--17507696571.fddF9CA99.31988
Date: Tue, 24 Jun 2025 12:54:17 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245289

            Bug ID: 1245289
           Summary: VUL-0: CVE-2025-6545: python-pytest-html: pbkdf2: predictable uninitialized/zero-filled memory returned for non-normalized or unimplemented algorithms supported by Node.js
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/460885/
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: python-maintainers-at-suse.com
          Reporter: camila.matos-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com, security-team-at-suse.de,
                    smash_bz-at-suse.de
            Blocks: 1245273
  Target Milestone: ---
          Deadline: 2025-07-11
          Found By: Security Response Team
           Blocker: ---

+++ This bug was initially created as a clone of Bug #1245273 +++

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing=
 by
Improper Validation. This vulnerability is associated with program files
lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-6545
https://www.cve.org/CVERecord?id=3DCVE-2025-6545
https://github.com/browserify/pbkdf2/commit/9699045c37a07f8319cfb8d44e2ff42=
52d7a7078
https://github.com/browserify/pbkdf2/commit/e3102a8cd4830a3ac85cd0dd011cc00=
2fdde33bb
https://github.com/browserify/pbkdf2/security/advisories/GHSA-h7cp-r72f-jxh6
https://bugzilla.redhat.com/show_bug.cgi?id=3D2374370
https://github.com/CVEProject/cvelistV5/blob/main//cves/2025/6xxx/CVE-2025-=
6545.json
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17507696571.fddF9CA99.31988
Date: Tue, 24 Jun 2025 12:54:17 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245289

          Summary
          VUL-0: CVE-2025-6545: python-pytest-html: pbkdf2: predictable=
 uninitialized/zero-filled memory returned for non-normalized or unimplemen=
ted algorithms supported by Node.js

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/460885/

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          python-maintainers@suse.com

          Reporter
          camila.matos@suse.com

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com, security-team@suse.de, smash_b=
z@suse.de

          Blocks
          1245273

          Target Milestone
          ---

          Deadline
          2025-07-11

          Found By
          Security Response Team

          Blocker
          ---

+++ This bug was initially created as a clone of Bug #1245273 +++

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing=
 by
Improper Validation. This vulnerability is associated with program files
lib/to-buffer.Js.

This issue affects pbkdf2: from 3.0.10 through 3.1.2.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-6545
https://www.cv=
e.org/CVERecord?id=3DCVE-2025-6545
https://github.com/browserify/pbkdf2/commit/9699045c3=
7a07f8319cfb8d44e2ff4252d7a7078
https://github.com/browserify/pbkdf2/commit/e3102a8cd=
4830a3ac85cd0dd011cc002fdde33bb
https://github.com/browserify/pbkdf2/security/advisories/GHSA=
-h7cp-r72f-jxh6
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2374370
https://github.com/CVEProject/cvelistV5/blob/main//cv=
es/2025/6xxx/CVE-2025-6545.json

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17507696571.fddF9CA99.31988--


--17508345944.Ac7220e4.1754
Date: Wed, 25 Jun 2025 06:56:34 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245332

            Bug ID: 1245332
           Summary: VUL-0: CVE-2025-6555,CVE-2025-6556,CVE-2025-6557: chromium: 138.0.7204.49 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: andrea.mattiazzo-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The Chrome team is delighted to announce the promotion of Chrome 138 to the
stable channel for Windows, Mac and Linux. This will roll out over the comi=
ng
days/weeks.

Chrome 138.0.7204.49 (Linux) contains a number of fixes and improvements --=
 a
list of changes is available in the log. Watch out for upcoming Chrome and
Chromium blog posts about new features and big efforts delivered in 138.

Security Fixes

This update includes 11 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

- CVE-2025-6555: Use after free in Animation.=20
- CVE-2025-6556: Insufficient policy enforcement in Loader.=20
- CVE-2025-6557: Insufficient data validation in DevTools.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17508345944.Ac7220e4.1754
Date: Wed, 25 Jun 2025 06:56:34 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245332

          Summary
          VUL-0: CVE-2025-6555,CVE-2025-6556,CVE-2025-6557: chromium: 1=
38.0.7204.49 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          andrea.mattiazzo@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The Chrome team is delighted to announce the promotion of Ch=
rome 138 to the
stable channel for Windows, Mac and Linux. This will roll out over the comi=
ng
days/weeks.

Chrome 138.0.7204.49 (Linux) contains a number of fixes and improvements --=
 a
list of changes is available in the log. Watch out for upcoming Chrome and
Chromium blog posts about new features and big efforts delivered in 138.

Security Fixes

This update includes 11 security fixes. Below, we highlight fixes that were
contributed by external researchers. Please see the Chrome Security Page for
more information.

- CVE-2025-6555: Use after free in Animation.=20
- CVE-2025-6556: Insufficient policy enforcement in Loader.=20
- CVE-2025-6557: Insufficient data validation in DevTools.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17508345944.Ac7220e4.1754--


--17508798503.Eb4E5.4198
Date: Wed, 25 Jun 2025 19:30:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245365

            Bug ID: 1245365
           Summary: VUL-0: CVE-2025-52889: incus: generation of nftables rules for local services can partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering` when using an ACL on a device connected to a bridge
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/461134/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: asarai-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Incus is a system container and virtual machine manager. When using an ACL =
on a
device connected to a bridge, Incus version 6.12 and 6.13 generates nftables
rules for local services (DHCP, DNS...) that partially bypass security opti=
ons
`security.mac_filtering`, `security.ipv4_filtering` and
`security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens =
the
door for other attacks. A patch is available at commit
2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-52889
https://bugzilla.redhat.com/show_bug.cgi?id=3D2374783
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17508798503.Eb4E5.4198
Date: Wed, 25 Jun 2025 19:30:50 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          <a class=3D"bz_bug_link=20
          bz_status_NEW "
   title=3D"NEW - VUL-0: CVE-2025-52889: incus: generation of nftables rule=
s for local services can partially bypass security options `security.mac_fi=
ltering`, `security.ipv4_filtering` and `security.ipv6_filtering` when usin=
g an ACL on a device connected to a bridge"
   href=3D"https://bugzilla.suse.com/show_bug.cgi?id=3D1245365">1245365

          Summary
          VUL-0: CVE-2025-52889: incus: generation of nftables rules fo=
r local services can partially bypass security options `security.mac_filter=
ing`, `security.ipv4_filtering` and `security.ipv6_filtering` when using an=
 ACL on a device connected to a bridge

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/461134/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          asarai@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Incus is a system container and virtual machine manager. Whe=
n using an ACL on a
device connected to a bridge, Incus version 6.12 and 6.13 generates nftables
rules for local services (DHCP, DNS...) that partially bypass security opti=
ons
`security.mac_filtering`, `security.ipv4_filtering` and
`security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens =
the
door for other attacks. A patch is available at commit
2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-52889
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2374783

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17508798503.Eb4E5.4198--


--17508804424.1C27Eccbd.4243
Date: Wed, 25 Jun 2025 19:40:42 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245367

            Bug ID: 1245367
           Summary: VUL-0: CVE-2025-52890: incus: generation of nftables rules that can partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering` when using an ACL on a device connected to a bridge
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.6
          Hardware: Other
               URL: https://smash.suse.de/issue/461135/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: asarai-at-suse.com
          Reporter: smash_bz-at-suse.de
        QA Contact: security-team-at-suse.de
                CC: camila.matos-at-suse.com
  Target Milestone: ---
          Found By: Security Response Team
           Blocker: ---

Incus is a system container and virtual machine manager. When using an ACL =
on a
device connected to a bridge, Incus versions 6.12 and 6.13 generates nftabl=
es
rules that partially bypass security options `security.mac_filtering`,
`security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to A=
RP
spoofing on the bridge and to fully spoof another VM/container on the same
bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for
the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-52890
https://bugzilla.redhat.com/show_bug.cgi?id=3D2374785
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17508804424.1C27Eccbd.4243
Date: Wed, 25 Jun 2025 19:40:42 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          <a class=3D"bz_bug_link=20
          bz_status_NEW "
   title=3D"NEW - VUL-0: CVE-2025-52890: incus: generation of nftables rule=
s that can partially bypass security options `security.mac_filtering`, `sec=
urity.ipv4_filtering` and `security.ipv6_filtering` when using an ACL on a =
device connected to a bridge"
   href=3D"https://bugzilla.suse.com/show_bug.cgi?id=3D1245367">1245367

          Summary
          VUL-0: CVE-2025-52890: incus: generation of nftables rules th=
at can partially bypass security options `security.mac_filtering`, `securit=
y.ipv4_filtering` and `security.ipv6_filtering` when using an ACL on a devi=
ce connected to a bridge

          Classification
          openSUSE

          Product
          openSUSE Distribution

          Version
          Leap 15.6

          Hardware
          Other

          URL
          https://smash.suse.de/issue/461135/

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          asarai@suse.com

          Reporter
          smash_bz@suse.de

          QA Contact
          security-team@suse.de

          CC
          camila.matos@suse.com

          Target Milestone
          ---

          Found By
          Security Response Team

          Blocker
          ---

Incus is a system container and virtual machine manager. Whe=
n using an ACL on a
device connected to a bridge, Incus versions 6.12 and 6.13 generates nftabl=
es
rules that partially bypass security options `security.mac_filtering`,
`security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to A=
RP
spoofing on the bridge and to fully spoof another VM/container on the same
bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for
the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=3DCVE-2025-52890
https://b=
ugzilla.redhat.com/show_bug.cgi?id=3D2374785

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17508804424.1C27Eccbd.4243--


--17509268662.e97d.357
Date: Thu, 26 Jun 2025 08:34:26 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245378

            Bug ID: 1245378
           Summary: openqa-bootstrap: unknown host names used
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Slowroll
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: santiago.zarate-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Running openQA-bootstrap-5.1750754160.1caccdc7-1.1.x86_64 's
/usr/share/openqa/script/openqa-bootstrap makes a ping to two unavailable
names:

+ echo -e '[auth]\nmethod =3D Fake'
+ [[ -z '' ]]
+ ping -c1 download.suse.de.
ping: download.suse.de.: Name or service not known
+ [[ -z '' ]]
+ ping -c1 gitlab.suse.de.
ping: gitlab.suse.de.: Name or service not known
+ /usr/share/openqa/script/fetchneedles
running as root, re-exec as geekotest ...
cloning https://github.com/os-autoinst/os-autoinst-distri-opensuse.git shal=
low.
Call 'git fetch --unshallow' for full history
Cloning into '.'...
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17509268662.e97d.357
Date: Thu, 26 Jun 2025 08:34:26 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245378

          Summary
          openqa-bootstrap: unknown host names used

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Slowroll

          Hardware
          x86-64

          OS
          Linux

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          jengelh@inai.de

          QA Contact
          qa-bugs@suse.de

          CC
          santiago.zarate@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Running openQA-bootstrap-5.1750754160.1caccdc7-1.1.x86_64 's
/usr/share/openqa/script/openqa-bootstrap makes a ping to two unavailable
names:

+ echo -e '[auth]\nmethod =3D Fake'
+ [[ -z '' ]]
+ ping -c1 download.suse.de.
ping: download.suse.de.: Name or service not known
+ [[ -z '' ]]
+ ping -c1 gitlab.suse.de.
ping: gitlab.suse.de.: Name or service not known
+ /usr/share/openqa/script/fetchneedles
running as root, re-exec as geekotest ...
cloning https://github.com/os-autoinst/os-autoinst-distri-opensuse.git =
shallow.
Call 'git fetch --unshallow' for full history
Cloning into '.'...

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17509268662.e97d.357--


--17509269524.fDaFf.363
Date: Thu, 26 Jun 2025 08:35:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245379

            Bug ID: 1245379
           Summary: openqa-bootstrap: curl call not robust enough
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: santiago.zarate-at-suse.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

openqa-bootstrap does not seem to be able to cope with https redirects.

+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
^Z
[1]+  Stopped                 setup_web_proxy=3Dnginx ./openqa-bootstrap
10:29 a4:../openqa/script # curl -sI http://localhost/
HTTP/1.1 301 Moved Permanently
Server: nginx/1.28.0
Date: Thu, 26 Jun 2025 08:29:59 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://localhost/
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17509269524.fDaFf.363
Date: Thu, 26 Jun 2025 08:35:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245379

          Summary
          openqa-bootstrap: curl call not robust enough

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          Linux

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          jengelh@inai.de

          QA Contact
          qa-bugs@suse.de

          CC
          santiago.zarate@suse.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

openqa-bootstrap does not seem to be able to cope with https=
 redirects.

+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
+ curl -sI http://localhost/
+ grep 200
+ sleep 3
^Z
[1]+  Stopped                 setup_web_proxy=3Dnginx ./openqa-bootstrap
10:29 a4:../openqa/script # curl -sI http://l=
ocalhost/
HTTP/1.1 301 Moved Permanently
Server: nginx/1.28.0
Date: Thu, 26 Jun 2025 08:29:59 GMT
Content-Type: text/html
Content-Length: 169
Connection: keep-alive
Location: https://localhost/

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17509269524.fDaFf.363--


body:
--17509859323.eaDdD.2375
Date: Fri, 27 Jun 2025 00:58:52 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245428

            Bug ID: 1245428
           Summary: mumble can not be installed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: M.Traxler-at-gsi.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Hello,

with the newest tumbleweed mumble can not be installed anymore:

# zypper in mumble
...
Problem: 1: nothing provides 'libprotobuf.so.30.2.0()(64bit)' needed by the=
 to
be installed mumble-1.5.735-225.30.x86_64
 Solution 1: do not install mumble-1.5.735-225.30.x86_64
 Solution 2: break mumble-1.5.735-225.30.x86_64 by ignoring some of its
dependencies

What can be done to be able to install mumble again?

Installing while breaking the system (solution 2) only leads to:

# mumble  --version=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                                                  mumble: error while loadi=
ng
shared libraries: libprotobuf.so.30.2.0: cannot open shared object file: No
such file or directory

But I can not install the old version of libprotobuf (libprotobuf.so.30.2.0)
because I get this error:
# rpm -i libprotobuf30_2_0-30.2-1.1.x86_64.rpm
error: Failed dependencies:
        libabsl_cord.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_cord_internal.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_cordz_info.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_die_if_null.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_hash.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_check_op.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_conditions.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_message.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_nullguard.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_raw_hash_set.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_spinlock_wait.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_status.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_statusor.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_str_format_internal.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_strings.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_synchronization.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_throw_delegate.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_time.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_time_zone.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libutf8_validity.so.30.2.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64

Any idea how to solve this problem?
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17509859323.eaDdD.2375
Date: Fri, 27 Jun 2025 00:58:52 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245428

          Summary
          mumble can not be installed

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Critical

          Priority
          P5 - None

          Component
          Other

          Assignee
          screening-team-bugs@suse.de

          Reporter
          M.Traxler@gsi.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Hello,

with the newest tumbleweed mumble can not be installed anymore:

# zypper in mumble
...
Problem: 1: nothing provides 'libprotobuf.so.30.2.0()(64bit)' needed by the=
 to
be installed mumble-1.5.735-225.30.x86_64
 Solution 1: do not install mumble-1.5.735-225.30.x86_64
 Solution 2: break mumble-1.5.735-225.30.x86_64 by ignoring some of its
dependencies

What can be done to be able to install mumble again?

Installing while breaking the system (solution 2) only leads to:

# mumble  --version=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                                                  mumble: error while loadi=
ng
shared libraries: libprotobuf.so.30.2.0: cannot open shared object file: No
such file or directory

But I can not install the old version of libprotobuf (libprotobuf.so.30.2.0)
because I get this error:
# rpm -i libprotobuf30_2_0-30.2-1.1.x86_64.rpm
error: Failed dependencies:
        libabsl_cord.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_cord_internal.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_cordz_info.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_die_if_null.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_hash.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_check_op.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_conditions.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_message.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_log_internal_nullguard.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_raw_hash_set.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_spinlock_wait.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_status.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_statusor.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_str_format_internal.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_strings.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_synchronization.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_throw_delegate.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_time.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libabsl_time_zone.so.2501.0.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64
        libutf8_validity.so.30.2.0()(64bit) is needed by
libprotobuf30_2_0-30.2-1.1.x86_64

Any idea how to solve this problem?

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17509859323.eaDdD.2375--

summary: mumble can not be installed


body:
--17510363300.B35AfE6.3812
Date: Fri, 27 Jun 2025 14:58:50 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245446

            Bug ID: 1245446
           Summary: Monitor turns off after booting 6.15.3

summary: Monitor turns off after booting 6.15.3


--17510398240.C17c6a.3932
Date: Fri, 27 Jun 2025 15:57:04 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245451

            Bug ID: 1245451
           Summary: AUDIT-0: dnf5: review of new polkit rules
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: fl4nn-at-posteo.de
        QA Contact: security-team-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

For the package found in OBS in system:packagemanager:dnf/dnf5 I would like=
 a
whitelisting for the following rpmlint error:

dnf5daemon-server.x86_64: E: polkit-untracked-privilege (Badness: 10)
org.rpm.dnf.v0.rpm.execute_trusted_transaction
(auth_admin:auth_admin:auth_admin_keep)
The polkit action is not listed in the polkit-default-privs profiles

dnf5daemon-server.x86_64: E: polkit-file-unauthorized (Badness: 10)
/usr/share/polkit-1/rules.d/org.rpm.dnf.v0.rules (sha256 file digest default
filter:7d96ff44ae23ba6cb07ca24f76fe22cc43d2bc2e15b9feb86f53d09b777d78f7 she=
ll
filter:7d96ff44ae23ba6cb07ca24f76fe22cc43d2bc2e15b9feb86f53d09b777d78f7 xml
filter:<failed-to-calculate>)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17510398240.C17c6a.3932
Date: Fri, 27 Jun 2025 15:57:04 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245451

          Summary
          AUDIT-0: dnf5: review of new polkit rules

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          fl4nn@posteo.de

          QA Contact
          security-team@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

For the package found in OBS in system:packagemanager:dnf/dn=
f5 I would like a
whitelisting for the following rpmlint error:

dnf5daemon-server.x86_64: E: polkit-untracked-privilege (Badness: 10)
org.rpm.dnf.v0.rpm.execute_trusted_transaction
(auth_admin:auth_admin:auth_admin_keep)
The polkit action is not listed in the polkit-default-privs profiles

dnf5daemon-server.x86_64: E: polkit-file-unauthorized (Badness: 10)
/usr/share/polkit-1/rules.d/org.rpm.dnf.v0.rules (sha256 file digest default
filter:7d96ff44ae23ba6cb07ca24f76fe22cc43d2bc2e15b9feb86f53d09b777d78f7 she=
ll
filter:7d96ff44ae23ba6cb07ca24f76fe22cc43d2bc2e15b9feb86f53d09b777d78f7 xml
filter:<failed-to-calculate>)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17510398240.C17c6a.3932--


--17510969040.93bD1CdBA.4598
Date: Sat, 28 Jun 2025 07:48:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245470

            Bug ID: 1245470
           Summary: [SELinux] Plymouth fails to display passphrase prompt for LUKS volume on boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: arvidjaar-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Operating System: openSUSE Tumbleweed

bor@uefi:~> sudo sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      34
bor@uefi:~>=20

Loading repository data...
Reading installed packages...

Information for package selinux-policy:
---------------------------------------
Repository     : openSUSE-20191030-0 (20250618)
Name           : selinux-policy
Version        : 20250616-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes
Status         : up-to-date
Source package : selinux-policy-20250616-1.1.src
Upstream URL   : https://github.com/openSUSE/selinux-policy
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.

bor@uefi:~>=20

bor@uefi:~> LANG=3DC zypper info plymouth
Loading repository data...
Reading installed packages...

Information for package plymouth:
---------------------------------
Repository     : openSUSE-20191030-0 (20250618)
Name           : plymouth
Version        : 22.02.122+94.4bd41a3-16.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 379.4 KiB
Installed      : Yes
Status         : up-to-date
Source package : plymouth-22.02.122+94.4bd41a3-16.1.src
Upstream URL   : https://www.freedesktop.org/wiki/Software/Plymouth
Summary        : Graphical Boot Animation and Logger
Description    :=20
    Plymouth provides an attractive graphical boot animation in
    place of the text messages that normally get shown. Text
    messages are instead redirected to a log file for viewing
    after boot.

bor@uefi:~>=20

Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.813:6): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D"859" dev=3D"pr=
oc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.813:7): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D"859" dev=3D"pr=
oc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.815:8): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D"859" dev=3D"pr=
oc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.815:9): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D"859" dev=3D"pr=
oc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0

Those AVC do not appear in ausearch results! They are visible only in journ=
al.
Probably they happen before audit logging is initialized, not sure.

Reproducer in my case:

Format LUKS device:

sudo cryptsetup luksFormat /dev/sdb --force-password
bor@uefi:~> lsblk -f  /dev/sdb
NAME FSTYPE      FSVER LABEL UUID                                 FSAVAIL
FSUSE% MOUNTPOINTS
sdb  crypto_LUKS 2           cb73be89-a794-470c-bcf6-9475809667ef=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
bor@uefi:~>=20

Add this device to the /etc/crypttab

bor@uefi:~> cat /etc/crypttab
cr_test UUID=3Dcb73be89-a794-470c-bcf6-9475809667ef - nofail
bor@uefi:~>=20

Reboot. No passhprase prompt appears in Plymouth, the systemd-cryptsetup
service is still activating and password request in systemd is still active

=E2=97=8F systemd-cryptsetup@cr_test.service - Cryptography Setup for cr_te=
st
     Loaded: loaded (/etc/crypttab; generated)
     Active: activating (start) since Sat 2025-06-28 10:33:12 MSK; 12min ago
        Job: 223
 Invocation: 8e347217139e4710a07848c48a88d7f9
       Docs: man:crypttab(5)
             man:systemd-cryptsetup-generator(8)
             man:systemd-cryptsetup@.service(8)
   Main PID: 736 (systemd-cryptse)
      Tasks: 1 (limit: 3366)
        CPU: 51ms
     CGroup:
/system.slice/system-systemd\x2dcryptsetup.slice/systemd-cryptsetup@cr_test=
.servi>
             =E2=94=94=E2=94=80736 /usr/bin/systemd-cryptsetup attach cr_te=
st
/dev/disk/by-uuid/cb73be89-a794->

Warning: some journal files were not opened due to insufficient permissions.

bor@uefi:~> LANG=3DC ll -Zd /run/systemd/ask-password/
drwxr-xr-x. 2 root root system_u:object_r:systemd_passwd_var_run_t:s0 80 Ju=
n 28
10:33 /run/systemd/ask-password/
bor@uefi:~> LANG=3DC ll -Z /run/systemd/ask-password/
total 4
-rw-r--r--. 1 root root system_u:object_r:systemd_passwd_var_run_t:s0 266 J=
un
28 10:33 ask.10692897680606647749
srw-------. 1 root root system_u:object_r:systemd_passwd_var_run_t:s0   0 J=
un
28 10:33 sck.ef7967b2a785f4e0
bor@uefi:~> cat /run/systemd/ask-password/ask.10692897680606647749=20
[Ask]
PID=3D736
Socket=3D/run/systemd/ask-password//sck.ef7967b2a785f4e0
AcceptCached=3D1
Echo=3D0
NotAfter=3D0
Silent=3D0
Message=3DPlease enter passphrase for disk QEMU_HARDDISK (cr_test):
Icon=3Ddrive-harddisk
Id=3Dcryptsetup:/dev/disk/by-uuid/cb73be89-a794-470c-bcf6-9475809667ef
bor@uefi:~>
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17510969040.93bD1CdBA.4598
Date: Sat, 28 Jun 2025 07:48:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245470

          Summary
          [SELinux] Plymouth fails to display passphrase prompt for LUK=
S volume on boot

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          arvidjaar@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Operating System: openSUSE Tumbleweed

bor@uefi:~> sudo sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      34
bor@uefi:~>=20

Loading repository data...
Reading installed packages...

Information for package selinux-policy:
---------------------------------------
Repository     : openSUSE-20191030-0 (20250618)
Name           : selinux-policy
Version        : 20250616-1.1
Arch           : noarch
Vendor         : openSUSE
Installed Size : 24.9 KiB
Installed      : Yes
Status         : up-to-date
Source package : selinux-policy-20250616-1.1.src
Upstream URL   : htt=
ps://github.com/openSUSE/selinux-policy
Summary        : SELinux policy configuration
Description    :=20
    A complete SELinux policy that can be used as the system policy for a
variety
    of systems and used as the basis for creating other policies.

bor@uefi:~>=20

bor@uefi:~> LANG=3DC zypper info plymouth
Loading repository data...
Reading installed packages...

Information for package plymouth:
---------------------------------
Repository     : openSUSE-20191030-0 (20250618)
Name           : plymouth
Version        : 22.02.122+94.4bd41a3-16.1
Arch           : x86_64
Vendor         : openSUSE
Installed Size : 379.4 KiB
Installed      : Yes
Status         : up-to-date
Source package : plymouth-22.02.122+94.4bd41a3-16.1.src
Upstream URL   : https://www.freedesktop.org/wiki/Software/Plymouth
Summary        : Graphical Boot Animation and Logger
Description    :=20
    Plymouth provides an attractive graphical boot animation in
    place of the text messages that normally get shown. Text
    messages are instead redirected to a log file for viewing
    after boot.

bor@uefi:~>=20

Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.813:6): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D&quot=
;859" dev=3D"proc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.813:7): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D&quot=
;859" dev=3D"proc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.815:8): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D&quot=
;859" dev=3D"proc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0
Jun 28 10:33:16 uefi kernel: audit: type=3D1400 audit(1751095994.815:9): av=
c:=20
denied  { search } for  pid=3D857 comm=3D"plymouthd" name=3D&quot=
;859" dev=3D"proc" ino=3D6084
scontext=3Dsystem_u:system_r:plymouthd_t:s0
tcontext=3Dsystem_u:system_r:systemd_passwd_agent_t:s0 tclass=3Ddir permiss=
ive=3D0

Those AVC do not appear in ausearch results! They are visible only in journ=
al.
Probably they happen before audit logging is initialized, not sure.

Reproducer in my case:

Format LUKS device:

sudo cryptsetup luksFormat /dev/sdb --force-password
bor@uefi:~> lsblk -f  /dev/sdb
NAME FSTYPE      FSVER LABEL UUID                                 FSAVAIL
FSUSE% MOUNTPOINTS
sdb  crypto_LUKS 2           cb73be89-a794-470c-bcf6-9475809667ef=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
bor@uefi:~>=20

Add this device to the /etc/crypttab

bor@uefi:~> cat /etc/crypttab
cr_test UUID=3Dcb73be89-a794-470c-bcf6-9475809667ef - nofail
bor@uefi:~>=20

Reboot. No passhprase prompt appears in Plymouth, the systemd-cryptsetup
service is still activating and password request in systemd is still active

=E2=97=8F systemd=
-cryptsetup@cr_test.service - Cryptography Setup for cr_test
     Loaded: loaded (/etc/crypttab; generated)
     Active: activating (start) since Sat 2025-06-28 10:33:12 MSK; 12min ago
        Job: 223
 Invocation: 8e347217139e4710a07848c48a88d7f9
       Docs: man:crypttab(5)
             man:systemd-cryptsetup-generator(8)
             man:systemd-cryptsetup@.service(8)
   Main PID: 736 (systemd-cryptse)
      Tasks: 1 (limit: 3366)
        CPU: 51ms
     CGroup:
/system.slice/system-systemd\x2dcryptsetup.slice/systemd-cryptsetup@cr_test.servi>
             =E2=94=94=E2=94=80736 /usr/bin/systemd-cryptsetup attach cr_te=
st
/dev/disk/by-uuid/cb73be89-a794->

Warning: some journal files were not opened due to insufficient permissions.

bor@uefi:~> LANG=3DC ll -Zd /run/systemd/ask-password/
drwxr-xr-x. 2 root root system_u:object_r:systemd_passwd_var_run_t:s0 80 Ju=
n 28
10:33 /run/systemd/ask-password/
bor@uefi:~> LANG=3DC ll -Z /run/systemd/ask-password/
total 4
-rw-r--r--. 1 root root system_u:object_r:systemd_passwd_var_run_t:s0 266 J=
un
28 10:33 ask.10692897680606647749
srw-------. 1 root root system_u:object_r:systemd_passwd_var_run_t:s0   0 J=
un
28 10:33 sck.ef7967b2a785f4e0
bor@uefi:~> cat /run/systemd/ask-password/ask.10692897680606647749=20
[Ask]
PID=3D736
Socket=3D/run/systemd/ask-password//sck.ef7967b2a785f4e0
AcceptCached=3D1
Echo=3D0
NotAfter=3D0
Silent=3D0
Message=3DPlease enter passphrase for disk QEMU_HARDDISK (cr_test):
Icon=3Ddrive-harddisk
Id=3Dcryptsetup:/dev/disk/by-uuid/cb73be89-a794-470c-bcf6-9475809667ef
bor@uefi:~>

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17510969040.93bD1CdBA.4598--


body:
--17511930590.C6E830.5005
Date: Sun, 29 Jun 2025 10:30:59 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245475

            Bug ID: 1245475
           Summary: wine-devel contains no archive files
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Tumbleweed
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aleithner@level101.at
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Recent versions of wine-devel are missing archive files, just like bug 1231=
820.
This time though, all architectures are missing, not just 64-bit.

It seems like request 1287260 [1] added a bunch of rm -f's to the package's
spec file to specifically remove these, see [2]. This, of course, breaks
building wine-specific projects using winegcc once again.

Without these archive files, winegcc fails to link winelib DLL projects aga=
inst
wine's libraries. Therefore, winelib DLL projects cannot be built on Tumble=
weed
currently.

[1]: https://build.opensuse.org/request/show/1287260
[2]: https://build.opensuse.org/request/show/1287260#diff_1_n150
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17511930590.C6E830.5005
Date: Sun, 29 Jun 2025 10:30:59 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245475

          Summary
          wine-devel contains no archive files

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          openSUSE Tumbleweed

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          aleithner@level101.at

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Recent versions of wine-devel are missing archive files, jus=
t like bug 1231820.
This time though, all architectures are missing, not just 64-bit.

It seems like request 1287260 [1] added a bunch of rm -f's to the package's
spec file to specifically remove these, see [2]. This, of course, breaks
building wine-specific projects using winegcc once again.

Without these archive files, winegcc fails to link winelib DLL projects aga=
inst
wine's libraries. Therefore, winelib DLL projects cannot be built on Tumble=
weed
currently.

[1]: https://bu=
ild.opensuse.org/request/show/1287260
[2]: https://build.opensuse.org/request/show/1287260#diff_1_n150

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17511930590.C6E830.5005--

summary: wine-devel contains no archive files


body:
--17512952815.20375.7023
Date: Mon, 30 Jun 2025 14:54:41 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245527

            Bug ID: 1245527
           Summary: GCC 15 - nethack doesn't build
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: tzimmermann-at-suse.com
          Reporter: tzimmermann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: pgajdos-at-suse.com
            Blocks: 1239850
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The error is

[   15s] allmain.c: In function =E2=80=98newgame=E2=80=99:
[   15s] allmain.c:507:31: error: passing argument 2 of =E2=80=98signal=E2=
=80=99 from
incompatible pointer type [-Wincompatible-pointer-types]
[   15s]   507 |         (void) signal(SIGINT, (SIG_RET_TYPE) done1);
[   15s]       |                               ^~~~~~~~~~~~~~~~~~~~
[   15s]       |                               |
[   15s]       |                               void (*)(void)
[   15s] In file included from /usr/include/sys/wait.h:36,
[   15s]                  from ../include/unixconf.h:284,
[   15s]                  from ../include/global.h:150,
[   15s]                  from ../include/config.h:356,
[   15s]                  from ../include/hack.h:9,
[   15s]                  from allmain.c:7:
[   15s] /usr/include/signal.h:88:57: note: expected =E2=80=98__sighandler_=
t=E2=80=99 {aka
=E2=80=98void (*)(int)=E2=80=99} but argument is of type =E2=80=98void (*)(=
void)=E2=80=99
[   15s]    88 | extern __sighandler_t signal (int __sig, __sighandler_t
__handler)
[   15s]       |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~^~~~~~~~~
[   15s] /usr/include/signal.h:72:16: note: =E2=80=98__sighandler_t=E2=80=
=99 declared here
[   15s]    72 | typedef void (*__sighandler_t) (int);
[   15s]       |                ^~~~~~~~~~~~~~
[   15s] allmain.c: In function =E2=80=98welcome=E2=80=99:
[   15s] allmain.c:547:1: warning: old-style function definition
[-Wold-style-definition]
[   15s]   547 | welcome(new_game)
[   15s]       | ^~~~~~~
[   15s] make[1]: *** [<builtin>: allmain.o] Error 1
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17512952815.20375.7023
Date: Mon, 30 Jun 2025 14:54:41 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245527

          Summary
          GCC 15 - nethack doesn't build

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Other

          Assignee
          tzimmermann@suse.com

          Reporter
          tzimmermann@suse.com

          QA Contact
          qa-bugs@suse.de

          CC
          pgajdos@suse.com

          Blocks
          1239850

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The error is

[   15s] allmain.c: In function =E2=80=98newgame=E2=80=99:
[   15s] allmain.c:507:31: error: passing argument 2 of =E2=80=98signal=E2=
=80=99 from
incompatible pointer type [-Wincompatible-pointer-types]
[   15s]   507 |         (void) signal(SIGINT, (SIG_RET_TYPE) done1);
[   15s]       |                               ^~~~~~~~~~~~~~~~~~~~
[   15s]       |                               |
[   15s]       |                               void (*)(void)
[   15s] In file included from /usr/include/sys/wait.h:36,
[   15s]                  from ../include/unixconf.h:284,
[   15s]                  from ../include/global.h:150,
[   15s]                  from ../include/config.h:356,
[   15s]                  from ../include/hack.h:9,
[   15s]                  from allmain.c:7:
[   15s] /usr/include/signal.h:88:57: note: expected =E2=80=98__sighandler_=
t=E2=80=99 {aka
=E2=80=98void (*)(int)=E2=80=99} but argument is of type =E2=80=98void (*)(=
void)=E2=80=99
[   15s]    88 | extern __sighandler_t signal (int __sig, __sighandler_t
__handler)
[   15s]       |=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
~~~~~~~~~~~~~~~^~~~~~~~~
[   15s] /usr/include/signal.h:72:16: note: =E2=80=98__sighandler_t=E2=80=
=99 declared here
[   15s]    72 | typedef void (*__sighandler_t) (int);
[   15s]       |                ^~~~~~~~~~~~~~
[   15s] allmain.c: In function =E2=80=98welcome=E2=80=99:
[   15s] allmain.c:547:1: warning: old-style function definition
[-Wold-style-definition]
[   15s]   547 | welcome(new_game)
[   15s]       | ^~~~~~~
[   15s] make[1]: *** [<builtin>: allmain.o] Error 1

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17512952815.20375.7023--

summary: GCC 15 - nethack doesn't build


--17513555802.aEF3.8243
Date: Tue, 1 Jul 2025 07:39:40 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245544

            Bug ID: 1245544
           Summary: VUL-0: CVE-2025-6554: chromium: 138.0.7204.96 release
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: ro-at-suse.com
          Reporter: abergmann-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-des=
ktop_30.html

Stable Channel Update for Desktop
Monday, June 30, 2025

The Stable channel has been updated to 138.0.7204.96/.97 for Windows,
138.0.7204.92/.93 for Mac and 138.0.7204.96 for Linux which will roll out o=
ver
the coming days/weeks. A full list of changes in this build is available in=
 the
Log.

 Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 1 security fix.=20
Below, we highlight fixes that were contributed by external researchers.=20
Please see the Chrome Security Page for more information.

- CVE-2025-6554: Type Confusion in V8.=20

Reported by Cl=C3=A9ment Lecigne of Google's Threat Analysis Group on 2025-=
06-25.

This issue was mitigated on 2025-06-26 by a configuration change pushed out=
 to
Stable channel across all platforms.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17513555802.aEF3.8243
Date: Tue, 1 Jul 2025 07:39:40 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245544

          Summary
          VUL-0: CVE-2025-6554: chromium: 138.0.7204.96 release

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Major

          Priority
          P5 - None

          Component
          Security

          Assignee
          ro@suse.com

          Reporter
          abergmann@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

https://chromereleases.googleblog.c=
om/2025/06/stable-channel-update-for-desktop_30.html

Stable Channel Update for Desktop
Monday, June 30, 2025

The Stable channel has been updated to 138.0.7204.96/.97 for Windows,
138.0.7204.92/.93 for Mac and 138.0.7204.96 for Linux which will roll out o=
ver
the coming days/weeks. A full list of changes in this build is available in=
 the
Log.

 Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majori=
ty
of users are updated with a fix. We will also retain restrictions if the bug
exists in a third party library that other projects similarly depend on, but
haven=E2=80=99t yet fixed.

This update includes 1 security fix.=20
Below, we highlight fixes that were contributed by external researchers.=20
Please see the Chrome Security Page for more information.

- CVE-2025-6554: Type Confusion in V8.=20

Reported by Cl=C3=A9ment Lecigne of Google's Threat Analysis Group on 2025-=
06-25.

This issue was mitigated on 2025-06-26 by a configuration change pushed out=
 to
Stable channel across all platforms.

Google is aware that an exploit for CVE-2025-6554 exists in the wild.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17513555802.aEF3.8243--


--17513637790.AB8b3b1fb.8702
Date: Tue, 1 Jul 2025 09:56:19 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245551

            Bug ID: 1245551
           Summary: systemd-update-helper: subsequent package removal and installations do not trigger restart of services
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: maciek.borzecki-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-snap-auto-instal=
l#
cat /etc/os-release
NAME=3D"openSUSE Tumbleweed"
# VERSION=3D"20250617"
ID=3D"opensuse-tumbleweed"
ID_LIKE=3D"opensuse suse"
VERSION_ID=3D"20250617"
PRETTY_NAME=3D"openSUSE Tumbleweed"

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-snap-auto-instal=
l#
zypper pa -i |grep systemd
i  | openSUSE-Tumbleweed-Oss | coreutils-systemd                           =
  |
9.7-2.1                        | x86_64
i  | openSUSE-Tumbleweed-Oss | libsystemd0                                 =
  |
257.6-2.1                      | x86_64
i+ | @System                 | systemd                                     =
  |
257.6-1.1                      | x86_64
v  | openSUSE-Tumbleweed-Oss | systemd                                     =
  |
257.6-2.1                      | x86_64
i  | openSUSE-Tumbleweed-Oss | systemd-default-settings                    =
  |
0.10-1.3                       | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-default-settings-branding-openSUSE  =
  |
0.10-1.3                       | noarch
i+ | openSUSE-Tumbleweed-Oss | systemd-devel                               =
  |
257.6-2.1                      | x86_64
i  | openSUSE-Tumbleweed-Oss | systemd-presets-branding-openSUSE           =
  |
12.2-25.1                      | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-presets-common-SUSE                 =
  |
15-39.1                        | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-rpm-macros                          =
  |
24-1.8                         | noarch
i  | @System                 | util-linux-systemd                          =
  |
2.41-2.1                       | x86_64
v  | openSUSE-Tumbleweed-Oss | util-linux-systemd                          =
  |
2.41.1-1.1                     | x86_64

I am working on packaging of snapd and I ran into issues in CI during testi=
ng
on openSUSE TW (snapshot and systemd version provided above).

On subsequent removal and installation of snapd package, the snapd.socket
service remains active. Specifically, removal of snapd package does not cau=
se
the socket unit to do away. I've tracked this down to systemd-update-helper
remove-system-units does not do anything. I've finally added `set -x` to
systemd-update-helper and got this log:

The following 2 packages are going to be REMOVED:
  snapd snapd-selinux

2 packages to remove.

Package install size change:
              |         0 B    required by packages that will be installed
  -157.1 MiB  |  -  157.1 MiB  released by packages that will be removed

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): y
+ command=3Dremove-system-units
+ shift
+ command -v systemctl
+ UPDATE_HELPER_USER_TIMEOUT_SEC=3D15
+ case "$command" in
+ do_remove_units system snapd.socket snapd.service snapd.seeded.service
snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target
+ mode=3Dsystem
+ shift
+ units=3D()
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.socket ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.seeded.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.apparmor.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.mounts.target ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.mounts-pre.target '=
]'
+ '[' 0 -eq 0 ']'
+ return
+ command=3Dremove-user-units
+ shift
+ command -v systemctl
+ UPDATE_HELPER_USER_TIMEOUT_SEC=3D15
+ case "$command" in
+ do_remove_units user snapd.session-agent.socket
+ mode=3Duser
+ shift
+ units=3D()
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/user/dont-disable/snapd.session-agent.socket =
']'
+ units+=3D("$unit")
+ '[' 1 -eq 0 ']'
+ case $mode in
+ systemctl --global disable --no-warn snapd.session-agent.socket
+ '[' -d /run/systemd/system ']'
++ systemctl list-units 'user@*' --legend=3Dno
++ sed -n -r 's/.*user@([0-9]+).service.*/\1/p'
+ users=3D0
+ for user in $users
+ wait
+ SYSTEMD_BUS_TIMEOUT=3D15s
+ systemctl --user -M 0@ disable --now --no-warn snapd.session-agent.socket
rmdir: failed to remove '/etc/systemd/system/snapd.mounts.target.wants': No
such file or directory
Stopping unit snapd.autoimport.service
Failed to stop snapd.autoimport.service: Unit snapd.autoimport.service not
loaded.
Waiting until unit snapd.autoimport.service is stopped [attempt 1]
snapd.autoimport.service is stopped.
Failed to kill unit snapd.autoimport.service: Unit snapd.autoimport.service=
 not
loaded.
Stopping unit snapd.seeded.service
Waiting until unit snapd.seeded.service is stopped [attempt 1]
snapd.seeded.service is stopped.
Failed to kill unit snapd.seeded.service: Unit snapd.seeded.service not loa=
ded.
Stopping unit snapd.apparmor.service
Waiting until unit snapd.apparmor.service is stopped [attempt 1]
snapd.apparmor.service is stopped.
Failed to kill unit snapd.apparmor.service: Unit snapd.apparmor.service not
loaded.
Stopping unit snapd.mounts.target
Waiting until unit snapd.mounts.target is stopped [attempt 1]
snapd.mounts.target is stopped.
Stopping unit snapd.mounts-pre.target
Waiting until unit snapd.mounts-pre.target is stopped [attempt 1]
snapd.mounts-pre.target is stopped.
Discarding preserved snap namespaces
Removing downloaded snaps
Removing features exported from snapd to helper tools
Final directory cleanup
Removing leftover snap shared state data
Removing snapd catalog cache
Removing extra snap-confine apparmor rules
warning: file /var/lib/snapd/apparmor/snap-confine: remove failed: No such =
file
or directory
warning: file /var/lib/snapd/apparmor/profiles: remove failed: No such file=
 or
directory
warning: file /snap: remove failed: No such file or directory
(1/2) Removing: snapd-1337.2.70-0.x86_64
...........................................................................=
...........................................................................=
.......[done]

It's clear that snapd.socket is not being stopped. I found this file:

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-snap-auto-instal=
l#
ls -lZ /run/systemd/rpm/system/dont-disable/snapd.socket
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 0 Jul =
 1
11:27 /run/systemd/rpm/system/dont-disable/snapd.socket

which is preventing the helper script from calling systemctl disable --now
snapd.socket.

I see that there was a change in systemd packaging
https://build.opensuse.org/package/rdiff/Base:System/systemd?linkrev=3Dbase=
&rev=3D1619
which added clean-state. I would have expected clean-state to be called upon
completion of a transaction. However, I found no rpm macro snippet I could =
add
to packaging, nor it is mentioned in the packaging wiki
https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines It feels like
there's some bit of integration missing somewhere.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17513637790.AB8b3b1fb.8702
Date: Tue, 1 Jul 2025 09:56:19 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245551

          Summary
          systemd-update-helper: subsequent package removal and install=
ations do not trigger restart of services

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          maciek.borzecki@gmail.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-s=
nap-auto-install#
cat /etc/os-release
NAME=3D"openSUSE Tumbleweed"
# VERSION=3D"20250617"
ID=3D"opensuse-tumbleweed"
ID_LIKE=3D"opensuse suse"
VERSION_ID=3D"20250617"
PRETTY_NAME=3D"openSUSE Tumbleweed"

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-snap-auto-instal=
l#
zypper pa -i |grep systemd
i  | openSUSE-Tumbleweed-Oss | coreutils-systemd                           =
  |
9.7-2.1                        | x86_64
i  | openSUSE-Tumbleweed-Oss | libsystemd0                                 =
  |
257.6-2.1                      | x86_64
i+ | @System                 | systemd                                 =
      |
257.6-1.1                      | x86_64
v  | openSUSE-Tumbleweed-Oss | systemd                                     =
  |
257.6-2.1                      | x86_64
i  | openSUSE-Tumbleweed-Oss | systemd-default-settings                    =
  |
0.10-1.3                       | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-default-settings-branding-openSUSE  =
  |
0.10-1.3                       | noarch
i+ | openSUSE-Tumbleweed-Oss | systemd-devel                               =
  |
257.6-2.1                      | x86_64
i  | openSUSE-Tumbleweed-Oss | systemd-presets-branding-openSUSE           =
  |
12.2-25.1                      | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-presets-common-SUSE                 =
  |
15-39.1                        | noarch
i  | openSUSE-Tumbleweed-Oss | systemd-rpm-macros                          =
  |
24-1.8                         | noarch
i  | @System                 | util-linux-systemd                      =
      |
2.41-2.1                       | x86_64
v  | openSUSE-Tumbleweed-Oss | util-linux-systemd                          =
  |
2.41.1-1.1                     | x86_64

I am working on packaging of snapd and I ran into issues in CI during testi=
ng
on openSUSE TW (snapshot and systemd version provided above).

On subsequent removal and installation of snapd package, the snapd.socket
service remains active. Specifically, removal of snapd package does not cau=
se
the socket unit to do away. I've tracked this down to systemd-update-helper
remove-system-units does not do anything. I've finally added `set -x` to
systemd-update-helper and got this log:

The following 2 packages are going to be REMOVED:
  snapd snapd-selinux

2 packages to remove.

Package install size change:
              |         0 B    required by packages that will be installed
  -157.1 MiB  |  -  157.1 MiB  released by packages that will be removed

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): y
+ command=3Dremove-system-units
+ shift
+ command -v systemctl
+ UPDATE_HELPER_USER_TIMEOUT_SEC=3D15
+ case "$command" in
+ do_remove_units system snapd.socket snapd.service snapd.seeded.service
snapd.apparmor.service snapd.mounts.target snapd.mounts-pre.target
+ mode=3Dsystem
+ shift
+ units=3D()
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.socket ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.seeded.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.apparmor.service ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.mounts.target ']'
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/system/dont-disable/snapd.mounts-pre.target '=
]'
+ '[' 0 -eq 0 ']'
+ return
+ command=3Dremove-user-units
+ shift
+ command -v systemctl
+ UPDATE_HELPER_USER_TIMEOUT_SEC=3D15
+ case "$command" in
+ do_remove_units user snapd.session-agent.socket
+ mode=3Duser
+ shift
+ units=3D()
+ for unit in "$@"
+ '[' '!' -e /run/systemd/rpm/user/dont-disable/snapd.session-agent.socket =
']'
+ units+=3D("$unit")
+ '[' 1 -eq 0 ']'
+ case $mode in
+ systemctl --global disable --no-warn snapd.session-agent.socket
+ '[' -d /run/systemd/system ']'
++ systemctl list-units 'user@*' --legend=3Dno
++ sed -n -r 's/.*user@([0-9]+).service.*/\1/p'
+ users=3D0
+ for user in $users
+ wait
+ SYSTEMD_BUS_TIMEOUT=3D15s
+ systemctl --user -M 0@ disable --now --no-warn snapd.session-agent.so=
cket
rmdir: failed to remove '/etc/systemd/system/snapd.mounts.target.wants': No
such file or directory
Stopping unit snapd.autoimport.service
Failed to stop snapd.autoimport.service: Unit snapd.autoimport.service not
loaded.
Waiting until unit snapd.autoimport.service is stopped [attempt 1]
snapd.autoimport.service is stopped.
Failed to kill unit snapd.autoimport.service: Unit snapd.autoimport.service=
 not
loaded.
Stopping unit snapd.seeded.service
Waiting until unit snapd.seeded.service is stopped [attempt 1]
snapd.seeded.service is stopped.
Failed to kill unit snapd.seeded.service: Unit snapd.seeded.service not loa=
ded.
Stopping unit snapd.apparmor.service
Waiting until unit snapd.apparmor.service is stopped [attempt 1]
snapd.apparmor.service is stopped.
Failed to kill unit snapd.apparmor.service: Unit snapd.apparmor.service not
loaded.
Stopping unit snapd.mounts.target
Waiting until unit snapd.mounts.target is stopped [attempt 1]
snapd.mounts.target is stopped.
Stopping unit snapd.mounts-pre.target
Waiting until unit snapd.mounts-pre.target is stopped [attempt 1]
snapd.mounts-pre.target is stopped.
Discarding preserved snap namespaces
Removing downloaded snaps
Removing features exported from snapd to helper tools
Final directory cleanup
Removing leftover snap shared state data
Removing snapd catalog cache
Removing extra snap-confine apparmor rules
warning: file /var/lib/snapd/apparmor/snap-confine: remove failed: No such =
file
or directory
warning: file /var/lib/snapd/apparmor/profiles: remove failed: No such file=
 or
directory
warning: file /snap: remove failed: No such file or directory
(1/2) Removing: snapd-1337.2.70-0.x86_64
...........................................................................=
...........................................................................=
.......[done]

It's clear that snapd.socket is not being stopped. I found this file:

garden:opensuse-tumbleweed-selinux-64 .../tests/main/snapd-snap-auto-instal=
l#
ls -lZ /run/systemd/rpm/system/dont-disable/snapd.socket
-rw-r--r--. 1 root root unconfined_u:object_r:systemd_unit_file_t:s0 0 Jul =
 1
11:27 /run/systemd/rpm/system/dont-disable/snapd.socket

which is preventing the helper script from calling systemctl disable --now
snapd.socket.

I see that there was a change in systemd packaging
https://build.opensuse.org/package/rdiff/Base:S=
ystem/systemd?linkrev=3Dbase&rev=3D1619
which added clean-state. I would have expected clean-state to be called upon
completion of a transaction. However, I found no rpm macro snippet I could =
add
to packaging, nor it is mentioned in the packaging wiki
h=
ttps://en.opensuse.org/openSUSE:Systemd_packaging_guidelines It feels l=
ike
there's some bit of integration missing somewhere.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17513637790.AB8b3b1fb.8702--


body:
--17514376442.53BEfe0C.11269
Date: Wed, 2 Jul 2025 06:27:24 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245584

            Bug ID: 1245584
           Summary: gcc 15.1.1+git9866-s390 regression
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: jslaby-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

Created attachment 883820
  --> https://bugzilla.suse.com/attachment.cgi?id=3D883820&action=3Dedit
preprocessed source

> https://build.opensuse.org/packages/kernel-source:kernel-default/job_hist=
ory/Kernel:stable/S390/s390x
> https://build.opensuse.org/package/live_build_log/Kernel:stable/kernel-so=
urce:kernel-default/S390/s390x
> I cannot repro with cross though: cross-s390x-gcc15-bootstrap-15.1.1+git9=
866-150300.36.1.x86_64
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/too=
ls/lib/bpf/libbpf.c?h=3Dlinux-6.15.y#n10090
> mod_len is set iff mod_name, so the error is bogus
> ok, gcc15-15.1.1+git9866-150300.36.1.x86_64 does not exhibit that, so it =
must be really s390 specific

> gcc-15 -g -O2 -std=3Dgnu89 -Wbad-function-cast -Wdeclaration-after-statem=
ent -Wformat-security -Wformat-y2k -Winit-self -Wmissing-declarations -Wmis=
sing-prototypes -Wnested-externs -Wno-system-headers -Wold-style-definition=
 -Wpacked -Wredundant-decls -Wstrict-prototypes -Wswitch-default -Wswitch-e=
num -Wundef -Wwrite-strings -Wformat -Wno-type-limits -Wstrict-aliasing=3D3=
 -Wshadow -Wno-switch-enum -Werror -Wall -fvisibility=3Dhidden -D_LARGEFILE=
64_SOURCE -D_FILE_OFFSET_BITS=3D64 -D"BUILD_STR(s)=3D#s"
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17514376442.53BEfe0C.11269
Date: Wed, 2 Jul 2025 06:27:24 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245584

          Summary
          gcc 15.1.1+git9866-s390 regression

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Development

          Assignee
          screening-team-bugs@suse.de

          Reporter
          jslaby@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

Created attachment 883820<=
/a> [details]
preprocessed source

> https://b=
uild.opensuse.org/packages/kernel-source:kernel-default/job_history/Kernel:=
stable/S390/s390x
> https://build.opensuse.org/pa=
ckage/live_build_log/Kernel:stable/kernel-source:kernel-default/S390/s390x<=
/a>
> I cannot repro with cross though: cross-s390x-gcc15-bootstrap-15.1.1+g=
it9866-150300.36.1.x86_64
> https://git.kern=
el.org/pub/scm/linux/kernel/git/stable/linux.git/tree/tools/lib/bpf/libbpf.=
c?h=3Dlinux-6.15.y#n10090
> mod_len is set iff mod_name, so the error is bogus
> ok, gcc15-15.1.1+git9866-150300.36.1.x86_64 does not exhibit that, so =
it must be really s390 specific

> gcc-15 -g -O2 -std=3Dgnu89 -Wbad-function-cast -=
Wdeclaration-after-statement -Wformat-security -Wformat-y2k -Winit-self -Wm=
issing-declarations -Wmissing-prototypes -Wnested-externs -Wno-system-heade=
rs -Wold-style-definition -Wpacked -Wredundant-decls -Wstrict-prototypes -W=
switch-default -Wswitch-enum -Wundef -Wwrite-strings -Wformat -Wno-type-lim=
its -Wstrict-aliasing=3D3 -Wshadow -Wno-switch-enum -Werror -Wall -fvisibil=
ity=3Dhidden -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=3D64 -D"BUILD_S=
TR(s)=3D#s"

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17514376442.53BEfe0C.11269--

summary: gcc 15.1.1+git9866-s390 regression


--17514543620.e31CeFd.12931
Date: Wed, 2 Jul 2025 11:06:02 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245608

            Bug ID: 1245608
           Summary: [Build 20250701] openQA test fails in journal_check
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/5143515/modules/jour
                    nal_check/steps/21
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-bugs-at-opensuse.org
          Reporter: ana.guerrero-at-suse.com
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: openQA
           Blocker: Yes

## Observation

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos_fips@64bit fails in
[journal_check](https://openqa.opensuse.org/tests/5143515/modules/journal_c=
heck/steps/21)

The message says:

Jul 02 08:26:41.930481 localhost kernel: basic hdkf test(hmac(sha256-generi=
c)):
hkdf_extract failed with -22

## Test suite description
microos FIPS enablement and some FIPS specific tests.=20

## Reproducible

Fails since (at least) Build
[20250328](https://openqa.opensuse.org/tests/4955791)

## Expected result

Last good: [20250326](https://openqa.opensuse.org/tests/4953837) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=3Dx86_64&distri=3Dmi=
croos&flavor=3DMicroOS-Image&machine=3D64bit&test=3Dmicroos_fips&version=3D=
Tumbleweed)
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17514543620.e31CeFd.12931
Date: Wed, 2 Jul 2025 11:06:02 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245608

          Summary
          [Build 20250701] openQA test fails in journal_check

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          URL
          https://openqa.opensuse.org/tests/5143515/modules/journal_che=
ck/steps/21

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Kernel

          Assignee
          kernel-bugs@opensuse.org

          Reporter
          ana.guerrero@suse.com

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          openQA

          Blocker
          Yes

## Observation

openQA test in scenario
microos-Tumbleweed-MicroOS-Image-x86_64-microos_fips@64bit fails in
[journal_check](https://openqa.opensuse.org/tests/5143515/modules=
/journal_check/steps/21)

The message says:

Jul 02 08:26:41.930481 localhost kernel: basic hdkf test(hmac(sha256-generi=
c)):
hkdf_extract failed with -22

## Test suite description
microos FIPS enablement and some FIPS specific tests.=20

## Reproducible

Fails since (at least) Build
[20250328](https://op=
enqa.opensuse.org/tests/4955791)

## Expected result

Last good: [20250326](https://openqa.opensuse.org/tests/4953837) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/test=
s/latest?arch=3Dx86_64&distri=3Dmicroos&flavor=3DMicroOS-Image&=
machine=3D64bit&test=3Dmicroos_fips&version=3DTumbleweed)

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17514543620.e31CeFd.12931--


body:
--17515571712.dECDbe1f6.18707
Date: Thu, 3 Jul 2025 15:39:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245697

            Bug ID: 1245697
           Summary: AUDIT-0: sssd: new polkit files
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

https://build.opensuse.org/request/show/1283420

submit: network:ldap/sssd@a0983a280dc60515b37997087f2e8a3d (r343) ->
openSUSE:Factory

---
[  162s] sssd.i586: E: polkit-file-unauthorized (Badness: 10000)
/usr/share/polkit-1/rules.d/sssd-realmd.rules (sha256 file digest default
filter:fb2bcf81da84890c74de32b1f4dd6d829058a43bbef9ae7862b92372efe4ddc0 she=
ll
filter:7c4a26f9ee56bef98c4d5a1728d1cefee81fbfbde9dbbc45ab6a5039bce727dc xml
filter:<failed-to-calculate>)
[  162s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
---
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17515571712.dECDbe1f6.18707
Date: Thu, 3 Jul 2025 15:39:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245697

          Summary
          AUDIT-0: sssd: new polkit files

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          Linux

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Security

          Assignee
          security-team@suse.de

          Reporter
          jengelh@inai.de

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

=
https://build.opensuse.org/request/show/1283420

submit: network:ldap/sssd@a0983a280dc60515b37997087f2e8a3d (r343) ->
openSUSE:Factory

---
[  162s] sssd.i586: E: polkit-file-unauthorized (Badness: 10000)
/usr/share/polkit-1/rules.d/sssd-realmd.rules (sha256 file digest default
filter:fb2bcf81da84890c74de32b1f4dd6d829058a43bbef9ae7862b92372efe4ddc0 she=
ll
filter:7c4a26f9ee56bef98c4d5a1728d1cefee81fbfbde9dbbc45ab6a5039bce727dc xml
filter:<failed-to-calculate>)
[  162s] Packaging polkit rules requires a review and whitelisting by the S=
USE
security
---

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17515571712.dECDbe1f6.18707--

summary: AUDIT-0: sssd: new polkit files


--17516387110.dD044f.21308
Date: Fri, 4 Jul 2025 14:18:31 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245790

            Bug ID: 1245790
           Summary: libalternatives/alts breaks python programs in /usr/bin
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: P.Suetterlin-at-royac.iac.es
        QA Contact: qa-bugs-at-suse.de
  Target Milestone: ---
          Found By: ---
           Blocker: ---

The new way of installing alternatives via links to 'alts' can/does break
python programs in /usr/bin.

E.g., I have a program in /usr/bin that wants to include some modules from
bottle:
from bottle import Bottle, run, template, static_file, request, response,
BaseRequest, default_app

However, for python the parent dir of the executable takes precedence over
other paths.  The issue now is that the bottle package (python313-bottle) d=
oes
contain this:

Pi4:/usr/bin # ls -l /usr/bin/bottle*
lrwxrwxrwx 1 root root      4 Jun 17 09:43 /usr/bin/bottle -> alts
-rwxr-xr-x 1 root root    208 Jun 17 09:43 /usr/bin/bottle-3.13
lrwxrwxrwx 1 root root      4 Jun 17 09:43 /usr/bin/bottle.py -> alts
-rwxr-xr-x 1 root root 180066 Jun 17 09:43 /usr/bin/bottle.py-3.13

So python uses /usr/bin/bottle.py, tries to read the alts binary as code and
reports an error.  This even affects the 'binary' /usr/bin/bottle (part of =
the
package) itself:

Pi4:~ # bottle
Traceback (most recent call last):
  File "/usr/bin/bottle-3.13", line 5, in <module>
    from bottle import main
SyntaxError: source code string cannot contain null bytes

Not sure if that is an error of the bottle package, or a shortcoming of the
'alts' approach.  But definitely 'linking' .py modules in /usr/bin via alts=
 is
a bad idea
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17516387110.dD044f.21308
Date: Fri, 4 Jul 2025 14:18:31 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245790

          Summary
          libalternatives/alts breaks python programs in /usr/bin

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          Other

          OS
          Other

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          Basesystem

          Assignee
          screening-team-bugs@suse.de

          Reporter
          P.Suetterlin@royac.iac.es

          QA Contact
          qa-bugs@suse.de

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

The new way of installing alternatives via links to 'alts' c=
an/does break
python programs in /usr/bin.

E.g., I have a program in /usr/bin that wants to include some modules from
bottle:
from bottle import Bottle, run, template, static_file, request, response,
BaseRequest, default_app

However, for python the parent dir of the executable takes precedence over
other paths.  The issue now is that the bottle package (python313-bottle) d=
oes
contain this:

Pi4:/usr/bin # ls -l /usr/bin/bottle*
lrwxrwxrwx 1 root root      4 Jun 17 09:43 /usr/bin/bottle -> alts
-rwxr-xr-x 1 root root    208 Jun 17 09:43 /usr/bin/bottle-3.13
lrwxrwxrwx 1 root root      4 Jun 17 09:43 /usr/bin/bottle.py -> alts
-rwxr-xr-x 1 root root 180066 Jun 17 09:43 /usr/bin/bottle.py-3.13

So python uses /usr/bin/bottle.py, tries to read the alts binary as code and
reports an error.  This even affects the 'binary' /usr/bin/bottle (part of =
the
package) itself:

Pi4:~ # bottle
Traceback (most recent call last):
  File "/usr/bin/bottle-3.13", line 5, in <module>
    from bottle import main
SyntaxError: source code string cannot contain null bytes

Not sure if that is an error of the bottle package, or a shortcoming of the
'alts' approach.  But definitely 'linking' .py modules in /usr/bin via alts=
 is
a bad idea

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17516387110.dD044f.21308--


body:
--17517973773.53C8C9273.22575
Date: Sun, 6 Jul 2025 10:22:57 +0000
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

https://bugzilla.suse.com/show_bug.cgi?id=3D1245828

            Bug ID: 1245828
           Summary: openh264: decoding broken
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X11 Applications
          Assignee: yfjiang-at-suse.com
          Reporter: jengelh-at-inai.de
        QA Contact: qa-bugs-at-suse.de
                CC: ngompa13-at-gmail.com
  Target Milestone: ---
          Found By: ---
           Blocker: ---

>>>
Wed Jun 25 08:40:15 UTC 2025 - Yifan Jiang <yfjiang-at-suse.com>

- Built with noopenh264, drop ffmpeg-dlopen-openh264.patch
  (jsc#PED-12607)
<<<

This recent change made ffmpeg-7 use libopenh264.so.8 from the noopenh264
project.
However, https://codecs.opensuse.org/openh264/openSUSE_Tumbleweed/x86_64/ s=
till
has only so.7, which means Tumbleweed-without-packman users don't a working
H264 setup currently.
--=20
You are receiving this mail because:
You are on the CC list for the bug.=

--17517973773.53C8C9273.22575
Date: Sun, 6 Jul 2025 10:22:57 +0000
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: https://bugzilla.suse.com/
Auto-Submitted: auto-generated

      <base href=3D"https://bugzilla.suse.com/" />

          Bug ID
          1245828

          Summary
          openh264: decoding broken

          Classification
          openSUSE

          Product
          openSUSE Tumbleweed

          Version
          Current

          Hardware
          x86-64

          OS
          Linux

          Status
          NEW

          Severity
          Normal

          Priority
          P5 - None

          Component
          X11 Applications

          Assignee
          yfjiang@suse.com

          Reporter
          jengelh@inai.de

          QA Contact
          qa-bugs@suse.de

          CC
          ngompa13@gmail.com

          Target Milestone
          ---

          Found By
          ---

          Blocker
          ---

>>>
Wed Jun 25 08:40:15 UTC 2025 - Yifan Jiang <yfjiang@suse.com>

- Built with noopenh264, drop ffmpeg-dlopen-openh264.patch
  (jsc#PED-12607)
<<<

This recent change made ffmpeg-7 use libopenh264.so.8 from the noopenh264
project.
However, https://codecs.opensuse.org/openh264/openSUSE_Tumbleweed/x86_64/=
 still
has only so.7, which means Tumbleweed-without-packman users don't a working
H264 setup currently.

      You are receiving this mail because:
=20=20=20=20=20=20

You are on the CC list for the bug.

=

--17517973773.53C8C9273.22575--

summary: openh264: decoding broken