Fedora Weekly News Issue 84
Thomas Chung
tchung at fedoraproject.org
Mon Apr 23 07:03:45 UTC 2007
= Fedora Weekly News Issue 84 =
Welcome to Fedora Weekly News Issue 84[1] for the week of April 15th
through April 21st, 2007. The latest issue can always be found here[2]
and RSS Feed can be found here[3].
[1] http://fedoraproject.org/wiki/FWN/Issue84
[2] http://fedoraproject.org/wiki/FWN/LatestIssue
[3] http://feeds.feedburner.com/fwn
[[TableOfContents]]
1. Fedora Weekly News Issue 84
1. Announcements
1. F7T4 and SATA/IDE Testing (This Means You!)
2. Multi-Lingual Release Announcement
3. firstname.lastname at fedoraproject.org is going away
2. Planet Fedora
1. The XO in the Real World
2. PIdgin hits Rawhide
3. Design a Linux logo for an Indy Racing Car
4. Volunteers Needed on Fedora Docs Project
3. Developments
1. Packaging Extensions for Mozilla Applications:
Security Implications
2. L10N Issue With system-sonfig-samba, Support or Bugreport?
3. Fedora 7 Release Notes Freeze: Going, going ...
4. Broken Dependencies in Fedora Extras. Mikmod To Be
Reverted. Packagers: Watch For Dlopens!
5. KDE LiveCD -- English Only, And Which parted GUI?
6. Mass Package Rebuilds - Papering Over Cracks or
Shaking the Tree?
7. Extras i386 Mock Rebuild -- Large Number of Failures
Due to Yum Bug
8. How To Deal With Binary Incompatibility Introduced
By Compiler Changes
9. The Great PERL Package Split
10. Add Option To Experiment With updates-testing To Firstboot?
4. Maintainers
1. How To Handle GPL Exceptions
2. Release Notes Freeze For Fedora 7
5. Documentation
1. FDSCo Meeting Minutes
2. Invite a Member
3. Default Home Page Links
4. Virtualization Guide
6. Translation
1. Entity Switchback
7. Infrastructure
1. Fedoraproject.org Email
8. Artwork
1. Echo SVGs
2. Default Test 4 Icon Theme
9. Security Week
1. Risk report: Two years of Red Hat Enterprise Linux 4
2. Macbook hacked at CanSecWest
10. Security Advisories
1. Fedora Core 6 Security Advisories
2. Fedora Core 5 Security Advisories
11. Events and Meetings
1. Release Engineering Meeting: 2007-04-16
2. Release Engineering Meeting: 2007-04-19
3. Packaging Committee Meeting: 2007-04-17
4. FESCo Meeting Summary for 2007-04-19
5. Event Report: ICT Week - PETRONAS University of
Technology (Malaysia)
6. Event Report: FISL 8.0 (Brazil)
12. Feedback
== Announcements ==
In this section, we cover announcements from various projects.
=== F7T4 and SATA/IDE Testing (This Means You!) ===
WillWoods announces in fedora-test-list[1] - This is your early
warning that F7 Test4 - the last of the pre-F7 test
releases[2] - is coming out NEXT WEEK.
IF YOU HAVE BEEN HAVING PROBLEMS WITH DISK DETECTION AND/OR OTHER
DISK-RELATED THINGS, please read this!
One of the biggest changes in F7 is the new IDE driver stack, which uses
libata (like the SATA drivers do). Not only are IDE hard drives now
called /dev/sdX, but they're using new and interesting code. This could
be (and has been) causing some problems relating to drive detection at
boot time and install time, especially with upgrades from FC6 and
earlier.
[1] https://www.redhat.com/archives/fedora-test-list/2007-April/msg00289.html
[2] http://fedoraproject.org/wiki/FedoraTesting
=== Multi-Lingual Release Announcement ===
KarstenWade announces in fedora-marketing-list[1] - The time has come
to produce the final list of talking points[2] we want
covered in the F7 release.
By producing this list, we are enabling writers to write a
native-language, region-specific version of the Fedora 7 release
announcement.
[1] https://www.redhat.com/archives/fedora-marketing-list/2007-April/msg00093.html
[2] http://fedoraproject.org/wiki/Docs/Drafts/ReleaseAnnouncements/TalkingPoints
=== firstname.lastname at fedoraproject.org is going away ===
MikeMcGrath announces in fedora-announce-list[1] - Please note that in
one week (April 25th)
firstname.lastname at fedoraproject.org email addresses are going away.
These reasons are purely technical. People that need exceptions should
contact someone on the infrastructure team[2] or stop by #fedora-admin on
irc.freenode.net for consideration on a case by case basis.
[1] https://www.redhat.com/archives/fedora-announce-list/2007-April/msg00004.html
[2] http://fedoraproject.org/wiki/Infrastructure
== Planet Fedora ==
In this secton, we cover a highlight of Planet Fedora - an aggregation
of blogs from world wide Fedora contributors.
http://planet.fedoraproject.org/
=== The XO in the Real World ===
JohnPalmieri points out in his blog[1] - "The FISL congress is over
and it was great talking to the enormous amount of people who showed
interest in the XO learning laptop and the OLPC project[2]. It was
nice to see people's interest turn into large smiles by the time I was
done explaining the project and answering their questions. Many stayed
for fifteen minute or more and some even came back multiple times to
play around with the machines and ask more questions."
"The experience made the long hours working the booth worth it. It
also affirmed to me the real reasons I decided to work on the project
when given the chance to switch from Red Hat's desktop group."
[1] http://www.j5live.com/?p=357
[2] http://www.laptop.org/
=== PIdgin hits Rawhide ===
WarrenTogami points out in his blog[1] - "A pre-beta7 snapshot of
pidgin-2.0.0[2] is in FE7, and gaim is now removed from Core. This
gives us a small window for gaim-* plugin package maintainers to
rename the plugin packages, and for everyone to test that an upgrade
from gaim to pidgin goes smoothly for the core application and all
plugins."
"nautilus-sendto seemed to be the only package within Core with a dep
on gaim. I have rebuilt nautilus-sendto without that gaim dep for
now. We will be able to re-add it later only after the distributions
are merged, since pidgin is now in Extras. We have put pidgin
directly into Extras in order to avoid issues where it must build
against other packages in Extras like meanwhile-devel."
[1] http://wtogami.livejournal.com/16260.html
[2] http://www.pidgin.im/
=== Design a Linux logo for an Indy Racing Car ===
MairinDuffy points out in her blog[1] - "Thought you open source
artists out there might be interested: Tux 500 Logo Contest[2]"
[1] http://mihmo.livejournal.com/40576.html
[2] http://tux500.com/contest.php
=== Volunteers Needed on Fedora Docs Project ===
JohnBabich points out in his blog[1] - "I am reading with concern
regarding the great work that three individuals are doing on the
Fedora 7 Release Notes: Paul, Rahul and Karsten. They do a terrific
job with the result being best-in-class documentation[2] for each
release of Fedora Linux. They are three highly-committed people who
work behind-the-scenes to do a mostly thankless job."
"Therefore, I am appealing to the Fedora community (and beyond) to
contribute time and talent to help keep Fedora one of the best
community distros available."
[1] http://jmbuser.livejournal.com/1450.html
[2] http://fedoraproject.org/wiki/DocsProject/Join
== Developments ==
In this section, we cover the problems/solutions,
people/personalities, and ups/downs of the endless discussions on
Fedora Developments.
http://www.redhat.com/archives/fedora-devel-list/
=== Packaging Extensions for Mozilla Applications: Security Implications ===
Firefox, Thunderbird, and other applications often have optional and
popular functional extensions available. The code for these does not
pass through the Fedora packaging process, and updating/removing them
is not recorded in the rpmdb, leading to external code (in the
applications with the most security problems [1]) being installed
without trace.
[1] http://www.redhatmagazine.com/2007/04/18/risk-report-two-years-of-red-hat-enterprise-linux-4/#id1549680
VilleSkyttä remembered [2] a conversation from the past that suggested
there was some interest in packaging the extensions. He was
specifically interested in making it easier to obtain a 64-bit version
of enigmail. ChristopherAillon responded that the only way he could
see of doing it was a bit ugly [3], by querying RPM in %post and
requiring triggers. OwenTaylor had some opposite experience with
mugshot, which uses triggers but avoids the RPM queries; it might be
useful to anyone seeking to package Firefox extensions [4].
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00855.html
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00858.html
[4] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00859.html
EnricoScholz wondered [4a] why Firefox was packaged in a way that
seemed inimical to an rpm-based system (using versioned directories in
/usr/lib). Christopher explained that this was because of a
non-stable ABI, and that Enrico's proposed alternatives seemed a bit
hackish [4b], but Enrico remained unconvinced based on his experience
with packaging 15 extensions for Firefox-1.5. OwenTaylor agreed with
Enrico that the packaging of Firefox seemed to have no advantage other
than for parallel installs of different versions [4c].
[4a] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00876.html
[4b] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00881.html
[4c] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00888.html
Owen was further of the opinion that actual binaries were profitably
packaged but that if it was just script (e.g. XUL or JavaScript), it
was best to leave the end-user to deal with it themselves.
Countering, EnricoScholz brought up the security angle [5] and also
the simplicity and ease of use that we've all grown accustomed to from
Fedora's repositories. ChristopherAillon introduced a distinction
between trust and security and referenced the recent Mozilla
Developer's Summit that discussed this issue, leading AndrewOverholt
to request further details to aid in a similar problem facing Eclipse
packagers [6].
[5] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00868.html
[6] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00873.html
This was an interesting discussion that could affect a large number of
projects. Extensibility through scripting is something that many
applications offer, and if there's an easy way to re-use other
people's code, then that will be taken by many end users regardless of
risks.
=== L10N Issue With system-sonfig-samba, Support or Bugreport? ===
In a pleasant and productive exchange, AlainPortal pointed out some
problems with the presence of two strings in a pot[1] file, leading to
a non-translatable interface for system-config-samba. His attempts to
get the attention of the maintainer prompted a gentle caution [2] from
GilboaDavara that @fedora-devel was not a support list and that it
would be better to file a bugzilla entry.
The developer, NilsPhillipsen, wasn't disturbed and didn't think that
he was being pestered for support [3] and encouraged a bugzilla entry.
[1] ''pot'' files are a standard, human-readable way of providing for
localization of string in software.
http://www.gnu.org/software/gettext/manual/gettext.html#Files
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01088.html
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01101.html
=== Fedora 7 Release Notes Freeze: Going, going ... ===
KarstenWade announced [1] on Friday April 20th 2007 that there were
only 24 hours to get changes to the release notes incorporated into
the ISO. The good news is that the Web-based release notes can be
updated any time, so if you miss(ed) this deadline, then you can still
communicate essential information.
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01125.html
For those of us that have suffered with weird Sony VAIO cdrom install
issues in the past, ChuckAnderson raised a very useful question [2]
about whether the current information in the release notes was useful
(after the move to libata).
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01128.html
AlanCox was worried that anyone that had one of these VAIOs (with
external CDROM) would not be able to install F7 and asked that if
anyone does have one, to do an "lspci -vxxxx" with the cardbus
controller inserted and to send it to him [3].
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01133.html
=== Broken Dependencies in Fedora Extras. Mikmod To Be Reverted.
Packagers: Watch For Dlopens! ===
The April 19th 2007 automatically generated report of broken
dependencies in Fedora Extras [1] revealed that an update of mikmod
was playing havoc with a lot of packages. HansdeGoede was one of the
maintainers of many of these and along with others argued that it was
far too late in the release cycle to introduce a change like this.
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01047.html
JindrichNovy agreed, and while admitting to being the guilty party,
explained that mikmod was pretty stagnant and that the beta fork had
some worthwhile improvements [2]. He suggested making this change
after the release of F7.
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01110.html
DominikMierzejewski ('Rathann') was bitten [3] by the perl packaging
problems mentioned in this same FWN issue.
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01060.html
After HansdeGoede suggested that the list might be incomplete,
MichaelSchwendt asserted that the tool that generates these reports
(repoclosure) was pretty smart. Hans didn't deny this but wondered if
it would miss some specific cases [4], such as a library being
explicitly loaded within code by dlopen, and thus avoiding rpm's
autodependency generation. Michael assented to this and said that it
was the responsibility of the packager to look out for this sort of
thing.
[4] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01087.html
=== KDE LiveCD -- English Only, And Which parted GUI? ===
The KDE LiveCD team has been making great strides to showcase what
this highly polished desktop environment can bring to the Fedora user
experience[1].
[1] http://fedoraproject.org/wiki/Releases/FeatureFedoraKDE/KDELiveCD
SebastianVahl was concerned that this LiveCD is only available in
English and he proposed two directions in which localized versions
might be made available [2]. These boil down to either making a huge
DVD, or else to making a good tutorial so that users of other
languages can localize the CD for themselves. Comments are solicited.
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01034.html
A decision also needs to be made about whether to go with gparted or
qtparted[3]. According to CallumLerwick, GilboaDavra, and
FrankSchmitt, ntfs-formatted partitions can be resized with gparted
but not with qtparted[4] (which is seemingly unmaintained since 2004),
and that gparted is going into the LiveCD on that basis[5].
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01028.html
[4] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01033.html
[5] http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=234082
=== Mass Package Rebuilds - Papering Over Cracks or Shaking the Tree? ===
JohnPoelstra posted details of the Release Engineering Meeting[1].
ThorstenLeemhuis was against one of the decisions made in the meeting:
the rebuilding en masse of all packages at Test2 release time. His
worries about the bandwidth impact versus the potential gains were
discussed with DaveJones [2], who wondered if those that could be
affected were likely to be running rawhide. Thorsten argued that
while they might not, they could still be affected if they simply
tried to upgrade from a stable release of Fedora N to Fedora N+1. A
brief exchange with AxelThimm unearthed the difficulty of obtaining
concrete historical data as to what extent Fedora was rebuilt in the
past, but the figures looked high.
1. https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00900.html
2. https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00904.html
In a separate branch of the same discussion, Axel came out very
strongly in favor of the rebuilds [3], asserting that in essence
avoiding rebuilds is just papering over the cracks and shifting bugs
from development to maintenance, and that it is better to identify
security and other problems and fix them prior to release.
3. https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00909.html
Following input from JakubJelinek [4], JesseKeating noted that
rebuilds should not be carried out merely to shake the tree and see
what falls out, but when there are specific problems expected due to
large changes in some critical components.
4. https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00942.html
=== Extras i386 Mock Rebuild -- Large Number of Failures Due to Yum Bug ===
MattDomsch posted the latest report on Dell's rebuilding of Extras
packages in mock[1]. As usual, this report contains details of how
many packages built/failed to build succesfully. MamoruTasaka noticed
that one of the reported failures actually built succesfully for
him[2].
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00894.html
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00895.html
HansdeGoede and MarcinZajączkowski were also surprised to see their
names appear [3] and didn't think there was a reason for their
packages to break. JesseKeating noticed that the version of yum being
used by Matt was lacking a crucial bug fix and that many of the
failures were a result of that rather than a problem with the packages
themselves. The errors were false-negatives rather than
false-positives and Matt wasn't too concerned about having to rebuild
the tiny fraction compared to the thousands that had been succesfully
processed.
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00950.html
=== How To Deal With Binary Incompatibility Introduced By Compiler Changes ===
As always, Fedora aggressively pursues the latest stable versions of
software, including essential components of the compiler toolchain.
PatriceDumas was worried about the potential for binary
incompatibility resulting from the introduction of gfortran as a
replacement for the aging g77[1]. AndrewHaley sought
clarification[2] of the problem that Patrice was trying to solve,
suggesting that using an "soname" was the usual way to track changes
in the Application Binary Interface (ABI) [2a]. Patrice argued that
this would lead to using a different soname version in Fedora than was
being used upstream [3].
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00890.html
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00916.html
[2a] http://en.wikipedia.org/wiki/Application_Binary_Interface
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00926.html
It seemed that there was some confusion and JakubJelinek helpfully
suggested[4] that what was at issue was not the binary compatibility
of essential compiler libraries, but rather the potential for creating
a namespace clash between sonames of other libraries that have been
built with different ABI versions of the compiler. This would make
user-compiled binaries made with older versions of the library fail to
link properly to the library, but it would not be possible to detect
the error because the soname would be the same. Jakub clarified that
what should be done is to talk to upstream for each library about a
name change.
[4] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00935.html
LinusWallej, EmmanualSeymann, and AndrewHaley further clarified that
rebuilding all these user-compiled programs dependent on a library
with a non-stable ABI was The Fedora Way[5]. Linus also suggested
that getting the programs into Fedora if they were generally useful
would be a good idea[6] and observed that many vendors target RHEL
instead because they like the stability of the ABI whereas Fedora will
do (within reason) whatever is innovative. Patrice seemed happy with
the outcome, but also believed that more documentation about ABI
practices was required.
[5] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00934.html
[6] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00971.html
=== The Great PERL Package Split ===
In line with the principle of modularizing packages as much as
possible, RobinNorwood announced[1] the splitting of development
packages out of the main perl package. The current situation is that
each current perl package has a "BuildRequires:perl-devel" dependency.
This results in users being concerned and confused that they have a
"devel" package on their system when they did not request it.
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00886.html
Robin outlined the two main ways of fixing this as discussed on
@fedora-perl-devel: 1) fix each package by removing the requires; 2)
fix each package and also split out 5, or so, other development
related packages and add them to the buildroots. Robin sought
feedback from maintainers on their preferred option.
Some early feedback from key project members indicated that such major
restructuring would be preferred after the release of F7. Robin,
while apologizing for the late timing, pointed out the benefits and
relatively low cost[2] as he saw it. MattDomsch wondered how
widespread the breakage would be and JasonLTibbitts and ChrisAdams
made some estimates, noting that it wasn't only every perl-<somename>
package, but at least 100 others[3]. MattMiller and others argued
that such breakage would quickly alert the package owner who could
then fix it easily. VilleSkyttä and RalfCorsepius raised problems
with this fix[4].
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00972.html
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00993.html
[4] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01012.html
RalfCorsepius and ChrisAdams wondered [5] about the problem of a
package that was generated using autoconf, which would just leave any
optional perl dependencies out and build the package without failure,
but with reduced functionality. This was agreed to be a corner-case
that could be neglected.
[5] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01016.html
JesseKeating and ChrisWeyl [6] were concerned with the problem of what
might be, in effect, a Fedora-centric redefinition of what could be
considered to be "core" PERL modules. Jesse's over-riding concern was
that anyone wanting to rebuild from shipped SRPMs should be able to do
so easily[7].
[6] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01065.html
[7] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg00980.html
=== Add Option To Experiment With updates-testing To Firstboot? ===
Following up on a suggestion of DaveJones', ChrisBrown suggested that
firstboot be modified to ask users whether they wanted access to the
updates-testing packages[1]. WillWoods thought[2] that it would be
better to draw attention to, and inform users about, repoman. One of
the concerns that Chris sought to address is that updates-testing gets
little actual testing. LukeMacken and JackTanner discussed[3] the
problem of removing packages from update-testing that had failed
community QA; in passing, Luke noted that in future all non-security
updates would have to pass through testing, which might help to
revitalize it. Luke also drew attention to bodhi, which should make
pushing updates easier in the future.
[1] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01072.html
[2] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01119.html
[3] https://www.redhat.com/archives/fedora-devel-list/2007-April/msg01176.html
== Maintainers ==
In this section, we cover Fedora Maintainers, the group of people who
maintain the software packages in Fedora
https://www.redhat.com/archives/fedora-maintainers/
=== How To Handle GPL Exceptions ===
Starting off the week on the fedora-maintainers-list was a question
from a concerned Fedora package reviewer who was unsure how to handle
an exception clause in the GPL license[1]. Rahul Sundaram chimed in
saying that if the GPL exception restricts the license it may cause
problems, but if it's more lax then it should be fine.
[1] https://www.redhat.com/archives/fedora-maintainers/2007-April/msg00305.html
=== Release Notes Freeze For Fedora 7 ===
This week also marked the freeze for the ISO-based release notes.
Changes to the release notes now only affect the web-based release
notes as the process of converting the release notes from the Wiki to
XML has started[1].
[1] https://www.redhat.com/archives/fedora-maintainers/2007-April/msg00432.html
== Documentation ==
In this section, we cover the Fedora Documentation Project.
http://fedoraproject.org/wiki/DocsProject
=== FDSCo Meeting Minutes ===
Both the log[1] and the summary[2] for the 2007-04-15 meeting are
available here:
[1] https://www.redhat.com/archives/fedora-docs-list/2007-April/date.html
[2] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00101.html
The main topics included updates to the Desktop User Guide for Fedora
7, Fedora 7 Test 4 release notes, some more Google Summer of Code
thoughts and also some discussions about the Administration Guide.
=== Invite a Member ===
The new Fedora accounts system will have the ability for existing
members to invite friends, or others they think would be interested in
helping out with Fedora, to join the project. MikeMcGrath requested
ideas on the best phrasing for these e-mail invites[1]. PaulWFrields
replied with his suggestion of an appropriate message[2].
[1] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00104.html
[2] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00105.html
=== Default Home Page Links ===
There was a proposal that it might be a good idea to include links to
some sites related to Free Culture, in a broader sense than software
alone, on the default Fedora 7 home page. The original proposal
suggested that sites such as Jamendo or Magnatune would be a
worthwhile addition[1]. Concerns were raised that this might transform
the home page in to an advertising medium, resulting in some users
losing faith in the standards of the home page[2]. Perhaps this is an
opportunity to define exactly what criteria are required for inclusion
in the homepage[3].
[1] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00114.html
[2] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00129.html
[3] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00135.html
=== Virtualization Guide ===
The Virtualization Guide needed updating for Fedora 7 to include
information on KVM[1], which was promptly addressed[2].
[1] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00133.html
[2] https://www.redhat.com/archives/fedora-docs-list/2007-April/msg00147.html
== Translation ==
This section, we cover the news surrounding the Fedora Translation
(L10n) Project.
http://fedoraproject.org/wiki/L10N
=== Entity Switchback ===
PaulFrields posted this message[1] which detailed the changes to
xml2po (now xml2po -e). He also mentioned that the number of fuzzy
entries appears to be fewer than initially thought.
[1] https://www.redhat.com/archives/fedora-trans-list/2007-April/msg00065.html
== Infrastructure ==
In this section, we cover Fedora Infrastructure Project.
http://fedoraproject.org/wiki/Infrastructure
=== Fedoraproject.org Email ===
MikeMcGrath made the email changes[1] discussed last week so that the
firstname.lastname at fedoraproject.org are no longer valid. The change
was made because of duplicity and processing problems.
[1] https://www.redhat.com/archives/fedora-infrastructure-list/2007-April/msg00155.html
== Artwork ==
In this section, we cover Fedora Artwork Project.
http://fedoraproject.org/wiki/Artwork
=== Echo SVGs ===
MatthiasClasen reports that, while investigating the possibility of
including SVGs in the Echo package to improve coverage of smaller
icons, the size of the echo-icon-theme package increases to 70MB[1].
This lead to the discovery that some of the larger icons suffer from a
number of bloat problems revolving around jpeg thumbnails and excess
XML tags. A script was written that removes a lot of this bloat
reducing the size of some icons considerably: 416K to 18K in one
case.[2] There are still some problems with this script, resulting in
some icons not rendering correctly, but it is being worked on
constantly.
[1] https://www.redhat.com/archives/fedora-art-list/2007-April/msg00064.html
[2] https://www.redhat.com/archives/fedora-art-list/2007-April/msg00065.html
=== Default Test 4 Icon Theme ===
As a result of the inclusion of Echo SVGs not being the quick-fix for
smaller size coverage that was hoped, MatthiasClasen proposed that
Bluecurve/Clearlooks may have to fall back to the default Fedora 7
icon theme[1]. This led to some discussion about possible alternative
icon themes for Fedora 7 and Mist appeared as a popular choice[2];
Mist has now been made the default icon theme for Fedora 7 Test 4[3].
[1] https://www.redhat.com/archives/fedora-art-list/2007-April/msg00085.html
[2] https://www.redhat.com/archives/fedora-art-list/2007-April/msg00087.html
[3] https://www.redhat.com/archives/fedora-art-list/2007-April/msg00102.html
== Security Week ==
In this section, we highlight the security stories from the week in Fedora.
=== Risk report: Two years of Red Hat Enterprise Linux 4 ===
MarkCox wrote an interesting article looking at the last two years of
security flaws in Red Hat Enterprise Linux 4[1]. The information in
this article is interesting to anyone who tracks open source security
flaws. There is not a lot of public analysis of open source security
flaws. The article does focus on Red Hat Enterprise Linux 4, but the
trends represented apply to any Linux distribution.
[1] http://www.redhatmagazine.com/2007/04/18/risk-report-two-years-of-red-hat-enterprise-linux-4/
=== Macbook hacked at CanSecWest ===
Apple's OS X is currently gaining attention in the security world[1].
Historically people have considered OS X to be very secure and mostly
virus and hack free. This is starting to change as researchers have
been paying attention to the Mac lately. Part of this is probably the
challenge it presents. Those of us in the Linux world have been
enjoying a similar situation. There is little fear of viruses, and as
long as one applies security updates, there isn't much fear of being
compromised.
[1] http://news.com.com/2100-7349_3-6178131.html?part=rss&tag=2547-1_3-0-5&subj=news
There are many people who will argue that the real reason for this is
that Linux is more secure by design. I believe it's a combination of
things. Historically Linux users have been a bit more savvy, this is
starting to change. In the past, the desktop was also very simple.
This too is changing. As Gnome and KDE gain functionality, they also
gain more security flaws. For example, the fact that the desktop will
display a thumbnail of many different file types gives an attacker a
doorway into a system. They of course need to convince a user into
downloading a file, but as we've seen from many viruses, this is not
as hard as it sounds. I hope that various technologies such as
SELinux and Exec-Shield will help keep most of the trash away, the
human factor cannot be fixed as easily. As long as people are willing
to open attachments, and visit random web sites, viruses will exist.
As a friend of mine used to say "We're OK until the toaster people
start using it." The "toaster people" are the normal people confused
by the knob on their toasters :)
== Security Advisories ==
In this section, we cover Security Advisories from fedora-package-announce.
https://www.redhat.com/archives/fedora-package-announce/
=== Fedora Core 6 Security Advisories ===
* FEDORA-2007-453: tcp_wrappers-7.6-40.3.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-453
* FEDORA-2007-436: coreutils-5.97-12.5.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-436
* FEDORA-2007-434: hplip-1.7.2-3.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-434
* FEDORA-2007-452: openoffice.org-2.0.4-5.5.22 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-452
* FEDORA-2007-451: scim-tables-0.5.7-2.1.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-451
* FEDORA-2007-442: selinux-policy-2.4.6-57.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-442
* FEDORA-2007-447: openoffice.org-2.0.4-5.5.21 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-447
* FEDORA-2007-428: yum-3.0.6-1.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-428
* FEDORA-2007-444: Fmc-4.6.1a-36.20070124cvs.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-444
* FEDORA-2007-415: php-5.1.6-3.5.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-415
* FEDORA-2007-440: [SECURITY] gstreamer-0.10.11-1.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-440
* FEDORA-2007-383: rhythmbox-0.9.8-2.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-383
* FEDORA-2007-410: tk2-2.10.8-3.fc6 -
http://fedoraproject.org/wiki/FSA/FC6/FEDORA-2007-410
=== Fedora Core 5 Security Advisories ===
* FEDORA-2007-455: [SECURITY] php-5.1.6-1.5 -
http://fedoraproject.org/wiki/FSA/FC5/FEDORA-2007-455
* FEDORA-2007-454: tcp_wrappers-7.6-40.3.fc5 -
http://fedoraproject.org/wiki/FSA/FC5/FEDORA-2007-454
* FEDORA-2007-414: [SECURITY] Image``Magick-6.2.5.4-4.2.1.fc5.8 -
http://fedoraproject.org/wiki/FSA/FC5/FEDORA-2007-414
* FEDORA-2007-445: mc-4.6.1a-36.20070124cvs.fc5 -
http://fedoraproject.org/wiki/FSA/FC5/FEDORA-2007-445
== Events and Meetings ==
In this section, we cover event reports and meeting summaries from
various projects.
=== Release Engineering Meeting: 2007-04-16 ===
* https://www.redhat.com/archives/fedora-advisory-board/2007-April/msg00113.html
=== Release Engineering Meeting: 2007-04-19 ===
* http://www.redhat.com/archives/fedora-devel-list/2007-April/msg01092.html
=== Packaging Committee Meeting: 2007-04-17 ===
* https://www.redhat.com/archives/fedora-maintainers/2007-April/msg00338.html
=== FESCo Meeting Summary for 2007-04-19 ===
* https://www.redhat.com/archives/fedora-maintainers/2007-April/msg00448.html
=== Event Report: ICT Week - PETRONAS University of Technology (Malaysia) ===
* https://www.redhat.com/archives/fedora-ambassadors-list/2007-April/msg00280.html
=== Event Report: FISL 8.0 (Brazil) ===
* https://www.redhat.com/archives/fedora-ambassadors-list/2007-April/msg00304.html
== Feedback ==
This document is maintained by the Fedora News Team[1]. Please feel
free to contact us to give your feedback. If you'd like to contribute
to a future issue of the Fedora Weekly News, please see the Join[2]
page to find out how to help.
[1] http://fedoraproject.org/wiki/NewsProject
[2] http://fedoraproject.org/wiki/NewsProject/Join
--
Thomas Chung
http://fedoraproject.org/wiki/ThomasChung
More information about the fedora-announce-list
mailing list