body:
--1584723191.Ad2b0.1308
Date: Fri, 20 Mar 2020 16:53:11 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167289

            Bug ID: 1167289
           Summary: ignition: missing dependencies
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: iforster-at-suse.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The ignition dracut module fails if certain programs are not available. The rpm
does not specify them as requirement though:

curl
e2fsprogs
dosfsprogs
xfsprogs

Another issue is that the code checks the kernel config for
CONFIG_FW_CFG_SYSFS=m and if that is the case wants to use qemu_fw_cfg which is
not necessarily also installed. So fails. Should check for presence o the
module instead of the config.

summary: ignition: missing dependencies


--1584732555.b146C72.18298
Date: Fri, 20 Mar 2020 19:29:15 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167293

            Bug ID: 1167293
           Summary: xdm: /etc/X11/xdm/README.security still refers to /etc/services
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: gp-at-suse.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

/etc/services has moved to /usr/etc/services while
/etc/X11/xdm/README.security still has the following reference:

   "with DisplayManager.requestPort in the file  xdm-config should be
   commented out.  This enables the XDMCP port with the default port
   number 177 (see /etc/services)."


body:
--1584766585.87084.443
Date: Sat, 21 Mar 2020 04:56:25 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167304

            Bug ID: 1167304
           Summary: [trackerbug] lxd 3.23 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 3.23. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-3-23-has-been-released/7140
  + Custom storage volumes in projects
  + Schedule snapshots for custom storage volumes
  + Expiry for custom storage volumes
  + Limits for projects
  + Restrictions for projects
  + Improved backup/export logic
  + VM: Support for migration
  + VM: Support for publishing

summary: [trackerbug] lxd 3.23 update


--1584833537.375e8D6a6.23747
Date: Sat, 21 Mar 2020 23:32:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167321

            Bug ID: 1167321
           Summary: gnome-keyring does not autostart with sddm
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: GNOME
          Assignee: gnome-bugs-at-suse.de
          Reporter: cornelis-at-solcon.nl
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

According to the changelog of gnome-keyring gnome-keyring should autostart with
sddm, but this is not the case. The relevant line I have in common-session-pc
is:

session    optional    pam_gnome_keyring.so    auto_start
only_if=gdm,gdm-password,lxdm,lightdm

If I add "sddm" to this, it is working. The spec does have a line that includes
"sddm", but somehow it is not written that way.

The spec includes the following comment:

###
# WARNING: when changing the pam-config calls in the scriptlets, please also
# update them in baselibs.conf.
# pam-config checks if the pam module is available for 32bit too if pam-32bit
# is installed, so the call here might fail until gnome-keyring-pam-32bit gets
# installed (see bnc#728586).
###

I have the 32bit package installed and the baselibs.conf is not updated to
include "sddm", which is probably the problem.


--1584908331.aCE1a0.18536
Date: Sun, 22 Mar 2020 20:18:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167343

            Bug ID: 1167343
           Summary: rpm: Libgcrypt warning: missing initialization - please fix the application
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: opensuse-at-mike.franken.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I get the message from the summary above several times after having installed
Tumbleweed snapshot 20200319 today.
I'm not sure, if it causes any harm - I couldn't identify any further problems.
The problem seems to be well known, I found several occurrences on the net, but
no definitive solution.


body:
Build Identifier:

I can't load any VST plugins in LMMS on openSUSE Tumbleweed (official package).
If I attempt loading a .dll plugin, nothing happens in the GUI. I know that
WINE is required if you want to be able to load VST plugins in LMMS and I have
it installed. When I launch LMMS from the terminal and attempt to load a VST
plugin, I get the following error message in the terminal:

kf5.kio.core: "Could not enter folder tags:/."
Remote plugin '/usr/lib64/lmms/RemoteVstPlugin' not found.
Error while reading.

Indeed /usr/lib64/lmms/RemoteVstPlugin is missing.
From what I've searched online I understood that LMMS needs specific libraries
at this particular location to be able to load VSTs.

Some forum posts describing a similar problem have led me to the conclusion
that the RemoveVstPlugin must have failed to build and the incomplete program
was shipped in the official package in Tumbleweed.

On the very start-up of the program, other errors are printed as well:

Cannot load library /usr/lib64/lmms/libmalletsstk.so: (libstk.so.4: cannot open
shared object file: No such file or directory)
Cannot load library /usr/lib64/lmms/libcarlarack.so: (libcarlabase.so: cannot
open shared object file: No such file or directory)
Cannot load library /usr/lib64/lmms/libgigplayer.so: (libgig.so.9: cannot open
shared object file: No such file or directory)
Cannot load library /usr/lib64/lmms/libcarlapatchbay.so: (libcarlabase.so:
cannot open shared object file: No such file or directory)
Cannot load library /usr/lib64/lmms/libcarlabase.so:
(libcarla_native-plugin.so: cannot open shared object file: No such file or
directory)

I have not experienced any problems that might be related to the dynamic
linking errors above but this definitely may be related to my problem, in the
grand scheme of things.

Reproducible: Always

Steps to Reproduce:
1. Open up LMMS (official package on Tumbleweed) [WINE has to be on your system
too] [You have to open it up from terminal to see the error messages]
2. Click on the instruments section
3. Drag VeSTige to Song-Editor so that it is added as a new instrument.
4. Click on the VeSTige instrument so that its' GUI opens up
5. Click the folder icon to open a dialog window for loading .dll VST plugins
6. Attempt loading any plugin
Actual Results:
Nothing happens in the GUI.
Errors displayed in the commandline.

kf5.kio.core: "Could not enter folder tags:/."
Remote plugin '/usr/lib64/lmms/RemoteVstPlugin' not found.
Error while reading.

Expected Results:
The program was expected to load the .dll plugin

summary: Missing VST plugin loading libs in LMMS


--1584910037.3aed40.27524
Date: Sun, 22 Mar 2020 20:47:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167346

            Bug ID: 1167346
           Summary: Illegal instruction crash (SIGILL) in /usr/include/c++/9/ext/new_allocator.h:119
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: freek-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

When starting HandBrakeGUI I get some debug output saying:
Thread 1 "HandBrakeGUI" received signal SIGILL, Illegal instruction.
0x00007ffff3ece6d1 in std::vector<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > > >::_M_realloc_insert<char const (&) [16]> (
    this=0x7fffffffd4e0, __position=__position@entry=non-dereferenceable
iterator for std::vector)
    at /usr/include/c++/9/ext/new_allocator.h:119
warning: Source file is more recent than executable.
119           deallocate(pointer __p, size_type)

This only occurs on my AMD system. There is no problem on my laptop with an
Intel processor.

File /usr/include/c++/9/ext/new_allocator.h is part of packet
libstdc++6-devel-gcc9-9.2.1+git1192-1.1.x86_64


--1584950923.bF4DbE60.8043
Date: Mon, 23 Mar 2020 08:08:43 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167379

            Bug ID: 1167379
           Summary: VUL-1: CVE-2020-6816: python-bleach: prone to a mutation XSS vulnerability in bleach.clean
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/255514/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: rfrohl-at-suse.com
        QA Contact: security-team-at-suse.de
                CC: mcepl-at-suse.com
          Found By: Security Response Team
           Blocker: ---

CVE-2020-6816

It was reported that python-bleach, a whitelist-based HTML-sanitizing
library, is prone to a mutation XSS vulnerability in bleach.clean when
strip=False and math or svg tags and one or more of the RCDATA tags
were whitelisted.
For the stable distribution (buster), this problem has been fixed in
version 3.1.2-0+deb10u1.
We recommend that you upgrade your python-bleach packages.
For the detailed security status of python-bleach please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/python-bleach

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6816
http://www.debian.org/security/-1/dsa-4643
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=954236


--1584964673.a4a0EB0.13913
Date: Mon, 23 Mar 2020 11:57:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167431

            Bug ID: 1167431
           Summary: audit request: User/group orthanc for rpmlint
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: axel.braun-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Hi,
as suggested in https://build.opensuse.org/request/show/786894 I would like to
request an audit for user/group orthanc
see https://build.opensuse.org/package/show/graphics/orthanc


body:
--1584981588.EeA2dbf0.8878
Date: Mon, 23 Mar 2020 16:39:48 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167465

            Bug ID: 1167465
           Summary: GCC 10: chromium build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:Gcc7/chromium/standard/x86_64

due to:
[  214s] In file included from
../../base/trace_event/trace_event_memory_overhead.cc:5:
[  214s] ../../base/trace_event/trace_event_memory_overhead.h:60:29: error:
'string' in namespace 'std' does not name a type
[  214s]    60 |   void AddString(const std::string& str);
[  214s]       |                             ^~~~~~
[  214s] ../../base/trace_event/trace_event_memory_overhead.h:15:1: note:
'std::string' is defined in header '<string>'; did you forget to '#include
<string>'?
[  214s]    14 | #include "base/macros.h"
[  214s]   +++ |+#include <string>
[  214s]    15 |
[  214s] ../../base/trace_event/trace_event_memory_overhead.cc:87:6: error: no
declaration matches 'void
base::trace_event::TraceEventMemoryOverhead::AddString(const string&)'
[  214s]    87 | void TraceEventMemoryOverhead::AddString(const std::string&
str) {
[  214s]       |      ^~~~~~~~~~~~~~~~~~~~~~~~
[  214s] In file included from
../../base/trace_event/trace_event_memory_overhead.cc:5:
[  214s] ../../base/trace_event/trace_event_memory_overhead.h:60:8: note:
candidate is: 'void
base::trace_event::TraceEventMemoryOverhead::AddString(const int&)'
[  214s]    60 |   void AddString(const std::string& str);
[  214s]       |        ^~~~~~~~~
[  214s] ../../base/trace_event/trace_event_memory_overhead.h:26:19: note:
'class base::trace_event::TraceEventMemoryOverhead' defined here
[  214s]    26 | class BASE_EXPORT TraceEventMemoryOverhead {
[  214s]       |                   ^~~~~~~~~~~~~~~~~~~~~~~~
[  214s] ../../base/trace_event/trace_event_memory_overhead.cc: In member
function 'void
base::trace_event::TraceEventMemoryOverhead::AddRefCountedString(const
base::RefCountedString&)':
[  214s] ../../base/trace_event/trace_event_memory_overhead.cc:94:21: error:
cannot convert 'const string' {aka 'const std::__cxx11::basic_string<char>'} to
'const int&'
[  214s]    94 |   AddString(str.data());
[  214s]       |             ~~~~~~~~^~
[  214s]       |                     |
[  214s]       |                     const string {aka const
std::__cxx11::basic_string<char>}

summary: GCC 10: chromium build fails


--1585033698.a5FDDFA80.7584
Date: Tue, 24 Mar 2020 07:08:18 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167501

            Bug ID: 1167501
           Summary: Invalid alignment in Pyhton 3.8 cpython header
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: asn-at-cryptomilk.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

In file included from /builds/cryptomilk/pam_wrapper/src/python/pypamtest.c:21:
In file included from /usr/include/python3.8/Python.h:147:
In file included from /usr/include/python3.8/abstract.h:837:
/usr/include/python3.8/cpython/abstract.h:91:11: error: cast from 'char *' to
'vectorcallfunc *' (aka 'struct _object *(**)(struct _object *, struct _object
*const *, unsigned long, struct _object *)') increases required alignment from
1 to 8 [-Werror,-Wcast-align]
    ptr = (vectorcallfunc*)(((char *)callable) + offset);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.

union {
   vectorcallfunc *ptr;

The correct way to do it would be:

union {
   char *data;
   vectorcallfunc *ptr;
} vc;

vc.data = (char *)callable + offset;
return *vc.ptr;


--1585041723.f027C1c80.25771
Date: Tue, 24 Mar 2020 09:22:03 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167537

            Bug ID: 1167537
           Summary: rpm does not open the database in read-only mode anymore
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

rpm does not open the database in read-only mode anymore:

kukuk@futec01:~> rpm -ql aaa_base
rpmxdbOpen: Read-only file system
error: cannot open Name index using ndb - Operation not permitted (1)
rpmxdbOpen: Read-only file system
error: cannot open Name index using ndb - Operation not permitted (1)
package aaa_base is not installed

The system is MicroOS (so read-only root filesystem).


--1585049670.CCFEA0.22834
Date: Tue, 24 Mar 2020 11:34:30 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167557

            Bug ID: 1167557
           Summary: python-lupa build failure test_coroutine_sets_callback_debug_hook_nowrap ppc64le segfault
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 833735
  --> http://bugzilla.opensuse.org/attachment.cgi?id=833735&action=edit
build.log

python-lupa build failure test_coroutine_sets_callback_debug_hook_nowrap
ppc64le segfault as reported on OBS in PowerPC project (1) or in devel (2)

As per osc jobhist started to fail last december.

I am able to recreate failure with local osc build, how to capture more data ?
(there is no available 'core' file)

=== extract of build log
[   65s] test_coroutine_sets_callback_debug_hook
(lupa.tests.test.TestLuaCoroutinesWithDebugHooks) ... ok
[   65s] test_coroutine_sets_callback_debug_hook_nowrap
(lupa.tests.test.TestLuaCoroutinesWithDebugHooks) ... /var/tmp/rpm-tmp.W51atc:
line 38:  1375 Segmentation fault      /usr/bin/python2 setup.py test
[   65s] error: Bad exit status from /var/tmp/rpm-tmp.W51atc (%check)
=== extract of job history
$osc jobhist    openSUSE:Factory:PowerPC/python-lupa standard ppc64le
time                 package     reason           code    build time worker
2019-02-27 16:36:22  python-lupa new build        succeeded 3m 18s
obs-power8-06:14
2019-06-21 22:46:46  python-lupa new build        succeeded 4m 17s
obs-power8-06:1
2019-07-30 04:13:54  python-lupa new build        succeeded 4m 29s
obs-power8-07:25
2019-12-18 14:00:47  python-lupa source change    failed    1m 37s
obs-power8-07:14
2019-12-24 01:58:30  python-lupa source change    failed    1m 24s
obs-power8-03:29
2020-03-09 00:37:24  python-lupa source change    failed    1m 11s
obs-power8-03:28
===

(1)
https://build.opensuse.org/package/show/openSUSE:Factory:PowerPC/python-lupa
(2) https://build.opensuse.org/package/show/devel:languages:python/python-lupa


--1585054270.E45324.27285
Date: Tue, 24 Mar 2020 12:51:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167565

            Bug ID: 1167565
           Summary: JeOS-olinuxinolime: empty root in dracut fails boot
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: guillaume.gardet-at-arm.com
          Reporter: lnussel-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: fvogt-at-suse.com
          Found By: ---
           Blocker: ---

openSUSE-Tumbleweed-ARM-JeOS-olinuxinolime.armv7l-2020.03.10-Snapshot20200317
does not boot. Turns out dracut fails at pre-mount. Looking at /dracut-state.sh
it shows root="". Adding root=UUID=<UUIDOFIMAGE> to the kernel command line
makes it boot. Is dracut supposed to figure out the root device itself like
that or is the kiwi config supposed to add a root= parameter?


body:
--1585089676.245A803c4.495
Date: Tue, 24 Mar 2020 22:41:16 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167611

            Bug ID: 1167611
           Summary: inxi version in Leap is ancient
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: maintenance-at-opensuse.org
          Reporter: mrmazda-at-earthlink.net
        QA Contact: qa-bugs-at-suse.de
                CC: sor.alexei-at-meowr.ru
          Found By: ---
           Blocker: ---

Original summary:
inxi version in Leap is ancient

Inxi in Leap is positively ancient, 2.3.40, short in functionality and with
some brokenness, very frustrating to ask forum users to use. TW just advanced
from 3.0.32 to 3.0.38. Often I find it necessary to point users to
https://smxi.org/docs/inxi-installation.htm#inxi-manual-install and not mention
that it's in OSS, but it's far more complicated to do, in an environment where
simplicity in explaining is key to producing support success.

Please push 3.0.38 to Leap, at least to 15.2 if not also 15.1. It would be
helpful also if the rpm would include /etc/inxi.conf with a -U switch enabler
ready to engage by removing its comment when necessary. Better yet, enable -U
by default. It's just a reporting script after all, not writing anything except
to standard video output.

summary: inxi version in Leap is ancient


--1585121368.E05546DC0.1650
Date: Wed, 25 Mar 2020 07:29:27 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167623

            Bug ID: 1167623
           Summary: VUL-1: CVE-2020-10938: GraphicsMagick: integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/255798/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: pgajdos-at-suse.com
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-10938

GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based
buffer overflow in HuffmanDecodeImage in magick/compress.c.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10938
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10938
https://sourceforge.net/p/graphicsmagick/code/ci/5b4dd7c6674140a115ec9424c8d19c6a458fac3e/


body:
--1585125128.aAEBCC0.26280
Date: Wed, 25 Mar 2020 08:32:08 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167628

            Bug ID: 1167628
           Summary: ffmpeg 4 does not ship executable
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: aloisio-at-gmx.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I realise there's a conflict with the ffmpeg 3 one, but wouldn't it be possible
to rename it? It does offer certain extra features.

summary: ffmpeg 4 does not ship executable


--1585167340.B5Ca0.25450
Date: Wed, 25 Mar 2020 20:15:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167690

            Bug ID: 1167690
           Summary: Regional and Language settings module (in KDE Systemsettings) crashes.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Linux
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: KDE Workspace (Plasma)
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: EagleScreen-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Now it is crashing every time I try to open it.
Application: Preferencias del sistema (systemsettings5), signal: Segmentation
fault
Using host libthread_db library "/lib64/libthread_db.so.1".
[Current thread is 1 (Thread 0x7fc6a6f61440 (LWP 2456))]

Thread 7 (Thread 0x7fc678f86700 (LWP 2484)):
#0  0x00007fc6a243a0a0 in __libc_enable_asynccancel () from /lib64/libc.so.6
#1  0x00007fc6a2422686 in poll () from /lib64/libc.so.6
#2  0x00007fc69b9986c9 in ?? () from /usr/lib64/libglib-2.0.so.0
#3  0x00007fc69b998a12 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
#4  0x00007fc67a1684c6 in ?? () from /usr/lib64/libgio-2.0.so.0
#5  0x00007fc69b9c1cde in ?? () from /usr/lib64/libglib-2.0.so.0
#6  0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#7  0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 6 (Thread 0x7fc679787700 (LWP 2483)):
#0  0x00007fc6a241e198 in read () from /lib64/libc.so.6
#1  0x00007fc69b9df8c0 in ?? () from /usr/lib64/libglib-2.0.so.0
#2  0x00007fc69b9981e8 in g_main_context_check () from
/usr/lib64/libglib-2.0.so.0
#3  0x00007fc69b998670 in ?? () from /usr/lib64/libglib-2.0.so.0
#4  0x00007fc69b9987dc in g_main_context_iteration () from
/usr/lib64/libglib-2.0.so.0
#5  0x00007fc69b998821 in ?? () from /usr/lib64/libglib-2.0.so.0
#6  0x00007fc69b9c1cde in ?? () from /usr/lib64/libglib-2.0.so.0
#7  0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#8  0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 5 (Thread 0x7fc684eec700 (LWP 2481)):
#0  0x00007fc6a2db7a86 in ?? () from /usr/lib64/libQt5Core.so.5
#1  0x00007fc6a2db62b9 in QTimerInfoList::updateCurrentTime() () from
/usr/lib64/libQt5Core.so.5
#2  0x00007fc6a2db6895 in QTimerInfoList::timerWait(timespec&) () from
/usr/lib64/libQt5Core.so.5
#3  0x00007fc6a2db7ede in ?? () from /usr/lib64/libQt5Core.so.5
#4  0x00007fc69b997c29 in g_main_context_prepare () from
/usr/lib64/libglib-2.0.so.0
#5  0x00007fc69b9985fb in ?? () from /usr/lib64/libglib-2.0.so.0
#6  0x00007fc69b9987dc in g_main_context_iteration () from
/usr/lib64/libglib-2.0.so.0
#7  0x00007fc6a2db819b in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
from /usr/lib64/libQt5Core.so.5
#8  0x00007fc6a2d5932a in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib64/libQt5Core.so.5
#9  0x00007fc6a2b7f10a in QThread::exec() () from /usr/lib64/libQt5Core.so.5
#10 0x00007fc6a06c9ba5 in QQmlThreadPrivate::run (this=0x56216eafdcd0) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/qml/ftw/qqmlthread.cpp:148
#11 0x00007fc6a2b808b2 in ?? () from /usr/lib64/libQt5Core.so.5
#12 0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#13 0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 4 (Thread 0x7fc68b085700 (LWP 2460)):
#0  0x00007fc69e0f887d in pthread_cond_wait@@GLIBC_2.3.2 () from
/lib64/libpthread.so.0
#1  0x00007fc68bf1790b in ?? () from /usr/lib64/dri/i965_dri.so
#2  0x00007fc68bf174f7 in ?? () from /usr/lib64/dri/i965_dri.so
#3  0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#4  0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 3 (Thread 0x7fc68f6b5700 (LWP 2459)):
#0  0x00007fc6a241e198 in read () from /lib64/libc.so.6
#1  0x00007fc69b9df8c0 in ?? () from /usr/lib64/libglib-2.0.so.0
#2  0x00007fc69b9981e8 in g_main_context_check () from
/usr/lib64/libglib-2.0.so.0
#3  0x00007fc69b998670 in ?? () from /usr/lib64/libglib-2.0.so.0
#4  0x00007fc69b9987dc in g_main_context_iteration () from
/usr/lib64/libglib-2.0.so.0
#5  0x00007fc6a2db819b in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) ()
from /usr/lib64/libQt5Core.so.5
#6  0x00007fc6a2d5932a in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from
/usr/lib64/libQt5Core.so.5
#7  0x00007fc6a2b7f10a in QThread::exec() () from /usr/lib64/libQt5Core.so.5
#8  0x00007fc6a3228cd5 in ?? () from /usr/lib64/libQt5DBus.so.5
#9  0x00007fc6a2b808b2 in ?? () from /usr/lib64/libQt5Core.so.5
#10 0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#11 0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 2 (Thread 0x7fc69360e700 (LWP 2458)):
#0  0x00007fc6a242269b in poll () from /lib64/libc.so.6
#1  0x00007fc69dcb6307 in ?? () from /usr/lib64/libxcb.so.1
#2  0x00007fc69dcb7f3a in xcb_wait_for_event () from /usr/lib64/libxcb.so.1
#3  0x00007fc696403300 in ?? () from /usr/lib64/libQt5XcbQpa.so.5
#4  0x00007fc6a2b808b2 in ?? () from /usr/lib64/libQt5Core.so.5
#5  0x00007fc69e0f24f9 in start_thread () from /lib64/libpthread.so.0
#6  0x00007fc6a242ceef in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x7fc6a6f61440 (LWP 2456)):
[KCrash Handler]
#6  0x00007fc6a056c89d in QQmlPropertyCache::callJSFactoryMethod
(args=0x7fffdbc7ac60, object=0x562170240f00, this=0x894c000e2246358d) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/include/QtQml/5.12.7/QtQml/private/../../../../../src/qml/qml/qqmlpropertycache_p.h:875
#7  QV4::QObjectWrapper::create (engine=<optimized out>,
engine@entry=0x56216eaf6000, object=object@entry=0x562170240f00) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4qobjectwrapper.cpp:691
#8  0x00007fc6a056ebf9 in QV4::QObjectWrapper::wrap_slowPath
(engine=0x56216eaf6000, object=0x562170240f00) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4qobjectwrapper.cpp:623
#9  0x00007fc6a054d33b in QV4::QObjectWrapper::wrap
(engine=engine@entry=0x56216eaf6000, object=<optimized out>) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/include/QtQml/5.12.7/QtQml/private/../../../../../src/qml/jsruntime/qv4qobjectwrapper_p.h:224
#10 0x00007fc6a05eb73c in QV4::ExecutionEngine::fromVariant
(this=this@entry=0x56216eaf6000, variant=...) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4engine.cpp:1514
#11 0x00007fc6a054abe6 in searchContextProperties (v4=v4@entry=0x56216eaf6000,
context=context@entry=0x562170257b90, name=<optimized out>,
hasProperty=hasProperty@entry=0x7fffdbc7af17, base=base@entry=0x0,
lookup=lookup@entry=0x0, originalLookup=<optimized out>, ep=<optimized out>) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4qmlcontext.cpp:126
#12 0x00007fc6a054ba75 in QV4::QQmlContextWrapper::getPropertyAndBase
(resource=<optimized out>, id=..., receiver=receiver@entry=0x0,
hasProperty=hasProperty@entry=0x7fffdbc7af17, base=base@entry=0x0, lookup=0x0,
lookup@entry=0x56216ed9ef70) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4qmlcontext.cpp:274
#13 0x00007fc6a054c2b5 in
QV4::QQmlContextWrapper::resolveQmlContextPropertyLookupGetter
(l=0x56216ed9ef70, engine=0x56216eaf6000, base=0x0) at
/usr/src/debug/libqt5-qtdeclarative-5.12.7-lp152.1.1.x86_64/src/qml/jsruntime/qv4qmlcontext.cpp:478
#14 0x00007fc67ef7bad5 in ?? ()
#15 0x0000000000000000 in ?? ()
[Inferior 1 (process 2456) detached]


body:
--1585210274.AcaeBE5a4.16650
Date: Thu, 26 Mar 2020 08:11:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167735

            Bug ID: 1167735
           Summary: disable mvapich2 builds for tensorflow
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: cgoll-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

On aarch64 the tensorflow build takes more than 20h. This blocks too many
resources, thus this build is disabled for now.

summary: disable mvapich2 builds for tensorflow


body:
--1585298440.b7Ba0.16193
Date: Fri, 27 Mar 2020 08:40:40 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167862

            Bug ID: 1167862
           Summary: GCC 10: fish build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails due to:

[  249s] In file included from
/home/abuild/rpmbuild/BUILD/fish-3.1.0/src/iothread.cpp:3:
[  249s] /home/abuild/rpmbuild/BUILD/fish-3.1.0/src/iothread.h:98:1: error:
'uint64_t' does not name a type
[  249s]    98 | uint64_t thread_id();
[  249s]       | ^~~~~~~~
[  250s] /home/abuild/rpmbuild/BUILD/fish-3.1.0/src/iothread.cpp: In function
'void* func_invoker(void*)':
[  250s] /home/abuild/rpmbuild/BUILD/fish-3.1.0/src/iothread.cpp:467:11: error:
'thread_id' was not declared in this scope; did you mean 'pthread_t'?
[  250s]   467 |     (void)thread_id();
[  250s]       |           ^~~~~~~~~
[  250s]       |           pthread_t

It's a known and fixed upstream issue:
https://github.com/fish-shell/fish-shell/issues/6604

We need to backport it.
Build log:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:Gcc7/fish/standard/x86_64

summary: GCC 10: fish build fails


--1585303033.22EfD06.16285
Date: Fri, 27 Mar 2020 09:57:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167874

            Bug ID: 1167874
           Summary: Update go 1.11 in SLE15SP2 for Leap 15.2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: armv7
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: guillaume.gardet-at-arm.com
        QA Contact: qa-bugs-at-suse.de
                CC: afaerber-at-suse.com, dmueller-at-suse.com
          Found By: ---
           Blocker: ---

go1.11 is not buildable on Leap 15.2 armv7, so there is no go compiler for
armv7 in Leap 15.2.

The fix is in devel:languages:go/go1.11 but SLE15SP2 (and thus Leap 15.2) still
uses an older version from Feb 2019.

Could we get a fix, either backport the fix [1] or update to current version of
devel project?

[1]: https://build.opensuse.org/request/show/785502


--1585314587.5fE1F44.23472
Date: Fri, 27 Mar 2020 13:09:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167898

            Bug ID: 1167898
           Summary: GCC: Internal compiler error when building HepMC
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Development
          Assignee: screening-team-bugs-at-suse.de
          Reporter: badshah400-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Building HepMC against GCC in Tumbleweed:
https://build.opensuse.org/package/show/openSUSE:Factory/HepMC
fails since March 19, probably after the latest GCC
https://build.opensuse.org/request/show/783281
was checked in to Factory. The following is the relevant part of the log:

```
[   10s] [  3%] Building CXX object
search/CMakeFiles/HepMC3search_static.dir/src/Selector.cc.o
[   10s] cd /home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/build/search &&
/usr/bin/c++  -DNO_DECLSPEC_StandardSelector
-I/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/include -I/homec
[   10s] In file included from
/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/search/include/HepMC3/Selector.h:14,
[   10s]                  from
/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/search/src/Selector.cc:10:
[   10s]
/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/search/include/HepMC3/Feature.h: In
lambda function:
[   10s]
/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/search/include/HepMC3/Feature.h:296:69:
internal compiler error: in get_fns, at cp/tree.c:2455
[   10s]   296 |             return fabs(local - value) <= ((fabs(local) <
fabs(value))? fabs(value) : fabs(local)) *
std::numeric_limits<Feature_type>::epsilon();
[   10s]       |
     ^
[   10s] Please submit a full bug report,
[   10s] with preprocessed source if appropriate.
[   10s] See <https://bugs.opensuse.org/> for instructions.
[   10s] make[2]: *** [search/CMakeFiles/HepMC3search_static.dir/build.make:79:
search/CMakeFiles/HepMC3search_static.dir/src/Selector.cc.o] Error 1
[   10s] make[2]: Leaving directory
'/home/abuild/rpmbuild/BUILD/HepMC3-3.2.1/build'
[   10s] make[2]: *** Waiting for unfinished jobs....
```


--1585351494.32b5B10.30522
Date: Fri, 27 Mar 2020 23:24:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167938

            Bug ID: 1167938
           Summary: python-ldap3 is broken (cannot import name PyAsn1UnicodeDecodeError)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: stasiek-at-michalski.cc
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

https://build.opensuse.org/build/openSUSE:Leap:15.2/standard/x86_64/python-ldap3/_log

This causes python-matrix-synapse-ldap3 to fail


--1585398362.6f0F3.515
Date: Sat, 28 Mar 2020 12:26:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167947

            Bug ID: 1167947
           Summary: [HPC, netcdf] Build RPM macro Files only for hon-HPC builds
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

The netcdf HPC build creates RPM macro files in separate packages. These macros
are only used for non-HPC builds.


--1585399772.Cad5e223.14425
Date: Sat, 28 Mar 2020 12:49:32 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167948

            Bug ID: 1167948
           Summary: [HPC, netdf-fortran] HPC build for mvapich2 is not enabled
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

netdf-fortran is presently not built for mvapich2-hpc.
This MPI 'flavor' should be supported.


--1585399978.bABe65a73.20190
Date: Sat, 28 Mar 2020 12:52:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167949

            Bug ID: 1167949
           Summary: [HPC, scalapack] Scalapack builds Master Packages for the BLACS Library although there are no separate HPC packages for the BLACS API
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: eich-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

The BLACS API is provided by libscalapack. For HPC libBLACS is not packaged and
shipped separately. The master packages for BLACS library and devel packages
still exist.
They should be removed.


--1585407881.CaD150.28143
Date: Sat, 28 Mar 2020 15:04:41 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167952

            Bug ID: 1167952
           Summary: bash-completion: mplayer completion excludes directories
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: msuchanek-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Created attachment 834115
  --> http://bugzilla.opensuse.org/attachment.cgi?id=834115&action=edit
patch that seems to fix the issue

The mplayer completion completes files and directories but only with a media
extensions. Directories should be completed regardless of extension.


body:
--1585414659.aeB4d7d5.16389
Date: Sat, 28 Mar 2020 16:57:39 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167959

            Bug ID: 1167959
           Summary: trackerbug for Opera 67 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: kieltux-at-gmail.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
                CC: maintenance-at-opensuse.org
          Found By: ---
           Blocker: ---

Leap 15.1 was last updated to opera 63.0.3368.66 with Chromium 76.0.3809.132
from Sept 2019. Should be current at 67.0.3575.115 with Chromium 80.0.3987.149.

We should bump this every once in a while to pick up security issues.

Btw... Leap 15.2 was also behind, see
https://build.opensuse.org/request/show/789333

summary: trackerbug for Opera 67 update


--1585432034.4b1071410.2934
Date: Sat, 28 Mar 2020 21:47:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1167974

            Bug ID: 1167974
           Summary: VUL-0: viewvc: CVS lastlog filename not escaped (XSS)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: dmueller-at-suse.com, lars.vogdt-at-suse.com,
                    security-team-at-suse.de
          Found By: ---
           Blocker: ---

When the show_subdir_lastmod option is enabled, ViewVC shows for directories in
the directory view the log message of the most recently modified child thereof,
along with the child file's name and revision number. Unfortunately, the child
file's name is not properly HTML-escaped.

Steps to reproduce the behavior

    In a CVS repository, copy the ,v backing file for any non-dead versioned
file into an otherwise empty subdirectory of the repository.

$ cd /opt/cvs/MyCVSRepository
$ mkdir new-module
$ cp some/existing/file.v 'new-module/<img src="#" onerror="alert(1)">.txt,v'

    Ensure that show_subdir_lastmod is enabled in your viewvc.conf file
(restarting any relevant servers).
    In ViewVC, visit the parent directory of the newly created file. ViewVC
will pass the name of your newly created file (minus the ,v bit) to the browser
without escaping that name for safe HTML transport. In this specific example, a
JavaScript alert dialog will appear with the message "1".

Fixed in v1.2.1 and v1.1.28.

References:
https://github.com/viewvc/viewvc/issues/211


--1585477992.de40a2aC26.24661
Date: Sun, 29 Mar 2020 10:33:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1167983

            Bug ID: 1167983
           Summary: [HPC, PMIx] Add explicit Library Package dependency to Package 'pmix'
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: cgoll-at-suse.com
          Reporter: eich-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: Development
           Blocker: ---

The automatic library dependency generator will add a library dependency on
libpmix to the package 'pmix'. This however is not sufficient as this library
is provided by openmpi as well.
To overcome this, a direct dependency in the form of
Requires: libpmix2 = %version
is needed.


--1585553630.a26c00f0.16266
Date: Mon, 30 Mar 2020 07:33:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168029

            Bug ID: 1168029
           Summary: VUL-0: CVE-2020-1772: otrs: Lost Password requests with wildcard values could allow attacker to retrieve valid Token
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/256040/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token
value,
which allows attacker to retrieve valid Token(s), generated by users which
already requested new passwords. This issue affects: ((OTRS)) Community Edition
5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior
versions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1772
https://otrs.com/release-notes/otrs-security-advisory-2020-09/


--1585553633.d4e6aED0.16649
Date: Mon, 30 Mar 2020 07:33:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168030

            Bug ID: 1168030
           Summary: VUL-0: CVE-2020-1771: otrs: Attacker is able craft an article with a link to the customer address book
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/256039/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-1771

Attacker is able craft an article with a link to the customer address book with
malicious content (JavaScript). When agent opens the link, JavaScript code is
executed due to the missing parameter encoding. This issue affects: ((OTRS))
Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1771
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-1771.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1771
https://otrs.com/release-notes/otrs-security-advisory-2020-08/


--1585553649.08b080.16616
Date: Mon, 30 Mar 2020 07:34:09 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168032

            Bug ID: 1168032
           Summary: VUL-0: CVE-2020-1769: otrs: Username and Password fields use autocomplete
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/256037/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-1769

In the login screens (in agent and customer interface), Username and Password
fields use autocomplete, which might be considered as security issue. This
issue
affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and
prior
versions. OTRS: 7.0.15 and prior versions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1769
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-1769.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1769
https://otrs.com/release-notes/otrs-security-advisory-2020-06/


--1585553636.6714cEB70.15101
Date: Mon, 30 Mar 2020 07:33:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168031

            Bug ID: 1168031
           Summary: VUL-0: CVE-2020-1770: otrs: Support bundle generated files could contain sensitive information that might be unwanted to be disclosed
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
               URL: https://smash.suse.de/issue/256038/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Basesystem
          Assignee: chris-at-computersalat.de
          Reporter: abergmann-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-1770

Support bundle generated files could contain sensitive information that might
be
unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition:
5.0.41
and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1770
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-1770.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1770
https://otrs.com/release-notes/otrs-security-advisory-2020-07/


body:
--1585587254.FC7aaCB3.2929
Date: Mon, 30 Mar 2020 16:54:14 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168104

            Bug ID: 1168104
           Summary: Issue with Patch openSUSE-2020-401
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: x86-64
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Maintenance
          Assignee: maintenance-at-opensuse.org
          Reporter: bugrprt21882-at-online.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Running the Patch openSUSE-2020-401 from the KDE Update Plasma - PackageKit -
results in the following errors being noted in the Zypper history:

# 2020-03-29 15:26:07 Output of grub2-i386-pc-2.02-lp151.21.12.1.noarch.rpm
%posttrans script:
#     update-bootloader: 2020-03-29 15:26:04 <3> update-bootloader-6892
run_command.294: '/usr/lib/bootloader/grub2-efi/
install' failed with exit code 127, output:
#     <<<<<<<<<<<<<<<<
#     target = x86_64-efi
#     + /usr/sbin/shim-install --config-file=/boot/grub2/grub.cfg
#     copying /usr/lib64/efi/grub.efi to /boot/efi/EFI/opensuse/grub.efi
#     x86_64-efi wird f374r Ihre Plattform installiert.
#     installation beendet. Keine Fehler aufgetreten.
#     /usr/sbin/shim-install: Zeile 326: efibootmgr: Kommando nicht gefunden.
#     /usr/sbin/shim-install: Zeile 352: efibootmgr: Kommando nicht gefunden.
#     >>>>>>>>>>>>>>>>
#     update-bootloader: 2020-03-29 15:26:07 <3> update-bootloader-6892
run_command.294: '/usr/lib/bootloader/grub2-efi/config' failed with exit code
127, output:
#     <<<<<<<<<<<<<<<<
#     + /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg
#     Generating grub configuration file ...
#     Found theme: /boot/grub2/themes/openSUSE/theme.txt
#     Found linux image: /boot/vmlinuz-4.12.14-lp151.28.44-default
#     Found initrd image: /boot/initrd-4.12.14-lp151.28.44-default
#     Found linux image: /boot/vmlinuz-4.12.14-lp151.28.40-default
#     Found initrd image: /boot/initrd-4.12.14-lp151.28.40-default
#     Found linux image: /boot/vmlinuz-4.12.14-lp151.28.36-default
#     Found initrd image: /boot/initrd-4.12.14-lp151.28.36-default
#     /etc/grub.d/80_suse_btrfs_snapshot: Zeile 7: btrfs: Kommando nicht
gefunden.
#     >>>>>>>>>>>>>>>>

pkgs: shim shim-leap

summary: Issue with Patch openSUSE-2020-401


--1585642166.27f15.12603
Date: Tue, 31 Mar 2020 08:09:26 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168150

            Bug ID: 1168150
           Summary: KDE:Extra/lensfun: Bug new version introduce failure in lot of software - code not ready
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: 3rd party software
          Assignee: kde-maintainers-at-suse.de
          Reporter: bruno@ioda-net.ch
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

Since the introduction of the new package v0.3.95 git version
There's some software that doesn't build (darktable in Factory)
And other that simply kaboom (ufraw for example)

Having released a new tarbal is certainly a good idea (for the updated
database) but upstream claim that they can't release a new version until
https://github.com/lensfun/lensfun/issues/945 is fixed.

reference https://github.com/lensfun/lensfun/issues/1033

Also upstream project page state clearly that they need a new leader to drive
the project. https://lensfun.github.io/news/

I'm not sure we fix whatever things with this new code. A lot of tools now are
just failing behind the scene (hugin can't do pano) etc.


body:
--1585653800.D0A1ca0.29922
Date: Tue, 31 Mar 2020 11:23:19 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168170

            Bug ID: 1168170
           Summary: mgetty build failure
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dmueller-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

[   51s] --------------------------------------------------------------------
[   51s] package: sendfax
[   51s] /usr/bin/chkstat modified files that are not properly handled!
[   51s] this will break rpm -V, ask ro for details.
[   51s] diff for both runs of rpm -V:
[   51s] -.M....G..    /usr/lib/mgetty+sendfax/faxq-helper
[   51s] +.M.......    /usr/lib/mgetty+sendfax/faxq-helper
[   51s] --------------------------------------------------------------------
[   51s] ### VM INTERACTION START ###
[   54s] [   47.301511] sysrq: Power Off
[   54s] [   47.304230] reboot: Power down
[   54s] ### VM INTERACTION END ###

this was fixed by Marcus already in Factory. due to regulatory processes need
to create a bugreport to fix this in Leap.

summary: mgetty build failure


--1585729630.dBE6de211.5159
Date: Wed, 1 Apr 2020 08:27:10 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168280

            Bug ID: 1168280
           Summary: VUL-0: CVE-2020-6817: python-bleach: Regular expression denial of service  in BleachSanitizerFilter.sanitize_css
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/256206/
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: dmueller-at-suse.com
          Reporter: atoptsoglou-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-6817

bleach.clean behavior parsing style attributes could result in a regular
expression denial of service (ReDoS).

Calls to bleach.clean with an allowed tag with an allowed style attribute are
vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a':
['style']}).

Workarounds:

do not whitelist the style attribute in bleach.clean calls
limit input string length

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
https://www.regular-expressions.info/redos.html
https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817
https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm


body:
--1585751162.1A704.2601
Date: Wed, 1 Apr 2020 14:26:02 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168338

            Bug ID: 1168338
           Summary: [trackerbug] lxd 4.0.0 update
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Containers
          Assignee: containers-bugowner-at-suse.de
          Reporter: asarai-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

- Update to LXD 4.0.0. The full upstream changelog is available from:
  https://discuss.linuxcontainers.org/t/lxd-4-0-lts-has-been-released/7231
  boo#

  Breaking Changes:
    * Removal of --container-only, replaced by --instance-only

  + VM: Support for backup (import/export)
  + PCI and USB devices in the resource API
  + Support for multiple ipvlan NIC devices
  + Support for host addresses on routed NIC
  + Support for editing cluster roles
  + Disk usage for custom volumes
  + Disk usage for snapshots
  + Support for passwordless PKI mode

pkgs: lxc lxcfs lxd

summary: [trackerbug] lxd 4.0.0 update


--1585751511.7c41ba0.7509
Date: Wed, 1 Apr 2020 14:31:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168341

            Bug ID: 1168341
           Summary: [Build 20200331] openQA test fails in await_install: mkinitrd fails on i586
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: i586
               URL: https://openqa.opensuse.org/tests/1221153/modules/awai
                    t_install/steps/11
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Basesystem
          Assignee: dracut-maintainers-at-suse.de
          Reporter: fvogt-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

aaa_base's get_kernel_version was fixed for .xz images, instead of failing it
returns the proper kernel version now.

On i586 this breaks mkinitrd though. For i586, it currently uses the "vmlinu."
regex for getting the kernel binaries in /boot, which also matches
/boot/vmlinux-...-....xz, which isn't the bootable kernel. Until now, those
were ignored because get_kernel_version failed.

Now that get_kernel_version is fixed, it now tries to build an initrd for the
".xz" versions, which obviously fails.

The fix is simple: Use i?86|x86_64) as match instead of i386|x86_64) in line
174.

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-i586-textmode@32bit fails in
[await_install](https://openqa.opensuse.org/tests/1221153/modules/await_install/steps/11)

## Test suite description
Maintainer: okurz

Installation in textmode and selecting the textmode "desktop" during
installation.

## Reproducible

Fails since (at least) Build
[20200330](https://openqa.opensuse.org/tests/1219967)

## Expected result

Last good: [20200329](https://openqa.opensuse.org/tests/1218352) (or more
recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=i586&distri=opensuse&flavor=DVD&machine=32bit&test=textmode&version=Tumbleweed)


--1585805304.4F1501.1350
Date: Thu, 2 Apr 2020 05:28:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168389

            Bug ID: 1168389
           Summary: transactional-update: umount of /proc failed
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: MicroOS
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Generating grub configuration file ...
Found theme: /boot/grub2/themes/openSUSE/theme.txt
Found linux image: /boot/vmlinuz-5.5.13-1-default
Found initrd image: /boot/initrd-5.5.13-1-default
done
2020-04-02 00:29 ERROR: umount of proc failed!
umount: /.snapshots/45/snapshot/proc: target is busy.
                     USER        PID ACCESS COMMAND
/.snapshots/45/snapshot/proc:kernel
                     root      mount /proc
COMMAND     PID USER   FD   TYPE DEVICE SIZE/OFF       NODE NAME
systemd       1 root   10r   REG    0,5        0      12745 /proc/1/mountinfo
systemd       1 root   14r   REG    0,5        0 4026532071 /proc/swaps
systemd-j   487 root   10r   REG    0,5        0      12987
/proc/sys/kernel/hostname
lsof      27267 root    3r   DIR    0,5        0          1 /proc
lsof      27267 root    6r   DIR    0,5        0   11695155 /proc/27267/fd


body:
--1585805484.5a8eFc381.4560
Date: Thu, 2 Apr 2020 05:31:24 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168390

            Bug ID: 1168390
           Summary: Update disables kubelet again
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Critical
          Priority: P5 - None
         Component: Kubic
          Assignee: kubic-bugs-at-opensuse.org
          Reporter: kukuk-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

(64/66) Removing kubernetes-kubelet-1.17.2-1.4.x86_64 [.....done]
Additional rpm output:
Removed /etc/systemd/system/multi-user.target.wants/kubelet.service.

Of course, cluster is not coming up again.

summary: Update disables kubelet again


--1585819501.30AdBA5.15232
Date: Thu, 2 Apr 2020 09:25:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168421

            Bug ID: 1168421
           Summary: Chromium security update to 80.0.3987.162
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: tchvatal-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-desktop_31.html

[$TBD][1062247] High CVE-2020-6450: Use after free in WebAudio. Reported by Man
Yue Mo of Semmle Security Research Team on 2020-03-17
[$TBD][1061018] High CVE-2020-6451: Use after free in WebAudio. Reported by Man
Yue Mo of Semmle Security Research Team on 2020-03-12
[$N/A][1059764] High CVE-2020-6452: Heap buffer overflow in media. Reported by
asnine on 2020-03-09


--1585915272.6Bb00.21997
Date: Fri, 3 Apr 2020 12:01:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168573

            Bug ID: 1168573
           Summary: obs-service-obs_scm-common - user obsservicerun and group obsrun don't exist
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: marina.latini-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

This is the output of zypper while installing a new version of the package:

------------------------------------
Installing: obs-service-obs_scm-common-0.10.14.1584463383.06b0455-281.1.noarch
...................................................................................................................................................................
Additional rpm output:
warning: user obsservicerun does not exist - using root
warning: group obsrun does not exist - using root
------------------------------------

cat /etc/os-release:
ID="opensuse-tumbleweed"
VERSION_ID="20200228"


--1585968342.2c4dCfa2.17393
Date: Sat, 4 Apr 2020 02:45:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168627

            Bug ID: 1168627
           Summary: Wrong dependency in RPM Package python3-breathe
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: 64bit
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Installation
          Assignee: yast2-maintainers-at-suse.de
          Reporter: fuiefh8sg-at-kaffeeschluerfer.com
        QA Contact: jsrain-at-suse.com
          Found By: ---
           Blocker: ---

The dependency of python(abi) was not increased from 3.7 to 3.8. In RPM package
python3-base the version of python(abi) is 3.8.


--1585984475.28E6bE2.5367
Date: Sat, 4 Apr 2020 07:14:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168628

            Bug ID: 1168628
           Summary: network:cluster/warewulf: Bug on vnfs-SUSE-Make-sure-no-repos-are-left-over-when-adding -a-list-of-repositories.patch
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: openSUSE Factory
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: burnus-at-gmx.de
          Reporter: runappz-at-gmail.com
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
                CC: eich-at-suse.com, scorot-at-free.fr
          Found By: ---
           Blocker: ---

Reused $i in bash script, which was firstly declared as number and then as
string.
The following patch should fix this.

---
vnfs-SUSE-Make-sure-no-repos-are-left-over-when-adding-a-list-of-repositories.patch
+++
vnfs-SUSE-Make-sure-no-repos-are-left-over-when-adding-a-list-of-repositories.patch.new
@@ -38,8 +38,8 @@
 +        done
 +
 +        cnt=0
-+        for i in `echo $ZYP_MIRROR | sed -e 's/,/ /'`; do
-+            $ZYP_CMD ar $i repo-$((cnt++))
++        for repourl in `echo $ZYP_MIRROR | sed -e 's/,/ /'`; do
++            $ZYP_CMD ar $repourl repo-$((cnt++))
 +        done
 +    fi
 +


--1585993311.6BB12.935
Date: Sat, 4 Apr 2020 09:41:51 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168630

            Bug ID: 1168630
           Summary: VUL-0: CVE-2020-6819,CVE-2020-6820: MozillaFirefox: use-after-free vulnerabilities fixed in 74.0.1, ESR 68.6.1 (MFSA 2020-11)
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: cgrobertson-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: cgrobertson-at-suse.com, security-team-at-suse.de,
                    wolfgang-at-rosenauer.org
          Found By: ---
           Blocker: ---

https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/

Security Vulnerabilities fixed in Firefox 74.0.1 and Firefox ESR 68.6.1

* CVE-2020-6819 bmo#1620818
  Use-after-free while running the nsDocShell destructor

* CVE-2020-6820 bmo#1626728
  Use-after-free when handling a ReadableStream

Mozilla sees targeted attacks in the wild.

References:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-11/
https://bugzilla.mozilla.org/show_bug.cgi?id=1620818
https://bugzilla.mozilla.org/show_bug.cgi?id=1626728


--1586095514.1daceE00.604
Date: Sun, 5 Apr 2020 14:05:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168657

            Bug ID: 1168657
           Summary: New maintainership and location for html2text
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: mail-at-mbayer.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Dear members of the team,

it occurs to me that you are maintaining a binary release of html2text:
https://build.opensuse.org/package/show/openSUSE:Factory/html2text

| html2text is now maintained by Fabian Groffen on GitHub at
| https://github.com/grobian/html2text .

html2text's primary site was http://www.mbayer.de/html2text/ (and before
that http://userpage.fu-berlin.de/~mbayer/tools/ ). Please adjust any
links and mirrors to refer to the new home at GitHub. Also, any
contributions or issue reports should now be submitted via GitHub.

Thank you!


body:
--1586102634.61dF1.14527
Date: Sun, 5 Apr 2020 16:03:54 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168659

            Bug ID: 1168659
           Summary: multimedia:apps/carla: Bug (Tumbleweed)
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: 64bit
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: simonf.lees-at-suse.com
          Reporter: guus.poort-at-upcmail.nl
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

OpenSUSE tumbleweed.

I can't load a windows vst into Carla within LMMS, this vst works through
Vestige in LMMS.

http://www.vst4free.com/free_vst.php?plugin=4Front_Piano&id=971

( win 32 bit version )

summary: multimedia:apps/carla: Bug (Tumbleweed)


--1586109853.7346EC5.20339
Date: Sun, 5 Apr 2020 18:04:13 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168661

            Bug ID: 1168661
           Summary: [Build 20200404] openQA test fails in await_install of installer, fails to reboot on SMP systems
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
               URL: https://openqa.opensuse.org/tests/1224945/modules/awai
                    t_install/steps/40
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: okurz-at-suse.com
        QA Contact: qa-bugs-at-suse.de
                CC: dimstar-at-opensuse.org
          Found By: ---
           Blocker: ---

## Observation

openQA test in scenario opensuse-Tumbleweed-DVD-x86_64-install_only@smp_64
fails in
[await_install](https://openqa.opensuse.org/tests/1224945/modules/await_install/steps/40)
fails to reboot on SMP systems

## Reproducible

Fails since Build [20200404](https://openqa.opensuse.org/tests/1224485), this
build, reproducibly

## Expected result

Last good: [20200402](https://openqa.opensuse.org/tests/1223880), previous
build

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=x86_64&distri=opensuse&flavor=DVD&machine=smp_64&test=install_only&version=Tumbleweed)

See
https://openqa.opensuse.org/snapshot-changes/opensuse/Tumbleweed/diff/20200404
for changes of this Tumbleweed snapshot.


--1586201878.cc3c13.19439
Date: Mon, 6 Apr 2020 19:37:58 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168783

            Bug ID: 1168783
           Summary: libinput-tools: missing dependency on python3-libevdev
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: All
                OS: All
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: X.Org
          Assignee: xorg-maintainer-bugs-at-forge.provo.novell.com
          Reporter: dev.rindeal+opensuse-at-gmail.com
        QA Contact: xorg-maintainer-bugs-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

```
> /usr/lib/libinput/libinput-measure-touchpad-pressure
Error: No module named 'libevdev'
One or more python modules are missing. Please install those modules and re-run
this tool.
```

Please do not confuse python3-libevdev with python3-evdev. `python3-libevdev`
is what's missing here and it's not even packaged yet.


body:
--1586251976.3d1E3b4.9704
Date: Tue, 7 Apr 2020 09:32:56 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1168839

            Bug ID: 1168839
           Summary: [tensorflow2] use mkl 0.21.2
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: cgoll-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The build of tensorflow 2 uses the the mkl-dnn  (math kernel library for deep
neuronal networks) from the system which is at version 1.1.3. This included two
patches which were not accepted upstream [1,2] as there were some functional
changes to mkl-dnn. As I can not oversee if this functional changes influence
the behavior of tensorflow, the mkl-dnn version 0.21.2 should be included as
source and the patches for the system mkl-dnn removed.
[1] https://github.com/tensorflow/tensorflow/pull/36488
[2] https://github.com/tensorflow/tensorflow/pull/36487

summary: [tensorflow2] use mkl 0.21.2


--1586263955.C20A0.10811
Date: Tue, 7 Apr 2020 12:52:35 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168865

            Bug ID: 1168865
           Summary: [Build 20200402] openQA test fails in lshw segfault ppc64le
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: PowerPC
               URL: https://openqa.opensuse.org/tests/1226146/modules/lshw
                    /steps/6
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: normand-at-linux.vnet.ibm.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

## Observation

lshw segfault ppc64le with version B.02.19.2-1.1
no failure in previous version B.02.18+git.20191228-1.1

reported failure:
=== extract from journalctl
Apr 06 22:04:09 susetest [RPM][3513]: Transaction ID 5e8bdf99 started
Apr 06 22:04:09 susetest [RPM][3513]: install lshw-B.02.19.2-1.1.ppc64le:
success
Apr 06 22:04:09 susetest [RPM][3513]: install lshw-B.02.19.2-1.1.ppc64le:
success
Apr 06 22:04:09 susetest [RPM][3513]: Transaction ID 5e8bdf99 finished: 0
Apr 06 22:04:22 susetest kernel: lshw[6160]: segfault (11) at 8 nip
7fff8b820dd4 lr 101d8d7a8 code 1 in libstdc++.so.6.0.28[7fff8b730000+270000]
Apr 06 22:04:22 susetest kernel: lshw[6160]: code: 4e800020 00000000 00000900
00000000 60000000 60000000 60000000 80030000
Apr 06 22:04:22 susetest kernel: lshw[6160]: code: 7c651b78 2c000000 40820014
e8630008 <e8030008> 7c250000 41820084 e8850010
===

openQA test in scenario
opensuse-Tumbleweed-DVD-ppc64le-extra_tests_in_textmode@ppc64le fails in
[lshw](https://openqa.opensuse.org/tests/1226146/modules/lshw/steps/6)

## Test suite description
Maintainer: okurz-at-suse.de

Mainly console extratest.

## Reproducible

Fails since (at least) Build
[20180813](https://openqa.opensuse.org/tests/734137)

## Expected result

Last good: (unknown) (or more recent)

## Further details

Always latest result in this scenario:
[latest](https://openqa.opensuse.org/tests/latest?arch=ppc64le&distri=opensuse&flavor=DVD&machine=ppc64le&test=extra_tests_in_textmode&version=Tumbleweed)


--1586290958.a1A4860.27093
Date: Tue, 7 Apr 2020 20:22:38 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168911

            Bug ID: 1168911
           Summary: VUL-0: chromium: multiple security issues fixed in 81.0.4044.92
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Major
          Priority: P5 - None
         Component: Security
          Assignee: tchvatal-at-suse.com
          Reporter: Andreas.Stieger-at-gmx.de
        QA Contact: security-team-at-suse.de
                CC: security-team-at-suse.de
          Found By: Critical Area Rapid Test Team
           Blocker: ---

https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html

Fixed in chromium 81.0.4044.92: 32 security fixes.

CVE-2020-6454: Use after free in extensions
CVE-2020-6423: Use after free in audio
CVE-2020-6455: Out of bounds read in WebSQL
CVE-2020-6430: Type Confusion in V8
CVE-2020-6456: Insufficient validation of untrusted input in clipboard
CVE-2020-6431: Insufficient policy enforcement in full screen
CVE-2020-6432: Insufficient policy enforcement in navigations
CVE-2020-6433: Insufficient policy enforcement in extensions
CVE-2020-6434: Use after free in devtools
CVE-2020-6435: Insufficient policy enforcement in extensions
CVE-2020-6436: Use after free in window management
CVE-2020-6437: Inappropriate implementation in WebView
CVE-2020-6438: Insufficient policy enforcement in extensions
CVE-2020-6439: Insufficient policy enforcement in navigations
CVE-2020-6440: Inappropriate implementation in extensions
CVE-2020-6441: Insufficient policy enforcement in omnibox
CVE-2020-6442: Inappropriate implementation in cache
CVE-2020-6443: Insufficient data validation in developer tools
CVE-2020-6444: Uninitialized Use in WebRTC
CVE-2020-6445: Insufficient policy enforcement in trusted types
CVE-2020-6446: Insufficient policy enforcement in trusted types
CVE-2020-6447: Inappropriate implementation in developer tools
CVE-2020-6448: Use after free in V8
Various fixes from internal audits, fuzzing and other initiatives


--1586329067.6FA3aEa0.29878
Date: Wed, 8 Apr 2020 06:57:47 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168935

            Bug ID: 1168935
           Summary: [DuplicateBinaries] llvm 9 and llvm 10 produce duplicate binaries
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: dimstar-at-opensuse.org
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

On April 7, LLVM10 was checked in to openSUSE:Factory - this results in
duplicate binaries being created, which is a major problem, as there is no
control which of the two is being available in the repo and for further product
builds..

e.g. mozjs68 is unresolvable with: nothing provides clang-tools = 9.0.1 needed
by clang9-devel, (got version 10.0.0-1.1) (llvm10 was last built, winning this
time inside OBS; for the repo it could be different)

Duplicate binaries found:
x86_64:
  clang-tools:
  - llvm10
  - llvm9
  libc++-devel:
  - llvm10
  - llvm9
  libc++1:
  - llvm10
  - llvm9
  libc++abi-devel:
  - llvm10
  - llvm9
  libc++abi1:
  - llvm10
  - llvm9
  python3-clang:
  - llvm10
  - llvm9

For the time being, I revert the addition of LLVM10 to Tumbleweed (no snapshot
broken yet)


--1586340141.B7466eDc0.15406
Date: Wed, 8 Apr 2020 10:02:21 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1168964

            Bug ID: 1168964
           Summary: Update cron in nextcloud package need a review.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Security
          Assignee: security-team-at-suse.de
          Reporter: ecsos-at-schirra.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

Olav Reinert <seroton10-at-gmail.com> made an request for cron in nextcloud.
Request was decliend from dimstar with:

[ 488s] nextcloud.noarch: E: cronjob-changed-file (Badness: 10000)
/etc/cron.d/nextcloud
[ 488s] A cron job or cron job related file installed by this package changed
[ 488s] in content. Please open a bug report to request follow-up review of the
[ 488s] introduced changes by the security team.

This have i made now.

But i wonder why.
Only time was changed.?.


--1586358456.30cE0.19467
Date: Wed, 8 Apr 2020 15:07:36 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169002

            Bug ID: 1169002
           Summary: LXC Appliance Image (Build 28.20) is missing /sbin/init
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: kristof.p-at-fce.vutbr.cz
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The LXC appliance image at:

http://download.opensuse.org/distribution/leap/15.2/appliances/opensuse-leap-image.x86_64-15.2.0-lxc-Build28.20.tar.xz

is missing /sbin/init and cannt be run.

Is it bug or intention?

Sorry to fill bug report. User registration on http://forums.opensuse.org/ is
not working.


--1586370470.CFafB4.24957
Date: Wed, 8 Apr 2020 18:27:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1169012

            Bug ID: 1169012
           Summary: usbmuxd still relies on libusbmuxd4 which is not provided anymore
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: x86-64
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: fkrueger-at-mailbox.org
        QA Contact: qa-bugs-at-suse.de
                CC: mpluskal-at-suse.com, tchvatal-at-suse.com
          Found By: ---
           Blocker: ---

usbmuxd cannot be installed (TW 20200405), because it still relies on
libusbmuxd4 although only libusbmuxd6 is available.


body:
--1586380141.F17D8d3.32722
Date: Wed, 8 Apr 2020 21:09:01 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1169021

            Bug ID: 1169021
           Summary: Support for WireGuard
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Kernel
          Assignee: kernel-maintainers-at-forge.provo.novell.com
          Reporter: mardnh-at-gmx.de
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The kernel in Tumbleweed was recently updated to version 5.6 with upstream
support for WireGuard (https://www.wireguard.com/)

Users of SLE/Leap still have to use the OOT kernel module that I maintain in
network:vpn:wireguard/wireguard

WireGuard upstream already did "proper" backport down to kernel 5.4
https://git.zx2c4.com/wireguard-linux/log/?h=backport-5.4.y

Do you see a chance to include Wireguard for the upcoming 5.3 based SLE/Leap
kernel ?

summary: Support for WireGuard


--1586415252.d7eCaA0.26743
Date: Thu, 9 Apr 2020 06:54:12 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169039

            Bug ID: 1169039
           Summary: VUL-1: CVE-2020-11653: performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy  that uses PROXY version 2
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/256877/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2020-11653

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x
before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS
termination proxy uses PROXY version 2. There can be an assertion failure and
daemon restart, which causes a performance loss.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11653
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11653
https://varnish-cache.org/security/VSV00005.html#vsv00005


--1586415462.FF3fA13.26156
Date: Thu, 9 Apr 2020 06:57:42 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169040

            Bug ID: 1169040
           Summary: VUL-1: CVE-2019-20637: varnish: information leak when handling one client request and the next on the same connection
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.1
          Hardware: Other
               URL: https://smash.suse.de/issue/256875/
                OS: Other
            Status: NEW
          Severity: Minor
          Priority: P5 - None
         Component: Security
          Assignee: jengelh-at-inai.de
          Reporter: wolfgang.frisch-at-suse.com
        QA Contact: security-team-at-suse.de
          Found By: Security Response Team
           Blocker: ---

CVE-2019-20637

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x
before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the
handling of one client request and the next request within the same connection.
This sometimes causes information to be disclosed from the connection
workspace,
such as data structures associated with previous requests within this
connection
or VCL-related temporary headers.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20637
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20637
http://varnish-cache.org/security/VSV00004.html#vsv00004


--1586470675.6bF73f70.31059
Date: Thu, 9 Apr 2020 22:17:55 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169153

            Bug ID: 1169153
           Summary: plasma-discover does not launch when installed in other desktop different than KDE Plasma.
    Classification: openSUSE
           Product: openSUSE Distribution
           Version: Leap 15.2
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: KDE Applications
          Assignee: opensuse-kde-bugs-at-opensuse.org
          Reporter: EagleScreen-at-gmail.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

I have installed discover in a XFCE desktop setup, the application seems to be
installed but does not open. When trying to open from a terminal, i get this:
~> plasma-discover
QQmlApplicationEngine failed to load component
qrc:/qml/DiscoverWindow.qml:6 module "org.kde.kquickcontrolsaddons" is not
installed

org.kde.plasma.discover: Errors when loading the GUI
org.kde.plasma.discover: could not get the main object
adding empty sources model QStandardItemModel(0x5625729802c0)
org.kde.plasma.libdiscover: Couldn't find a category for  "fwupd-backend"
remote hasn't changed: lvfs

Any missing dependency in the discover package?


--1586526713.A0edc80.17172
Date: Fri, 10 Apr 2020 13:51:53 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.suse.com/show_bug.cgi?id=1169192

            Bug ID: 1169192
           Summary: file shows file as 'statically linked', but readelf listed all NEEDED require
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: holgerbruenjes-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

file --version
file-5.38

shows 'statically linked'

 file /usr/lib64/libmagic.so.1.0.0
/usr/lib64/libmagic.so.1.0.0: ELF 64-bit LSB shared object, x86-64, version 1
(SYSV), statically linked,
BuildID[sha1]=f5c22cef0ef8447fe35a2b3b7d4a54fe59efd1bd, stripped

but with readelf -d

readelf -d /usr/lib64/libmagic.so.1.0.0

Dynamic section at offset 0x26d98 contains 29 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [liblzma.so.5]
 0x0000000000000001 (NEEDED)             Shared library: [libbz2.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libz.so.1]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000e (SONAME)             Library soname: [libmagic.so.1]

all NEEDED require where listed, so is libmagic 'not' statically linked

now the old version 5.37 shows 'dynamically linked'

file --version
file-5.37

file /usr/lib/libmagic.so.1.0.0
/usr/lib/libmagic.so.1.0.0: ELF 32-bit LSB shared object, Intel 80386, version
1 (SYSV), dynamically linked,
BuildID[sha1]=fe072c8ca1a6192ac4ecf6ae4c57353fb3c04869, stripped


body:
--1586774117.5152B1b3.10893
Date: Mon, 13 Apr 2020 10:35:17 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169283

            Bug ID: 1169283
           Summary: Header file missing package flint-devel
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Other
          Assignee: screening-team-bugs-at-suse.de
          Reporter: maiphi.public-at-gmx.net
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package flint-devel from the Tumbleweed OSS repository is broken, because
it is missing the file /usr/include/flint/config.h. This file is required for
inclusion by the FLint header files.

I understand that this is considered an upstream issue, because FLint includes
the config file with "#include config.h". See
https://build.opensuse.org/package/show/science/flint
https://github.com/wbhart/flint2/issues/521
The latter issue has been closed, because it is considered an issue of
opensuse.

I'm writing this in the hope that people start talking to each other. But if
noone is willing to fix this on either side, shouldn't the package at least be
removed from the system repositories?

Note that also Leap 15.1 is affected.

summary: Header file missing package flint-devel


--1586802787.083B33.32005
Date: Mon, 13 Apr 2020 18:33:07 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169340

            Bug ID: 1169340
           Summary: GNOME:Factory/gnome-sound-recorder: Missing dependency on gjs
    Classification: openSUSE
           Product: openSUSE.org
           Version: unspecified
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: 3rd party software
          Assignee: os.gnome.maintainers-at-gmail.com
          Reporter: sebix+novell.com-at-sebix.at
        QA Contact: bnc-team-screening-at-forge.provo.novell.com
          Found By: ---
           Blocker: ---

On Tumbleweed 20200411 with version 3.34.0-3.1:

$ gnome-sound-recorder
bash: /usr/bin/gnome-sound-recorder: /usr/bin/gjs-console: bad interpreter: No
such file or directory

After installing the package "gjs" it works.


body:
--1586844830.01d5f0db15.7353
Date: Tue, 14 Apr 2020 06:13:50 +0000
MIME-Version: 1.0
Content-Type: text/plain

http://bugzilla.opensuse.org/show_bug.cgi?id=1169368

            Bug ID: 1169368
           Summary: GCC 10: gdb build fails
    Classification: openSUSE
           Product: openSUSE Tumbleweed
           Version: Current
          Hardware: Other
                OS: Other
            Status: NEW
          Severity: Normal
          Priority: P5 - None
         Component: Basesystem
          Assignee: screening-team-bugs-at-suse.de
          Reporter: martin.liska-at-suse.com
        QA Contact: qa-bugs-at-suse.de
          Found By: ---
           Blocker: ---

The package fails here:
https://build.opensuse.org/package/live_build_log/openSUSE:Factory:Staging:N/gdb/standard/x86_64

due to:
[  169s] ../../bfd/elf.c: In function 'setup_group':
[  169s] ../../bfd/elf.c:745:35: error: overflow in conversion from 'unsigned
int' to 'int' changes value from 'num_group = 4294967295' to '-1'
[-Werror=overflow]
[  169s]   745 |     elf_tdata (abfd)->num_group = num_group = -1;
[  169s]       |                                   ^~~~~~~~~
[  169s] mv -f .deps/elfxx-x86.Tpo .deps/elfxx-x86.Plo

summary: GCC 10: gdb build fails