Brief items

Supply-chain attack analysis: Ultralytics (PyPI Blog)

The Python Package Index (PyPI) Blog has an analysis of the compromise of the ultralytics project, and what PyPI has learned from this event:

PyPI staff and volunteers do their best to remove malware, but because the service is open to anyone looking to publish software there is an unfortunately high amount of abuse. Thankfully most of this abuse does not have the same widespread impact as a targeted attack on an already widely-used project.

Mike Fiedler, the PyPI Safety and Security Engineer is working on new systems for reducing the time that malware is available to be installed on PyPI, through APIs that security researchers can automatically send reports to and new "quarantine" release status to prevent harm while a human investigates the situation. Expect more in this space in 2025!

Comments (none posted)

Kernel release status

The current development kernel is 6.13-rc3, released on December 15. Linus commented: "Earlier this week it felt to me like things might have already started to quiet down in prep for the holidays, but doing the statistics on rc3 that doesn't actually seem to be the case - this looks very regular both in number of commits and in diff size".

Stable updates: 6.12.5, 6.6.66, 6.1.120, 5.15.174, 5.10.231, and 5.4.287 were released on December 14.

The 6.12.6, 6.6.67, 6.1.121, 5.15.175, 5.10.232, and 5.4.288 updates are in the review process; they are due on December 19.

Comments (none posted)

Quote of the week

To my surprise, there is an English word "primite". According to Merriam Webster, this is "the anterior member of a pair of gregarines in syzygy". I fervently hope not to have much opportunity to use this word, especially in reference to myself.

— Paul McKenney

Comments (4 posted)

CentOS Stream 10 and EPEL 10 released

The CentOS Project has announced the general availability of CentOS Stream 10. See the release notes for information on new features, changes, and removed software. The Extra Packages for Enterprise Linux (EPEL) 10 repository is also available, and will be adding minor version repositories:

For the EPEL 9 release, we started building packages about six months before the RHEL 9 release by using CentOS Stream 9 as the initial build environment. For EPEL 10, we're expanding on that approach and doing the same thing for each minor version of RHEL 10. We will have separate DNF repositories for each minor version of RHEL 10, including CentOS Stream 10 as the leading minor version. Packages built for one minor version will carry forward to the next minor version. You can find more details about this structure in our branching documentation.

LWN covered Stream 10 and EPEL 10 on December 11.

Comments (none posted)

Fedora Asahi Remix 41 is now available

Fedora Magazine reports that the Fedora Asahi Remix 41 for Apple Silicon is now available:

In addition to all the exciting improvements brought by Fedora Linux 41, Fedora Asahi Remix 41 provides x86/x86-64 emulation integration including support for AAA games to Apple Silicon. The game support is based on the new conformant Vulkan 1.4 driver. It also continues to provide extensive device support, including high quality audio out of the box.

LWN covered a talk from the X.org Developers Conference (XDC) by Alyssa Rosenzweig on the status of Asahi's GPU drivers in October.

Comments (3 posted)

Kali Linux 2024.4 released

Version 2024.4 of the Kali Linux penetration-testing distribution has been released. Changes include a switch to Python 3.12, the removal of i386 kernel support, GNOME 47, and more.

Comments (none posted)

Kubernetes v1.32 released

Version 1.32 (dubbed "Penelope") of Kubernetes has been released with 13 major features graduating to Stable status, 12 entering Beta, and 19 entering Alpha.

If Kubernetes is Ancient Greek for "pilot", in this release we start from that origin and reflect on the last 10 years of Kubernetes and our accomplishments: each release cycle is a journey, and just like Penelope, in "The Odyssey", weaved for 10 years -- each night removing parts of what she had done during the day -- so does each release add new features and removes others, albeit here with a much clearer purpose of constantly improving Kubernetes.

Comments (none posted)

A sapling matures: meet sq 1.0

The Sequoia PGP project has announced version 1.0 of the sq command-line tool for managing OpenPGP encryption and signatures. It also provides a decentralized public key infrastructure (PKI), and key management facilities. This is the first stable release since development began on the project in 2017.

sq's PKI is probably its most notable feature, and the one we invested the most time in. The PKI is used to authenticate certificates, and messages. Authentication is necessary to ensure that you are encrypting to the person you think you are, and to identify who really authored a message; without authentication, encryption and verification are much weaker.

Comments (24 posted)

Xfce 4.20 released

Version 4.20 of the Xfce desktop environment has been released. "The major focus during this development cycle was the preparation of the codebase to be ready for Wayland". See the Xfce 4.20 tour for an overview of the changes in this release.

Comments (31 posted)