https://www.debian.org/security/2020-GRUB-UEFI-SecureBoot/

https://9to5linux.com/grub2-boot-failure-issues-fixed-in-debian-and-ubuntu-update-now

There are issues with the current sndio-package as it seems not possible to get this to work with ALSA.

Current torsocks version is broken.
It returns the following error when attempting to torify application :

which: no getcap

In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation

https://security-tracker.debian.org/tracker/CVE-2019-2201

Patch: https://github.com/libjpeg-turbo/libjpeg-turbo/issues/388

Hello,

I’m unable to print some pdfs on my Hyperbola 3.0 system.
Some background :

cups is installed, service enabled and working
system-config-printer is installed and my printer has been correctly added.

I can print most pdfs and text files but recently with a pdf, it fails to print it.* And system-config-printer returned the following error (see capture) :

Printer "EPSON XP-620-Series" requires the '/usr/lib/cups/filters/epson-escpr-wrapper' but it is not currently installed.

Currently, “epson-escpr-wrapper” is installed but it is in :

/usr/libexec/cups/filters/epson-escpr-wrapper

Looking at source code of system-config-printer, it expects that wrapper to be installed in “/usr/lib/” so I tried to symlink that “epson-escpr-wrapper” to “/usr/lib/cups/filters” but it doesn’t work..

*With a Debian system and the exact same configuration, the “problematic” pdf prints just fine so it is not an issue with the pdf.

The current version of BleachBit needs to be adapted so it can clean the new .cache/hyperbola/ directory.

smartmontools 6.5-1.hyperbola1

Error while trying to update smart-drivedb :

anon@test[~] update-smart-drivedb

External Link/usr/bin/update-smart-drivedb: download from branches/RELEASE_6_5_DRIVEDB failed (curl: exit 23) /usr/bin/update-smart-drivedb: download from trunk failed (curl: exit 23)

These two options could be enabled :

Kernel hacking → [*] Filter access to /dev/mem
[*] Filter I/O access to /dev/mem

Security options → [*] Restrict unprivileged access to the kernel syslog

Description: https://www.openwall.com/lists/oss-security/2020/02/24/5 https://www.bleepingcomputer.com/news/security/new-critical-rce-bug-in-openbsd-smtp-server-threatens-linux-distros/

Qualys Security Advisory

LPE and RCE in OpenSMTPD’s default install (CVE-2020-8794)

in OpenSMTPD's (and hence OpenBSD's) default configuration. Although
OpenSMTPD listens on localhost only, by default, it does accept mail
from local users and delivers it to remote servers. If such a remote
server is controlled by an attacker (either because it is malicious or
compromised, or because of a man-in-the-middle, DNS, or BGP attack --
SMTP is not TLS-encrypted by default), then the attacker can execute
arbitrary shell commands on the vulnerable OpenSMTPD installation.

OpenSMTPD server (which accepts external mail) and send a mail that
creates a bounce. Next, when OpenSMTPD connects back to their mail
server to deliver this bounce, the attacker can exploit OpenSMTPD's
client-side vulnerability. Last, for their shell commands to be
executed, the attacker must (to the best of our knowledge) crash
OpenSMTPD and wait until it is restarted (either manually by an
administrator, or automatically by a system update or reboot).

Description: Since the migration to xenocara there seems to be a bug with applications using GTK-2. From time to time there are crashes with assertion `!xcb_xlib_threads_sequence_lost’.

Looking into this a little bit more deep there are also other distributions affected and this is an upstream-bug. But the concrete situation is not that easy, while it could be also part of the library libX11 itself. Looking therefore here: https://bugs.launchpad.net/ubuntu/+source/pcmanfm/+bug/1782984

Affected are for example LXDE in general, icedove, iceweasel and many more!

Description: Problem with execution of “pacstrap /mnt base base-devel syslinux” from 0.3.1-chroot ISO-image with modified pacman.conf and mirrorlist for testing. There are errors for the packages “libxcrypt” and “man-pages” as both have “/usr/share/man/man3/crypt.3.gz” and “/usr”share/man/man3/crypt_r.3.gz” included.

Description: Configuration file “syslinux.cfg” under /boot/syslinux/ has to be adjusted. Problem with kernel-images loaded and the concurrent booting device is per default configured to /dev/sda3. Kernel-images are named as “linux-libre” not “linux-libre-lts”.

Description:

• replace deprecated GNU Bazaar to Brezy for Canis Major

Additional info:

• bzr 2.7.0-2
• GNU Bazaar will be unmaintained (for now, there are only bug fixes)
• GNU Bazaar only supports Python 2.
• Python 2.7 is the end of the Python 2 line of development. [0]
• There never will be an official Python 2.8 release.
• Or use Tauthon (fork of Python 2.7) as dependency.

Note: It needs a provide: bazaar and brezy

Steps to reproduce:

• broken package

Description:

• The Arch version of Erlang (headless version) from the snapshot used by Hyperbola comes with systemd support. Since Hyperbola follows the Init Freedom Campaign , systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)
* config and/or log files etc.

Repository      : community
Name            : erlang-nox
Version         : 19.3-3
Description     : General-purpose concurrent functional programming language developed by Ericsson (headless version)
Architecture    : x86_64
URL             : http://www.erlang.org/
Licenses        : Apache
Groups          : None
Provides        : None
Depends On      : ncurses  openssl
Optional Deps   : erlang-unixodbc: database support
                  java-environment: for Java support
                  lksctp-tools: for SCTP support
Conflicts With  : erlang
Replaces        : None
Download Size   : 39.01 MiB
Installed Size  : 106.73 MiB
Packager        : Jan de Groot <jgc@archlinux.org>
Build Date      : Fri 28 Apr 2017 08:44:33 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

/usr/lib/systemd/system/epmd.service is owned by erlang-nox 19.3-3
/usr/lib/systemd/system/epmd.socket is owned by erlang-nox 19.3-3

Steps to reproduce:

• Install package.

Description:

• The Arch version of Motion from the snapshot used by Hyperbola comes with systemd support. Since Hyperbola follows the Init Freedom Campaign , systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)
* config and/or log files etc.

Repository      : community
Name            : motion
Version         : 4.0.1-2
Description     : A software motion detector which grabs images from video4linux devices and/or from webcams
Architecture    : x86_64
URL             : http://www.lavrsen.dk/foswiki/bin/view/Motion/WebHome
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : libjpeg  v4l-utils  ffmpeg
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 235.61 KiB
Installed Size  : 923.00 KiB
Packager        : Sergej Pupykin <pupykin.s+arch@gmail.com>
Build Date      : Mon 14 Nov 2016 02:17:55 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

/usr/lib/systemd/system/motion.service is owned by motion 4.0.1-2

Steps to reproduce:

• Install package.

Description:

• The Arch version of tinc from the snapshot used by Hyperbola comes with systemd support. Since Hyperbola follows the Init Freedom Campaign , systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)
* config and/or log files etc.

Repository      : community
Name            : tinc
Version         : 1.0.31-2
Description     : VPN (Virtual Private Network) daemon
Architecture    : x86_64
URL             : http://www.tinc-vpn.org/
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : lzo  openssl  zlib
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 107.42 KiB
Installed Size  : 194.00 KiB
Packager        : Evangelos Foutras <evangelos@foutrelis.com>
Build Date      : Mon 13 Mar 2017 01:06:11 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

/usr/lib/systemd/system/tinc.service is owned by tinc 1.0.31-2
/usr/lib/systemd/system/tinc@.service is owned by tinc 1.0.31-2

Steps to reproduce:

• Install package.

Description:

Since Hyperbola follows the Init Freedom Campaign, systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)

community/backuppc 4.1.2-1 [installed]

   Enterprise-grade system for backing up Linux, Windows and MacOS PCs

* config and/or log files etc.

Additional info:

Steps to reproduce: install it

Since Hyperbola follows the Init Freedom Campaign, systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)

extra/gpsd 3.16-3 [installed]

   GPS daemon and library to support USB/serial GPS devices

* config and/or log files etc.

Additional info:

Steps to reproduce: install it

Description:

Hiawatha contains only systemd files.

It shall be removed and openrc shall be provided

Description:

• needs OpenRC init script

Additional info:

• onioncat 0.2.2.r578-1

Steps to reproduce:

• none

Description:

• needs OpenRC init script and contains systemd file

Additional info:

• umurmur 0.2.16_a-6

umurmur /usr/lib/systemd/system/umurmur.service

Steps to reproduce:

• none

Description:

• needs OpenRC init script and contains systemd files

Additional info:

• prosody 1:0.10.r7198+.2fd20f372cb1+-2

prosody /usr/lib/systemd/system/prosody.service
prosody /usr/lib/sysusers.d/prosody.conf
prosody /usr/lib/tmpfiles.d/prosody.conf

Steps to reproduce:

• none

Description:

• needs OpenRC init script and contains systemd files

Additional info:

• unrealircd 4.0.11-2

unrealircd /usr/lib/systemd/system/unrealircd.service
unrealircd /usr/lib/tmpfiles.d/unrealircd.conf

Steps to reproduce:

• none

Description:

• needs OpenRC init script and contains systemd file

Additional info:

• mcelog 1:148-1

mcelog /usr/lib/systemd/system/mcelog.service

Steps to reproduce:

• none

Description:

• needs OpenRC init script (bzr serve), like [git] (git-daemon) and [subversion] (svnserve)

Additional info:

• bzr 2.7.0-2

Note: needs a provide: bazaar

Steps to reproduce:

• none

Description:

• needs OpenRC init scripts (hg serve and chg server), like [git] (git-daemon) and [subversion] (svnserve)

Additional info:

• mercurial 4.2-1

Note: needs a provide: hg

Steps to reproduce:

• none

Description:

• Add new a Murmur package capable of working without a graphical user interface. It’s common on servers and embedded devices that requires only interfaces like network (eg. SSH) or serial port to handle services.

Additional info:

• based on murmur 1.2.19-5

Steps to reproduce:

• none

Description:

• Add an Asterisk package capable of working without a graphical user interface. It’s common on servers and embedded devices that requires only interfaces like network (eg. SSH) or serial port to handle services.

Additional info:

• based on asterisk 14.4.0-1

Steps to reproduce:

• none

Cannot mix incompatible Qt library (version 0×50800) with this library (version 0×50904)
Aborted

./Nextcloud-2.3.3-x86_64.AppImage: /usr/lib/libQt5Core.so.5: version `Qt_5.9’ not found (required by /tmp/.mount_NextclpprMnG/usr/bin/../lib/libqt5keychain.so.1

These two packages are directly affected by an older qt5...

Could you update all the qt packages to the LTS version available?

The Knock patches for linux-libre maintained by you at https://git.hyperbola.info:50100/kernels/knock.git/ have support up to linux-libre 4.13 only (and I think it didn’t work for it when I tried it, compilation failed) but from all of those supported versions, the newest maintained generation by the upstream is 4.9.x

However, since newer kernel generations might require reprogramming the patch, I want to request it only for the latest LTS generation which is 4.14. As you know, LTS software are supported for a long time, so it’s worth to make it for linux-libre 4.14.x

This might not be really important for Hyperbola in the short term, but you are the maintainers of the TCP Stealth implementation for Linux-libre and I and maybe other people would like to use it in their projects for newer versions.

Plus, it would be great since while 4.9 kernels can use the GRSec+Knock combination like linux-libre-lts-unofficial-grsec-knock, with support for 4.14 anyone would be able to use a combination of newer patches such as Linux-hardened+Knock (Linux-hardened supports 4.14 and 4.15 as of now) which is what I’d like to do.
https://github.com/copperhead/linux-hardened/releases

Description:
notmuch-mutt fails to compile without perl-mail-message which is missing in Hyperbola

Steps to reproduce:
Install notmuch-mutt and try `notmuch-mutt` at the command line. Then install `perl-mail-message` from Arch and try again.

The Arch version of “supervisor” from the snapshot used by Hyperbola comes with systemd support. Since Hyperbola follows the a global ruleset for INIT-freedom, systemd unit files removal is required and adding support for other init-systems (preferred OpenRC for now) to replace it.

Description:

cat msg | /usr/sbin/sendmail – sendmail: No such file or directorycannot create temporary file /var/spool/smtpd/offline/1572544775.XXXXIqNsFX

Additional info:
* package version: 6.4.2p1-1.hyperbola2.backports1

It is same problem as here:
https://github.com/OpenSMTPD/OpenSMTPD/issues/839

I could solve it with:

sudo chmod g+s /usr/sbin/smtpctl
sudo chmod g+s /usr/sbin/smtpctl

and then

sudo rc-service smtpd start

Even though I think I should not need to start it to use only sendmail.

(gst-plugin-scanner:17336): GStreamer-WARNING : Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstzbar.so’: libzbar.so.0: cannot open shared object file: No such file or directory
(gst-plugin-scanner:17336): GStreamer-WARNING : Failed to load plugin ‘/usr/lib/gstreamer-1.0/libgstfluidsynthmidi.so’: libfluidsynth.so.1: cannot open shared object file: No such file or directory

Repositorio : extra
Nombre : gstreamer
Versión : 1.12.0-1
Descripción : GStreamer open-source multimedia framework core library
Arquitectura : x86_64
URL : https://gstreamer.freedesktop.org/ Licencias : LGPL Grupos : Nada
Provee : Nada
Depende de : libxml2 glib2 libunwind libcap libelf
Dependencias opcionales : Nada
En conflicto con : Nada
Remplaza a : Nada
Tamaño de la descarga : 1897,45 KiB
Tamaño de la instalación : 17241,00 KiB
Encargado : Jan Alexander Steffens (heftig) jan.steffens@gmail.com Fecha de creación : jue 04 may 2017 14:13:05 -05
Validado por : Suma MD5 Suma SHA-256 Firma

Description:

From official PHP page, our php 7.1 is out of support and security

Our package :
https://www.hyperbola.info/packages/extra/x86_64/php/

PHP page :
https://www.php.net/supported-versions.php

Description:

• Option to add NextCloud/OwnCloud accounts in ‘Online Accounts’ section of System Settings not appearing.

Additional info:
* package version(s)

• 17.04.0-1

* config and/or log files etc.

• N/A

Steps to reproduce:

• Run application
• Go to ‘Online Accounts’ section of System Settings

Description:

• Clicking to add an Jabber Account opens a dialog with no fields to enter information.

Additional info:
* package version(s)

• 17.04.0-3.hyperbola1

* config and/or log files etc.

• N/A

Steps to reproduce:

• Run Application
• Clicking to add an Jabber Account

I probably should’ve mentioned this before, but if it is set to suspend when lid is closed, it should automatically lock. if the security option: lock screen with system is set to sleep is tweaked on it doesn’t lock always.

This is word for word what I wrote in the forums, but yeah... it is a problem say if someone wants to use your laptop without your permission and can do so.

But it is also a problem if you set it to lock instead because it is more prone to overheating when your not using it, and it doesn’t suspend quickly enough.

I have tried this many times and the same story can be told, again and again.

I think this issue should be considered high or critical merely because of the privacy risk if someone gets their hands on your laptop while its on. Even if you have been away... :/

I wonder if anyone else has this issue... well you guys will tell me I am sure. if critical doesn’t match what you think I am sure you will change it. ;)

Description:

I have tried all combinations, but despite “noauto” specified in /etc/fstab all devices get mounted at boot.

Who can help me, not to mount a device during boot?

Description:

glom cannot run without libgda, so it should depend on libgda package

/etc/ssl/certs/java/cacerts has 0 entries, resulting in ssl handshake errors in java applications.

Package versions:
* ca-certificates 20170307-1
* ca-certificates-utils 20170307-1

Description:

https://proj4.org/index.html

This package have valuable geodetic applications, and I intend to present Hyperbola GNU/Linux-libre soon in universities and schools in East Africa.

The coordinate system there is not WGS84 and this package only in new version is providing the conversion from East African geographic coordinates to WGS84, and will be very usable in many industrial and private applications.

would it be possible to make it use sudo instead?

From what I know, sudo is safer. Let me know if you agree this is a problem.

Description:

This bug only appears when logged in as root on terminal

# kf5-config --version
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
Qt: 5.8.0
KDE Frameworks: 5.33.0
kf5-config: 1.0

Additional info:

* package version(s)

$ pacman -Si kdelibs4support
Repositorio               : extra
Nombre                    : kdelibs4support
Versión                   : 5.33.0-1
Descripción               : Porting aid from KDELibs4
Arquitectura              : x86_64
URL                       : https://community.kde.org/Frameworks
Licencias                 : LGPL
Grupos                    : kf5-aids
Provee                    : Nada
Depende de                : kunitconversion  kitemmodels  kemoticons  kded  kparts
Dependencias opcionales   : Nada
En conflicto con          : kde4support
Remplaza a                : kde4support
Tamaño de la descarga     : 3,03 MiB
Tamaño de la instalación  : 17,36 MiB
Encargado                 : Felix Yan <felixonmars@archlinux.org>
Fecha de creación         : jue 13 abr 2017 14:29:47 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

Steps to reproduce:

- Install KDE plasma

Description:

org.freedesktop.DBus.Error.NameHasNoOwner: Could not get owner of name ‘org.bluez.obex’: no such name

Additional info:
* package version(s)

$ pacman -Si blueman
Repositorio               : community
Nombre                    : blueman
Versión                   : 2.0.4-3
Descripción               : GTK+ Bluetooth Manager
Arquitectura              : x86_64
URL                       : https://github.com/blueman-project/blueman
Licencias                 : GPL
Grupos                    : Nada
Provee                    : Nada
Depende de                : bluez  bluez-libs  gtk3  libnotify  python-cairo  python-dbus
                            python-gobject
Dependencias opcionales   : dnsmasq: Network Access Point (NAP) support
                            networkmanager: Dial Up Networking (DUN) and Personal Area
                            Networking (PAN) support
                            pulseaudio-bluetooth: audio devices support
En conflicto con          : Nada
Remplaza a                : Nada
Tamaño de la descarga     : 1814,18 KiB
Tamaño de la instalación  : 5345,00 KiB
Encargado                 : Felix Yan <felixonmars@archlinux.org>
Fecha de creación         : dom 25 dic 2016 12:00:42 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

* config and/or log files etc.

(blueman-applet | ccze -A):
- https://paste.debian.net/plain/1049476

(pkgfile -l blueman):
- https://paste.debian.net/plain/1049477

Steps to reproduce:

- Install blueman

(14/14) installing gitlab [##############################] 100%
/tmp/alpm_bCqhHf/.INSTALL: line 2: systemd-tmpfiles: command not found

Hello Hyperbola!

GPA gives out the following errors upon opening the app.

First:

```
The GPGME library returned an unexpected
error at confdialog.c:1459. The error was:

    Unsupported protocol

This is either an installation problem or a bug in GPA.
GPA will now try to recover from this error.
```

Second:

```
Fatal Error in GPGME library
(invoked from file options.c, line 302):

    Unsupported protocol

The application will be terminated

What can I do to overcome these errors?
```
As this issue makes gpa app completely unusable, I have set this bug report’s severity as high.

I also request the admin to set priority to high due to it’s severity.

Thank you!

Regards,
RG.

Description:

groff is typesetting system similar to TeX/LaTeX however, it is very small and very usable. It is not built properly with URW fonts, or such are missing, I cannot know all details. Overall groff package is basically somehow broken.

It shall depend on proper fonts, and such fonts should already be built, including their Unicode versions.

Package is only partially built.

https://aur.archlinux.org/packages/linux-mptcp/

Kernel Patch for 4.9 :
http://multipath-tcp.org/patches/mptcp-v4.9-c88d1d56809e.patch

Compile :
https://multipath-tcp.org/pmwiki.php/Users/DoItYourself

Current VLC version (3.0.4-3.hyperbola1.backports1) fails to play DVB stream using a RTL2832 usb dongle.

I start the playlist like this :

vlc channels.conf

but it returns the following error :

cache_block stream error: cannot pre fill buffer

Also, it asks the user to be in “video” group to access DVB device, this was not needed before with Hyperbola 0.2.9. User being in “wheel” was enough.
Anyway, even after adding my user to video group, it still fails with “cache_block stream error: cannot pre fill buffer”

This is not an issue with my DVB adapter or driver. rtl2832 is correctly loaded. And I can play the channels.conf playlist just fine with “mpv” or “mplayer”.
Also, the channels.conf used works just fine with a more recent version of VLC on an other system (Manjaro) so something is broken with the current VLC used.

Maybe a package bump would fix the issue.