0 of the GNU Stow symbolic-link manager has been released. This marks the first release for GNU Stow since 2019. Maintainer Adam Spires wrote:

I would like to sincerely apologise to all Stow users for this incredibly overdue release, the cadence of which is perhaps vaguely reminiscent of releases by the great Donald Knuth, except with none of the grace and deliberate planning.

Spires notes that this release "makes considerable efforts to make the internals more understandable and easy to maintain", and has put out a call for a co-maintainer.

Full Story (comments: 4)

V8 incorporates new sandbox

V8, the JavaScript engine used in Chrome, announced that its memory sandbox is no longer experimental.

Chrome 123 could therefore be considered to be a sort of "beta" release for the sandbox. This blog post uses this opportunity to discuss the motivation behind the sandbox, show how it prevents memory corruption in V8 from spreading within the host process, and ultimately explain why it is a necessary step towards memory safety.

Comments (5 posted)