- 1 Fedora Weekly News Issue 163
- 1.1 Announcements
- 1.2 Planet Fedora
- 1.3 Ambassadors
- 1.4 QualityAssurance
- 1.5 Developments
- 1.6 Translation
- 1.7 Infrastructure
- 1.8 Artwork
- 1.9 Security Week
- 1.10 Security Advisories
Fedora Weekly News Issue 163
Welcome to Fedora Weekly News Issue 163 for the week ending February 15th, 2009.
If you are interested in contributing to Fedora Weekly News, please see our 'join' page. We welcome reader feedback: email@example.com
In this section, we cover announcements from the Fedora Project.
Contributing Writer: Max Spevack
Slow News Week
It was a quiet week on the announcements front, with nothing more than a few outage notifications being sent to the primary Fedora announcements mailing lists.
Your correspondent promises to make an announcement this week, so that this space may be used to its full potential in next week's issue.
February 20: Fedora Activity Day @ SCaLE
February 20 - 22: Southern California Linux Expo (SCaLE)
Also, people are encouraged to register for Fedora or JBoss.org related speaking slots at LinuxTag 2009.
In this section, we cover the highlights of Planet Fedora - an aggregation of blogs from Fedora contributors worldwide.
Contributing Writer: Adam Batkin
Dave Jones announced some changes to the Fedora kernel packaging "to drop the regular 686 kernels. As of Fedora 11, the only 32-bit kernels built are '586' and '686-PAE' (and their -debug variants)."
Lennart Poettering described some of the new changes in the latest
PulseAudio 0.9.15 release, including Flat Volumes, On-the-fly Reconfiguration of Devices (aka "S/PDIF Support"), Native support for 24bit samples and support for Airport Express.
David Nalley wrote about the Fedora Ambassadors giving away free XO laptops! To qualify, either "Package and maintain a sugar-* package for 2 releases or more" or "Build a Sugar activity that helps meet the 'holy list of 4th grade maths'".
Andrew Overholt announced the release of the
Linux Tools project for
Eclipse. The release has lots of features from profiling and tracing with
autoconf and RPM spec file editor (with autocomplete) support.
Jef Spaleta expressed mild excitement at Canonical's "Renewed focus on suspend resume". In a later post, he wrote about comparing Linux (and even OSX) user experiences with respect to functionality regressions after an update.
Once again: So many people have written about attending FOSDEM that it would take an entire issue of FWN post all of the links. Instead an arbitrarily selection will be randomly chosen.
In this section, we cover Fedora Ambassadors Project.
Contributing Writer: Larry Cafiero
FAD SCaLE coming up 2009-02-20
There will be breaks and such, but the FAD will be treated much like a sprint. We're here to get something accomplished -- specifically font packaging and documentation -- so come on by and help us out for an hour or all day. We'd love to have you there!
Also, if you can make SCaLE from the Southern California area, stop by the Fedora booth.
SCaLE takes place on this weekend at the Westin Airport Los Angeles. For more information, visit the Southern California Linux Expo site.
Got Ambassador News?
Any Ambassador news tips from around the Fedora community can be submitted to me by e-mailing lcafiero-AT-fedoraproject-DOT-org and I'd be glad to put it in this weekly report.
In this section, we cover the activities of the QA team.
Contributing Writer: Adam Williamson
This week's regular test day was on iSCSI. Martin Sivak and Hans de Goede represented the developers, and testing was lead by Marian Ganisin with assistance from Chris Williams, Mike Anderson, Michael Christie and James Laska. Test cases worked on during the test day can be seen on the page. Please record any additional test ideas or considerations at Exploratory Testing iSCSI. Consult the quick start guide for creating a software-based iscsi target for use with testing.
Next week's test day will be on the 20 Second Startup feature planned for Fedora 11. It will be held on Thursday (2009-02-19) in the #fedora-qa channel on Freenode IRC. Please drop by if you would like to help test and improve boot speed for Fedora 11.
The QA group weekly meeting was held on February 11th. The full log is available. Will Woods gave a status report on the progress of the autoqa project, which is working on creating automated test scripts to run whenever certain events happen. He also reported on progress with the Nitrate project, which is for collecting test cases and test plans and compiling results from running them. Jóhann Guðmundsson asked if it will be possible to pull existing test cases from the current Wiki-based system into Nitrate when it is released, and Will Woods said this is likely to be possible.
The Bugzappers group weekly meeting was held on February 10th. The group agreed that the current list of most-important components should be updated, and Edward Kirk will do this. Edward Kirk, Brennan Ashton and Adam Williamson (links) agreed that simple goals should be set for the group, but did not reach final agreement on what these should be. Adam Williamson suggested that Bug Days be revived and made weekly, and this idea was supported by Edward Kirk and Brennan Ashton.
The next QA weekly meeting will be held on February 18th at 1600 UTC in #fedora-qa, and the next Bugzappers weekly meeting on February 17th at 1700 UTC in #fedora-bugzappers.
Work continued on the ongoing project to rewrite and re-organize the main pages in the QA team's Wiki space. Adam Williamson, Jóhann Guðmundsson, Christopher Beland and Leam Hall all contributed ideas, suggestions and drafts.
Release-critical bug process
Adam Williamson initiated a discussion regarding the process for handling release-critical bugs. Matej Cepl, James Laska, Jesse Keating, and John Poelstra contributed opinions. In the end it was agreed that the basic shape of the current process is a good one but the groups involved - BugZappers, release engineering, and developers - should communicate and collaborate more in deciding on release-critical bugs.
François Cami, together with others, proposed a project to conduct organized testing of
DRI functionality with a range of common hardware for
Fedora 11. He highlighted four important areas he felt were needed for this: an opt-in system to record what hardware is owned by what testers (possibly utilizing Smolt), a system for producing test plans, a system for recording the results of tests, and regularly scheduled test sessions. Jóhann Guðmundsson supported the idea and suggested that, while some of the features would require help from the infrastructure group, the QA group could at least immediately start writing test cases. James Laska pointed out that extensive information is needed to diagnose and fix
X issues remotely. François will work with the X maintainers to define exactly what information needs to be provided.
In this section the people, personalities and debates on the @fedora-devel mailing list are summarized.
Contributing Writer: Oisin Feeley
FLOSS Multimedia Codec Support
Inspired by previous discussions on whether Fedora should distribute FLOSS content Martin Sourada tried to start a discussion about the poor support of FLOSS multimedia. Martin noted: "Out of the combinations of two FLOSS containers (matroska and ogg) and two FLOSS video codecs (dirac and theora) I know only one (ogg + theora) actually works in xine-lib (used by KDE4) which is pathetic." He asked for help in documenting the situation on a wiki page.
An information packed sub-thread started by Gregory Maxwell expanded the scope of the tests and started a discussion with Dominik Mierzejewski about the problem of
ffmpeg providing sub-optimal implementations of unencumbered codecs. It seems that for reasons of efficiency
ffmpeg re-invents the wheel from scratch instead of using and improving upstream implementations. Kevin Kofler also rose to the implied challenge that
GStreamer was preferable to
Multiple Packages from One Source ?
A question about how to handle the situation where a single source could be compiled with alternate databases was posted by Steven Moix. The
motion video motion detector software can be compiled to use either
Postgres. Steven explained that the problem was that "[...]you can't divide it into sub-packages, at the end it generates one big binary file [...]" and wondered should he just choose the database he preferred or propose two packages.
Manuel Wolfshant expressed what appeared to be the common wisdome: "personally I would compile twice, once enabling mysql and another time pgsql, and create 2 packages. each package would install a "motion-dbname" binary, and a symlink would allow access via the well known name "motion". Using alternatives would allow a switch between the two."
Although it was admitted that David Woodhouse's suggestion to make the program use loadable plugins was the ideal Tom Lane thought that was "[...] a bit above and beyond what a packager should do. If he's also an upstream developer, then he should undertake that addition with his developer hat on; but it's *well* beyond the size of patch that a Fedora package should be carrying."
The ability to specify alternate requires (similar to those used in the .deb package format) was discussed by Richard W.M. Jones and Tom Lane and dismissed as impractical in this case anyway due to variations in SQL.
Take a Peek at the Fedora 11 Release Notes
Fresh from his work on the
RHEL-5.3 Release Notes Ryan Lerch apprised the list of the latest changes to the
Fedora 11 Release Notes. Ryan sought early feedback and changes to documentation beats in order to give the community an early preview of the release notes.
Ryan also provided an rpm of this Release Notes mockup.
Heads Up: Noarch Subpackages Landing Soon
Florian Festi warned that the ability to produce noarch subpackages will soon be available in Fedora. This brings the benefit of being able to share these packages among different architectures thus reducing disk space and mirror bandwidth.
rpm-4.6</rpm> supports <code>noarch fully there are still some fixes to make to
koji before the Fedora buildsystem can cope with noarch subpackages. Florian suggested that those who wanted to could experiment in
rpmdiff to compare the results across different architectures. He assured readers that there were no plans to force packagers to use this feature and invited anyone interested in developing the use of noarch in future release to a discussion.
Florian later warned that one potential negative outcome of using such sub-packages would be a proliferation of packages and consequent bloating of metadata which might affect
VilleSkyttä suggested that it would be wise to make sure that use of
BuildRequire: rpm-build >= 4.6.0 was enforced in order to ensure that earlier versions of
rpmbuild did not produce
noarch versions of the main package and other potential subpackages. Florian's response recognized the problem but deprecated the use of
BuildRequires to such an extent. One possible alternative which he proposed was to "[have [[User:|Panu Matilainen]] backport a check that will make noarch packages (both regular and noarch) fail to build if they contain binaries [and ensure that this] additional check will be in place before koji will be updated[.]" This latter proposal stimulated a good deal of interest from Ralf Corsepius and Richard W.M. Jones as they were both concerned with cross-architecture issue. The definition of a "binary" seemed to be one unclear point.
In a later thread Florian updated a list of packages which could be easily turned into noarch subpackages.
Mass Rebuild Coming Soon
Jesse Keating drew attention to "[...] a perfect storm brewing for Fedora 11" due to the need to rebuild with
GCC-4.4 (see FWN#161, the use of i586 as the default supported architecture (see FWN#162 and the support of stronger hashes (last paragraph of FWN#107).
Apparently the time-constraints led to a desire to start the rebuild as soon as possible without giving maintainers an explicit window in which to do their own builds. Jesse preferred to give maintainers an ability to opt-out and sought suggestions on how this could be achieved.
Jesse suggested that interested parties should either reply to the thread and/or participate in the 2009-02-16 IRC meeting in #fedora-meeting at 1800UTC.
New Tool Measures Ease of Cross-compiling to Windows
This section covers the news surrounding the Fedora Translation (L10n) Project.
Contributing Writer: Runa Bhattacharjee
Additions to talk.fedoraproject.org
Rafael Gomes has volunteered to update content on talk.fedoraproject.org and would be creating the .pot file to make it available for translators. Additionally, Lucas Do Amaral has volunteered to add content regarding ekiga configuration that would ensure error free display of the translated content, as had been earlier reported by Richard van der Luit .
Further discussion on the Infrastructure Roadmap
In continuation to the earlier discussion, Dimitris Glezos mentions that the important issue currently is the inconsistent uptime of the system due to the lack of administration resources . He also mentions that adding Publican support to the Transifex instance would be possible with support from the Fedora Publican group. Additionally, he mentions that Transifex v0.5 to be released in March, would have support for Statistics based display as a start to the future goal of supporting all the features of Damned Lies. It is to be noted that FLP uses Damned Lies and Transifex for its Translation infrastructure.
Domingo Becker added a wishlist for the current system, that includes reservation of files for translation, timeout and notification system to the co-ordinator. In a separate thread, Francesco Tombolini voiced his opinion about the lack of the file locking feature and the downtime in the statistics page .
Migration of Damned Lies
Asgeir Frimannsson had announced the imminent migration of the old Damned Lies instance to the new Django-based Damned Lies instance. Damned Lies is used by http://translate.fedoraproject.org for generating the translation statistics.
New Members in FLP
Daniel Yousefi (Persian) , Ahmad Razzaghi (Persian) , Daniele Catanesi (Italian) , Mads Bille Lundby (Danish) , and Zoltan Sumegi (Hungarian)  joined the Fedora Localization Project last week.
This section contains the discussion happening on the fedora-infrastructure-list
Contributing Writer: Huzaifa Sidhpurwala
cgit to replace gitweb?
Seth Vidal saidthat he has setup cgit as a replacement for gitweb on hosted2 and it is available at hosted2.fedoraproject.org/cgit/ He said that he would like to replace gitweb as a web based git repo browser but that would mean that the urls from gitweb will not work any more. He said that he would like to get some feedback on this.
In this section, we cover the Fedora Artwork Project.
Contributing Writer: Nicu Buculei
Evolving Fedora 11 Artwork
The development of the Fedora 11 artwork evolved on @fedora-art. Máirín Duffy posted a new wallpaper mockup: "It's more really an attempt at a nice backdrop, and maybe we can layer some of the trees and buildings we were talking about on top[.]"
Charles Brej investigated boot animations: "On the plymouth front, I am likely to be a bit busier at work this release than the F10 one, so I would really appreciate some of ideas as to what people would like during the system boot. The possibilities are pretty much limitless but it would be a good thing to conserve the CPU and keep the number and size of images included in the initrd to a minimum".
In this section, we highlight the security stories from the week in Fedora.
Contributing Writer: JoshBressers
Is Open Source Software Secure?
This week there was a story posted to Slashdot titled How To Argue That Open Source Software Is Secure?. Quoting the post:
... saying that they were warned that they are dangerously insecure because they run open source operating systems or software, because 'anyone can read the code and hack you with ease.'
This issue seems to keep coming up from time to time. This argument is of course silly and one of those "Prove it ... you can't? So it's true!" There is no way to prove that a piece of closed source software is more or less secure than a given piece of Open Source Software. If you can't see the source, you can't be certain that the vendor did or didn't fix issues. You need to unconditionally trust your vendor. If the source code is wide open for anyone to see, it keeps the vendor honest. You can't sweep issues under a transparent rug. You can try, and maybe hide a few piles of dust, but the really scary piles of dirt will stick out like sore thumbs.
The issue at hand isn't is application A more secure than application B, but do you trust vendor A more than vendor B?
In this section, we cover Security Advisories from fedora-package-announce.
Contributing Writer: David Nalley
Fedora 10 Security Advisories
- xine-lib-188.8.131.52-1.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00359.html
- squid-3.0.STABLE13-1.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00362.html
- squidGuard-1.2.1-2.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00365.html
- python-fedora-0.3.9-1.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00368.html
- asterisk-184.108.40.206-2.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00416.html
- moodle-1.9.4-1.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00657.html
- fail2ban-0.8.3-18.fc10 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00721.html
Fedora 9 Security Advisories
- squidGuard-1.2.1-2.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00360.html
- python-fedora-0.3.9-1.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00361.html
- squid-3.0.STABLE13-1.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00363.html
- lighttpd-1.4.20-6.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00364.html
- xine-lib-220.127.116.11-1.fc9.1 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00367.html
- moodle-1.9.4-1.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00496.html
- asterisk-18.104.22.168-2.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00602.html
- dahdi-tools-2.0.0-1.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00603.html
- libresample-0.1.3-9.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00604.html
- dnsmasq-2.45-1.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00670.html
- fail2ban-0.8.3-18.fc9 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00719.html