License change notification for Eclipse Plugins
by Mat Booth
Some Eclipse Foundation plug-ins have already made the switch from EPL to
EPL-2.0 and I have updated the licence field in the corresponding Rawhide
RPMs where I am aware of the change.
I expect that most plug-ins from the Foundation and the Eclipse Platform
itself will make the switch over the coming year. I don't plan to announce
each change individually so if you are interested in Eclipse Platform or
plug-in licensing, please pay special attention going forward.
Thanks
--
Mat Booth
http://fedoraproject.org/get-fedora
5 years, 10 months
F29 System Wide Change: Golang 1.11
by Jan Kurik
= Proposed System Wide Change: Golang 1.11 =
https://fedoraproject.org/wiki/Changes/golang1.11
Owner(s):
* Jakub Čajka <jcajka at redhat dot com>
Rebase of Golang package to upcoming version 1.11 in Fedora 29,
including rebuild of all dependent packages(pre-release version of Go
will be used for rebuild, if released version will not be available at
the time).
== Detailed description ==
Rebase of Golang package to upcoming version 1.11 in Fedora 29. Golang
1.11 is schedule to be released in Aug.
Due to current nature of Go packages, rebuild of dependent package
will be required to pick up the changes.
== Scope ==
* Proposal owners:
Rebase golang package in f29, help with resolving possible issues
found during package rebuilds.
* Other developers:
fix possible issues with help from golang maintainers
* Release engineering:
Rebuild of dependent packages in side tag.
RelEng tracking issue https://pagure.io/releng/issue/7569
** List of deliverables:
N/A
* Policies and guidelines:
N/A
* Trademark approval:
N/A
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
F29 Self Contained Change: User PATH Prioritization
by Jan Kurik
= Proposed Self Contained Change: User PATH Prioritization =
https://fedoraproject.org/wiki/Changes/UserPathPrioritization
Owner(s):
* Sorin Sbarnea <ssbarnea at redhat dot com>
* Till Maas <opensource at till dot name>
* Miro Hrončok <mhroncok at redhat dot com>
Changing user PATH '''~/.local/bin''' to be moved to the top of the
PATH list instead of the end. This will bring Fedora in sync with
other distributions which already fixed this issues (Debian/Ubuntu)
and will allow users to install and use their own command line tools,
also fixing multiple bugs where user installed tools cannot be
accessed because the system installed ones took precedence.
== Detailed description ==
Currently if user is installing his own tools with installers like
(pip), they will be installed inside ~/.local/bin but if the same CLI
tools are installed at system level the user would not be able to use
his own tools because the system one would be picked instead. This
happens because .bashrc file adds user PATH to the end instead of the
top of PATH list variable.
Same problem was happening with other distributions but they fixed it
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839155 Debian bug)
Example: "pip install --user virtualenv" would install virtualenv at
user level, adding ~/.local/bin/virtualenv executable. Still, if
virtualenv happens to be installed at system level, this would
currently be used instead of user installed one. On the other hand,
python itself already knows to prefer user installed modules which
means that "python -m virtualenv" will call user installed module
instead of the system one.
This may result in undefined behavior, where user installs foo, than
run foo, but /usr/bin/foo is run and that import from Python modules
in home. Those modules might have different API.
If we change the order and to assure the user folders do take
precedence, we would assure that python modules and shell scripts
would use the same modules, avoiding weird bugs where what you call is
not what you installed.
The issue is not unique to pip installed and applies to any tools that
are installed in de facto default XDG folder locations.
There should be '''no security concerns''' due to this change because
any user is already able to add executables and to alter its own PATH,
which means that if someone wants to trick a user to use another
executable, they are already able to do that. This has already been
proved several times in the
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.o...
initial discussions about this change.
The change itself technically is in /etc/skel/.bash_profile from bash.
Currently:
PATH=$PATH:$HOME/.local/bin:$HOME/bin
After the change:
PATH=$HOME/.local/bin:$HOME/bin:$PATH
(Note that whether we move $HOME/bin or not has not yet been decided.)
Note that this change will only affect new user accounts, we cannot
change PATH for already existing accounts without crazy and undesired
hacks.
== Scope ==
* Proposal owners:
change /etc/skel/.bash_profile to have local folders before the system
ones in default PATH
* Other developers:
N/A (not a System Wide Change)
* Release engineering:
https://pagure.io/releng/issue/7554 #7554
** List of deliverables:
N/A (not a System Wide Change)
* Policies and guidelines:
N/A (not a System Wide Change)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
Elections for Mindshare - May 2018 - Result announcement
by Jan Kurik
Greetings, all!
The elections for Mindshare - May 2018 [1] have concluded, and the
results are shown below.
Mindshare committee is electing 1 seat this time.
A total of 107 ballots were cast, meaning a candidate could accumulate
up to 321 votes (107 * 3).
The results for the elections are as follows:
# votes | name
- --------+----------------------
205 | Sumantro Mukherjee (sumantrom)
- --------+----------------------
188 | Nick Bebout (nb)
114 | Itamar Peixoto (itamarjp)
Congratulations to the winning candidate, and thank you all candidates
for running this elections!
[1] https://admin.fedoraproject.org/voting/about/mindshare-may-2018
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
Elections for Council - May 2018 - Result announcement
by Jan Kurik
Greetings, all!
The elections for Council - May 2018 [1] have concluded, and the
results are shown below.
Fedora Council is electing 1 seat this time.
A total of 110 ballots were cast, meaning a candidate could accumulate
up to 220 votes (110 * 2).
The results for the elections are as follows:
# votes | name
- --------+----------------------
164 | Till Maas (till)
- --------+----------------------
115 | Nick Bebout (nb)
Congratulations to the winning candidate, and thank you all candidates
for running this elections!
[1] https://admin.fedoraproject.org/voting/about/council-may-2018
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
F29 Self Contained Change: Changes/Update festival to 2.5
by Jan Kurik
= Proposed Self Contained Change: Changes/Update festival to 2.5 =
https://fedoraproject.org/wiki/Changes/Update_festival_to_2.5
Owner(s):
* Lukáš Tyrychtr <lukastyrychtr at gmail dot com>
Update the packaged festival speech synthesis system to the latest
upstream version. And just as a bonus make it actually work.
== Detailed description ==
Festival provides capabilities for speech synthesis and a framework
for synthetic voice creation. It generally provides higher quality
voices than Espeak.
== Scope ==
* Proposal owners:
Actually do the package updates (almost done) and get them in to Fedora.
* Other developers:
N/A (not a System Wide Change)
* Release engineering:
https://pagure.io/releng/issue/7551 #7551
** List of deliverables:
N/A (not a System Wide Change)
* Policies and guidelines:
N/A (not a System Wide Change)
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
F29 System Wide Change: NSS load p11-kit modules by default
by Jan Kurik
= Proposed System Wide Change: NSS load p11-kit modules by default =
https://fedoraproject.org/wiki/Changes/NSSLoadP11KitModules
Owner(s):
* Daiki Ueno <dueno at redhat dot com>
When NSS database is created, PKCS#11 modules configured in the
system's p11-kit will be automatically registered and visible to NSS
applications.
== Detailed description ==
Fedora provides a mechanism to configure PKCS#11 modules system wide,
allowing the crypto libraries (GnuTLS and OpenSSL) to use PKCS#11
modules in a consistent manner. Until now NSS applications haven't
benefit from it as NSS uses a different configuration mechanism which
requires users to register PKCS#11 modules in NSS databases. This
change makes the manual procedure unnecessary, by registering the
p11-kit-proxy module (the aggregator of the system PKCS#11 modules) in
NSS databases with the default configuration.
See also:
* https://bugzilla.redhat.com/show_bug.cgi?id=1173577
== Scope ==
* Proposal owners:
** Enable p11-kit-proxy in the newly created NSS database, through the
crypto-policies package.
** Modify the opensc package not to register itself to the NSS
database upon installation.
* Other developers:
** Make sure that this change doesn't cause any regression with the
existing applications.
* Release engineering:
[https://pagure.io/releng/issue/7548 #7548]
** List of deliverables: N/A
* Policies and guidelines:
PackageMaintainers/PKCS11 needs changes basically to eliminate NSS
specific stuff
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
F29 System Wide Change: i686 Is For x86-64
by Jan Kurik
= Proposed System Wide Change: i686 Is For x86-64 =
https://fedoraproject.org/wiki/Changes/i686_Is_For_x86-64
Owner(s):
* Florian Weimer <fweimer at redhat dot com>
Fedora builds its i686 packages for use on x86-64 systems as multi-lib RPMs.
== Detailed description ==
Currently, the i686 RPM packages are built in such a way that they are
compatible with very old i686 systems, such as the Pentium III. The
only addition over the i686/Pentium Pro baseline is a requirement to
support long NOPs, for Intel CET. However, the majority of
installations of i686 packages is for use on x86_64 systems, as
multi-lib RPMs. Furthermore, there are reports that the i686 kernel
does not run stable on old hardware which is not x86-64-capable (
https://lists.fedoraproject.org/archives/list/x86@lists.fedoraproject.org...
).
This proposal suggests to accept this reality and build the i686
packages in such a way that they require the ISA level of (early)
x86-64 CPUs.
== Scope ==
* Proposal owners:
Adjust the redhat-rpm-config, gcc, and glibc packages to switch to the
new compiler flags. Except for mstackrealign, there is substantial
experience with this configuration downstream.
* Other developers:
Other developers can enable SSE2 optimization in their packages if
they want, where this has been a compile-time option only.
* Release engineering:
https://pagure.io/releng/issues/7543 #7543
** List of deliverables: TBD
* Policies and guidelines:
i686 is no longer a primary architecture. The Packaging Guidelines do
not currently require support for non-SSE2 x86 systems, so no change
is required there.
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
F29 System Wide Change: Strong crypto settings: phase 2
by Jan Kurik
= Proposed System Wide Change: Strong crypto settings: phase 2 =
https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2
Owner(s):
* Tomáš Mráz <tmraz at redhat dot com>
We update the current system-wide crypto policy to further disable
legacy cryptographic protocols (TLS 1.0 and TLS 1.1) and weak
Diffie-Hellman key exchange sizes (1024 bit)
== Detailed description ==
Fedora includes several cryptographic components who's security
doesn't remain constant over time. Algorithms such as (cryptographic)
hashing and encryption typically have a lifetime after which they are
considered either too risky to use or plain insecure. That would mean
we need to phase out such algorithms from the default settings, or
completely disable if they could cause irreparable issue.
While in the past we did not disable algorithms in a consistent way
(different applications utilized different policies), today we have a
system-wide policy followed by a large part of Fedora components. That
allows us to move consistently and deprecate algorithms system-wide.
For rationale see RFC 7457 for a more complete list of attacks taking
advantage of legacy crypto algorithms.
The changes for default policy are:
* Keep only TLS 1.2 (and TLS 1.3 when available) as enabled protocols
and move the TLS 1.x, x<=1 to legacy level.
* Require finite field parameters (RSA, Diffie-Hellman) of 2048 and
more in the default settings
That is a policy of:
LEGACY
MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 255 bits (including bernstein curves)
Signature algorithms: SHA-1 hash or better (not RIPEMD)
Ciphers: all available > 112-bit key, >= 128-bit block (no rc4, but with 3DES)
key exchange: ECDHE, RSA, DHE
DH params size: >=1023
RSA params size: >=1023
TLS protocols: TLS >= 1.0
DEFAULT
MACs: All HMAC with SHA1 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 255 bits (including bernstein curves)
Signature algorithms: with SHA-1 hash or better (not DSA)
Ciphers: >= 128-bit key, >= 128-bit block (aes, camellia, chacha20,
including aes-cbc)
key exchange: ECDHE, RSA, DHE
DH params size: >= 2048
RSA params size: >= 2048
TLS protocols: TLS >= 1.2
FUTURE
MACs: All HMAC with SHA256 or better + all modern MACs (poly1305 etc)
Curves: all prime >= 384 bits (including bernstein curves)
Signature algorithms: SHA-384 hash or better (not DSA)
Ciphers: >= 256-bit key, >= 128-bit block, only Authenticated
Encryption (AE) ciphers
key exchange: ECDHE, DHE
DH params size: >= 3072
RSA params size: >= 3072
TLS protocols: TLS >= 1.2
== Scope ==
* Proposal owners:
The policies include in crypto-policies package need to be updated.
* Other developers:
* Crypto policies are updated to the settings above
* https://bugzilla.redhat.com/show_bug.cgi?id=1487607 OpenSSL is
updated to allow setting policies for TLS versions
* Release engineering:
Copied from F28 change - no impact
https://pagure.io/releng/issue/7235 #7235
** List of deliverables:
* Crypto policies are updated to the settings above
* OpenSSL, NSS, GnuTLS and all applications covered under the Fedora
Crypto Policies follow the new crypto settings.
* Policies and guidelines:
No changes to packaging or other guidelines is needed.
* Trademark approval:
N/A (not needed for this Change)
--
Jan Kuřík
JBoss EAP Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic
5 years, 10 months
