Jonathan Bryce has announced two open community meetings to hearinput on the topic of the OpenInfraFoundation migrating to the Linux Foundation. Brycewrote that the OpenInfra board has carefully evaluated its options,and sees joining the Linux Foundation as the best way forward.Like the Linux Foundation, the OpenInfra Foundation is 501(c)(6)nonprofit. According to the FAQ,OpenInfra "is in great health, financially and otherwise" witha growth in membership of about 15% in the last year. However, itsneeds in 2025 are different than when it was founded as the OpenStackFoundation in 2012.
Version 25.2 of the LibreOffice productivity suite is out. Changes includethe ability to remove all personal information from any document, supportfor ODF version1.4, a number of accessibility improvements, and more;see therelease notes for details.
Version24.10.0 of the OpenWrt router-oriented distribution has been released.Changes include an update to the 6.6 kernel, use of access control lists onlarger systems, multipath TCP support, better WiFi6 support, thebeginning of WiFi7 support, and more.
Open source is often described as a "gift economy"-anecosystem where contributors are motivated by a desire to make theworld a better place. That is, sometimes, true. However, JamesBottomley used his maintrack slot at FOSDEM 2025,on February1, to make the case that it is better to bank on theselfish motivations of individuals to drive community success than torely on their altruism.
Security updates have been issued by Debian (asterisk and chromium), Fedora (FlightGear, java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, java-latest-openjdk, and SimGear), Mageia (bind, chromium-browser-stable, python-django, and vim), Oracle (buildah, bzip2, firefox, keepalived, mariadb:10.11, and podman), Slackware (curl, mariadb, and mozilla), SUSE (cargo-audit-advisory-db-20250204 and python311-scikit-learn), and Ubuntu (ckeditor, krb5, and ruby2.7).
Over the past year or so, LWN has added a number of useful newfeatures for our subscribers to enhance the experience of reading andcommenting on our content. Those features are of little use, however,to readers who do not know about them. It has been more than a decadesince we last provided atour of the site-it seems that another is inorder. Walk this way for a look at the LWN kernel source database (KSDB),enhanced commenting features, EPUB downloads, and more.
Jake Hillion gavea presentation atFOSDEM about usingsched_ext, the BPFscheduling framework that was introduced in kernel version 6.12, to help findelusive concurrency problems. In collaboration with Johannes Bechberger, he hasbuilt a scheduler that can reveal theoretically possible but unobservedconcurrency bugs in test code in a few minutes. Since their scheduler onlyrelies on mainline kernel features, it can theoretically be applied to anyapplication that runs on Linux - although there are a number of caveats sincethe project is still in its early days.
Security updates have been issued by Debian (firefox-esr), Fedora (fastd, ovn, and yq), Mageia (libreoffice), Slackware (mozilla), SUSE (google-osconfig-agent, grafana, helm, and rime-schema-all), and Ubuntu (linux-azure, linux-azure-5.4, linux-lowlatency, openjdk-17, openjdk-21, openjdk-23, openjdk-8, and openjdk-lts).
Jeff Xu has been working ona patch set that makes certain mappings in a process's address spaceimpossible to change, sealing them against tampering. This has some potentialsecurity benefits - mainly, makingsure that someone cannot relocate thevsyscall andvDSO mappings - but some kernel developers haven'tbeen impressed with the patches.While the core functionality (sealing the mappings) is sound, some of thesupporting code for enabling and disabling the new feature caused concern bygoing against the normal design for such things. Reviewers also questionedhow this feature would interact with checkpointing and with sandboxing.
Version135.0 of the Firefox web browser has been released. Changes includemore languages for the translations feature, increasing roll-out of thecredit-card autofill and AI chatbot features, and (perhaps most welcome):
By the time that Linus Torvalds released6.14-rc1 and closed the merge window for this development cycle, some9,307 non-merge changesets had been pulled into the mainlinerepository - the lowest level of merge-window activity seen in years.There were, nonetheless, a number of interesting changes in the5,000 commits pulled since thefirst-half merge-window summary was written.
Matthias Clasen has written a short update on a GTK hackfest thattook place at FOSDEM and what'scoming in GTK 4.18. This includes fixes for pointer sizes in Waylandwhen fractional scaling is enabled, removal of the old GL renderer infavor of the GLrenderer introduced in GTK4.13.6, and deprecation of X11 and Broadway backends with intentto remove them in GTK 5.The deprecated backends will remain available until then, and noaction is required by developers at this time, Clasen wrote: "Thereis no need to act on deprecations until you are actively porting yourapp to the next major version of GTK, which is not on the horizonyet".
Version 2.44 of the GNU Binutils package has been released. Perhaps themost significant change is the absence of the "gold" linker, which isdeprecated and about to disappear entirely. Gold appeared in 2008 with some fanfare as a fasterlinker, but it has suffered from a lack of maintenance in recent years.This release also includes some architecture-specific assemblerimprovements, and some (non-gold) linker enhancements.
The6.13.1,6.12.12,6.6.75,6.1.128,5.15.178,5.10.234, and5.4.290stable kernel updates have all been released; each contains another set ofimportant fixes.
Julia, a free, general-purposeprogramming language aimed at science, engineering, and related arenas oftechnical computing, has steadily improved and widened its scope ofapplication since its initial publicrelease in2012. As part of its 1.11release from late 2024, Julia made several inroads into areasoutside of its traditional focus, provided its users with advances intooling, and has seen several improvements in performance and programmerconvenience. These recent developments in andaround Julia go a long way to answer several longstanding complaints fromboth new and experienced users. We last lookedin on the language one year ago,for its previous major release, Julia1.10.
The election to replace outgoing openSUSE board members isunderway, with four candidates vying for three seats. The election wasinitially scheduled to be completed in December, but the timeline was extendeddue to too few candidates standing for the seats. Voting closes onFebruary2 and the results are expected to be announced onFebruary3.
The Linux Foundation has published itslong-awaited article on international sanctions and open-sourcedevelopment. This is the reasoning that went into the removal of a group of Russian kernelmaintainers in October.
Security updates have been issued by AlmaLinux (libsoup), Debian (debian-security-support and redis), Fedora (expat, java-21-openjdk, lemonldap-ng, and phpMyAdmin), Mageia (chromium-browser-stable and git-lfs), Oracle (bzip2, git-lfs, libsoup, mariadb:10.11, mariadb:10.5, python-jinja2, redis, and unbound), Red Hat (git-lfs, libsoup, python-jinja2, rsync, and unbound), SUSE (buildah, chromium, google-osconfig-agent, govulncheck-vulndb, hauler, ignition, krb5, libxml2, python311-pydantic, SDL2_sound, and trivy), and Ubuntu (jquery, linux-azure, linux-azure-4.15, linux-azure-5.15, linux-hwe-5.4, linux-oracle, and mysql-8.0).
While the path toward the ability to write device drivers in Rust has beenanything but smooth, steady progress has been made and that goal is closeto being achieved - for some types of drivers at least. Device driversneed to be able to set up memory areas for direct memory access (DMA)transfers, though; that means Rust drivers will need a set ofabstractions to interface with the kernel's DMA-mapping subsystem. Thoseabstractions have run into resistance that has the potential to blockprogress on the Rust-for-Linux project as a whole.
Visitors to the freedesktop.orgGitLab instance are currently being greeted with a message noting thatthe company who has been hosting it for free for nearly five years, Equinix, hasasked that it be moved (or start being paid for) by the end of April. Theissueticket opened by Benjamin Tissoires in order to track the planning of a move is clear that the project is grateful forthe gift:"First, I'd like to thank Equinix Metal for the years of support they gave us. They were very kind and generous with us and even if it's a shame we have to move out on a short notice, all things come to an end."The current cost for the services, much of which is for 50TB of bandwidth data transferper month and a half-dozen beefy servers for running continuous-integration(CI) jobs, comes to around $24,000 per month. Tissoires believes that theproject should start paying for service somewhere, in order to avoidupheaval of this sort, sometimes on short or no notice. "I personallythink we better have fd.o pay for its own servers, and then have sponsorschip in. This way, when a sponsor goes away, it's technically much simplerto just replace the money than change datacenter." Various options arebeing discussed there, but any move is likely to disrupt normal servicesfor a week or more.
Version 2.41 of the GNUC Library has been released. Changes include a number of test-suiteimprovements, strict-error support in the DNS stub resolver, wrappers forthe the sched_setattr()and sched_getattr() system calls,Unicode 16.0.0 support,improved C23 support,support for extensible restartablesequences,Guarded Control Stack support on 64-bit Arm systems,and more.
The Thunderbird project has announcedthat it is making its Releasechannel the default download beginning with the 135.0 release inMarch. This will move users to major monthly releases instead of theannual major Extended Support Release (ESR) that is the currentdefault.
Version 6.9 of the Incus container and virtual-machine management system has been released. Changes include a command to provide virtual machine memory dumps, ability to set network ACLs for instances on bridged networks, and more.
For years we have had occasional requests to be able to receive LWN ina format for ebook readers. It took a while, but we are now happy toannounce that all of LWN's feature content is available, to subscribers atthe "professional hacker" level and above, in the EPUB format. To obtainthe weekly edition as an EPUB file, just click the "Download EPUB" link inthe left column. There is a separate RSS feedfor the EPUB format as well. Any other feature content can be turned intoan ebook by appending /epub to its URL.We will also be creating special EPUB books at times. As an example ofwhat is possible, our complete coverage from Kangrejos 2024 and the 2024 Linux Storage, Filesystem,Memory Management, and BPF Summit are available to all readers.There are surely places where our EPUB books can be improved; please feelfree to drop us a note (at lwn@lwn.net) with suggestions.
Security researcher RyotaKhas shared a series of vulnerabilities that all have to do with how Gitinterfaces with externalcredential managers. In short, while Git guards against newline characters(\n) being injected into a repository's URL, some programming languagesalso treat carriage return characters (\r) as being newlines. Adding acarriage return to a repository's URL can cause Git and the credential managerto disagree on how the URL should be parsed, ultimately resulting in Gitcredentials being sent to the wrong host. Malicious repositories could includeGit submodules with malformed URLs, triggering the bug. Only password-based authenticationwith an external credential manager isvulnerable to this attack; SSH-based authentication remains secure. The Git projecthas chosen to consider this a vulnerability in Git, given the large amount ofexternal software affected. The project has fixed the bug on its end byreleasing updates for all supported versions that bancarriage returns in URLs entirely.Affected software includes GitHub Desktop, Git LFS, and possibly other Git utilities:
Earthstar is a privacy-oriented,offline-first, LGPL-licensed database intended to support distributedapplications. Unlike other distributed storage libraries, itfocuses on providing mutable data with human-meaningful names and modificationtimes, which gives it an interface similar to many non-distributedkey-value databases.Now, the developers are looking at switching to a new synchronizationprotocol - one that is general enough that it might see wider adoption.
Ubuntu will be moving its "official realtime communicationschannels" from IRC to Matrix, beginning March1,2025, followinga discussionon the ubuntu-devel mailing list.
This year's edition of the Free and OpenSource Software Developers' European Meeting (FOSDEM) begins onFebruary1 in Brussels. The event is widely regarded as one ofthe most important open-source conferences. One of the reasons thatFOSDEM is held in high esteem by the community is its non-commercialnature. It does accept sponsors, butsponsorships come with few perks and no "pay-for-play" speakingslots. Thus, the scheduling of a keynote by JackDorsey-primarily known for his role in co-founding Twitter, andcurrently CEO and chairman of FOSDEM sponsor Block,Inc.-raised eyebrows and led to plans for a protest. Thekeynote has since been removed from the schedule, but there are stilla number of lingering questions.
Security updates have been issued by Debian (git and openjpeg2), Mageia (virtualbox), SUSE (podman), and Ubuntu (clamav, frr, libreoffice, linux-xilinx-zynqmp, and quagga).
The Go language is designed to make iteasy for developers to import otherGo packages and compile everything into a static binaryfor simple distribution. Unfortunately, this complicates things forthose who package Go programs for Linux distributions, such as Fedora,that have guidelines which require dependencies to be packagedseparately. Fedora's Go special interestgroup (SIG) is asking for relief and a loosening of the bundlingguidelines to allow Go packagers to bundle dependencies into thepackages that need them, otherwise known as vendoring. So far, theparticipants in the discussion have seemed largely in favor of theidea.
Last year, LWN examined the changes lined up forRust's 2024 edition. Now, with the editionready to be stabilized in February,it's time to look back at the edition process and see what wassuccessfully adopted, which new changes were added, and what still remains towork on. A surprising amount of new work was proposed, implemented, andstabilized during the year.
Security updates have been issued by Debian (chromium and python-django), Fedora (git-lfs and pam-u2f), Mageia (golang), Red Hat (java-11-openjdk with Extended Lifecycle Support, java-17-openjdk, and java-21-openjdk), SUSE (cheat, dante, docker-stable, grafana, and kernel), and Ubuntu (cacti, cyrus-imapd, HTMLDOC, and PCL).
A "uretprobe" is a dynamic, user-space tracepoint injected by the kernelinto a running process; this documenttersely describes their use. Among other things, uretprobes are used bythe perf utility to time function calls. The 6.11 kernel saw asignificant change to uretprobes that improved their performance, but thatchange is also creating trouble for some users. The best way to solve theproblem is not entirely clear.
As of this writing, just over 4,300 non-merge changesets have been pulledinto the mainline repository for the 6.14 release. Many of the pullrequests this time around include remarks saying that activity has beenrelatively low this time around, presumably due to the holidays. So those4,300 changesets are probably closer to the merge-window halfway point thanusual. Much of the work merged thus far looks more like incrementalimprovements than major new initiatives, but there still have been a numberof interesting changes in the mix.
The proposal to add a more general facility for string formatting toPython, which we looked at in August 2024,has changed a great deal since, so it merits another look. Thechanges take multiple forms: a new title for PEP750 ("Template Strings"), a different mechanism for creating and using templates,a new Template type to hold them, and several additional authors for the PEP.Meanwhile, one controversial part of the original proposal, lazy evaluationof the interpolated values, has been changed so that it requires anexplicit opt-in (via lambda);template strings are a generalization of f-strings and lazy evaluation was seen by someas a potentially confusing departure from their behavior.
The computer mouse is a wonderful invention, but for the past fewmonths I've been working to use mine as little as possible forproductivity and ergonomic reasons. It should not be surprising thatthere are quite a few open-source applications, utilities, andconfiguration options that are either designed to or incidentallyassist in creating a keyboard-driven desktop. This includes tiling windowmanagement with PaperWM, the Vimium browser extension, Input Remapper, and more.
LWN.net