Fedora People

Episode 283 – When vulnerability disclosure becomes dangerous

Posted by Josh Bressers on August 08, 2021 06:01 PM

Josh and Kurt talk about a very difficult disclosure problem. What happens when you have to report a vulnerability to an ethically questionable company? It’s less simple than it sounds, many of the choices could end up harming victims.

<audio class="wp-audio-shortcode" controls="controls" id="audio-2517-1" preload="none" style="width: 100%;"><source src="https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_283_When_vulnerability_disclosure_becomes_dangerous.mp3?_=1" type="audio/mpeg">https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_283_When_vulnerability_disclosure_becomes_dangerous.mp3</audio>

Show Notes

hash attack

Posted by Frank Ch. Eigler on August 07, 2021 01:33 PM

Apple has announced that it will start scanning your personal files on your devices for "Child Sexual Abuse Material", as identified by its cryptographic hash. It will apparently match hashes against a database of hash codes of "known" bad content distributed by some sort of well-meaning activist organization. A match will apparently trigger an automatic disabling of one's Apple account, just for starters.

Not creepy at all, right? Hey don't worry, it's not like political activists are trying to stop the spread of right wing hate memes via the exact same image-hash-code matching technology. Oh wait.

But it's okay, you're safe, you're a conformist, you would never snicker at that icky frog meme. Yet, yet, yet, don't be too comfortable. You might have enemies. Enemies who want you to lose your accounts, online presence, or even livelihood, and are too smart to simply send you one of these Verboten bits of digital horror straight.

What if an enemy were cunning enough to mount a cryptographic collision attack by crafting a brand new file so that its hash matches any on these designated bad-bad-bad lists? It just takes some time & possible brief rental of cloud computing resources. They can create an innocent looking get-rich-quick document, cute kitten video, or social issue awareness email. Something so good that you'd be tempted to save & forward it.

A few days later, Apple's (and other Big Tech's) surveillance software detects it as a hit, and automatically accuses you of abusing feelings or children or whatever. Accounts shut down, scarlet letter issued, literal police reporting can all come next. Heck, your friends and colleagues may also get flagged by that kitten video you shared, and be rather miffed at you. Depending on whether you can get through to a Big Tech support phone staff, you may or may not be able to clear your name.

Good luck! What could possibly go wrong!

Friday’s Fedora Facts: 2021-31

Posted by Fedora Community Blog on August 06, 2021 09:59 PM

Here’s your weekly Fedora report. Read what happened this week and what’s coming up. Your contributions are welcome (see the end of the post)!

Nest With Fedora continues tomorrow.

I have weekly office hours on Wednesdays in the morning and afternoon (US/Eastern time) in #fedora-meeting-1. Drop by if you have any questions or comments about the schedule, Changes, elections, or anything else. See the upcoming meetings for more information.

Announcements

CfPs

<figure class="wp-block-table">
ConferenceLocationDateCfP
SeaGLvirtual5–6 Novcloses 19 August
Linux Foundation Member SummitNapa, CA, US2–4 Novcloses 8 August
CentOS Dojovirtual7–8 Octcloses 6 September
Ohio Linux FestColumbus, OH, USearly Deccloses 1 October
</figure>

Help wanted

Prioritized Bugs

<figure class="wp-block-table">
Bug IDComponentStatus
1953675kf5-akonadi-serverNEW
1951492annobinASSIGNED
</figure>

Upcoming meetings

Releases

Fedora Linux 35

Schedule

  • 2021-08-10 — F35 branches from Rawhide, F36 development begins
  • 2021-08-10 — Change complete (testable) deadline
  • 2021-08-24 — Change complete (100%) deadline

For the full schedule, see the schedule website.

Changes

<figure class="wp-block-table">
ProposalTypeStatus
Switch to WirePlumber as the PipeWire session managerSelf-ContainedApproved
Use power-profiles-daemon on WorkstationSelf-ContainedFESCo #2655
Restart User Services after UpgradeSystem-WideFESCo #2657
</figure>

Changes approved, rejected, or withdrawn will be removed from this table the next week. See the ChangeSet page for a full list of approved changes.

Fedora Linux 36

Changes

<figure class="wp-block-table">
ProposalTypeStatus
libffi 3.4System-WideApproved
</figure>

Contributing

Have something you want included? You can file an issue or submit a pull request in the fedora-pgm/pgm_communication repo.

The post Friday’s Fedora Facts: 2021-31 appeared first on Fedora Community Blog.

Use OpenCV on Fedora Linux ‒ part 2

Posted by Fedora Magazine on August 06, 2021 08:00 AM

Welcome back to the OpenCV series where we explore how to make use of OpenCV on Fedora Linux. The first article covered the basic functions and use cases of OpenCV. In addition to that you learned about loading images, color mapping, and the difference between BGR and RGB color maps. You also learned how to separate and merge color channels and how to convert to different color spaces. This article will cover basic image manipulation and show you how to perform image transformations including:

  • Accessing individual image pixels
  • Modifying a range of image pixels
  • Cropping
  • Resizing
  • Flipping

Accessing individual pixels

import cv2
import numpy as np
import matplotlib.pyplot as plt

# Read image as gray scale.
img = cv2.imread(cv2.samples.findFile("gradient.png"),0)
# Set color map to gray scale for proper rendering.
plt.imshow(img, cmap='gray')
# Print img pixels as 2D Numpy Array
print(img)
# Show image with Matplotlib
plt.show()
<figure class="aligncenter size-large"></figure>

To access a pixel in a numpy matrix, you have to use matrix notation such as matrix[r,c], where the r is the row number and c is the column number. Also note that the matrix is 0-indexed. If you want to access the first pixel, you need to specify matrix[0,0]. The following example prints one black pixel from top-left and one white pixel from top-right-corner.

# print the first pixel
print(img[0,0])
# print the white pixel to the top right corner
print(img[0,299])

Modifying a range of image pixels

You can modify the values of pixels using the same notation described above.

gr_img = img.copy()

# Modify pixel one by one
#gr_img[20,20] = 200
#gr_img[20,21] = 200
#gr_img[20,22] = 200
#gr_img[20,23] = 200
#gr_img[20,24] = 200
# ...

# Modify pixel between 20-80 pixel range
gr_img[20:80,20:80] = 200

plt.imshow(gr_img, cmap='gray')
print(gr_img)
plt.show()
<figure class="aligncenter size-large"></figure>

Cropping images

Cropping an image is achieved by selecting a specific (pixel) region of the image.

import cv2 as cv
import matplotlib.pyplot as plt
img = cv.imread(cv.samples.findFile("starry_night.jpg"),cv.IMREAD_COLOR)
img_rgb = cv.cvtColor(img, cv.COLOR_BGR2RGB)
fig, (ax1, ax2) = plt.subplots(1,2)
ax1.imshow(img_rgb)
ax1.set_title('Before Crop')
ax2.imshow(img_rgb[200:400, 300:600])
ax2.set_title('After Crop')
plt.show()
<figure class="aligncenter size-large"></figure>

Resizing images

Syntax: dst = cv.resize( src, dsize[, dst[, fx[, fy[, interpolation]]]] )

The resize function resizes the src image down to or up to the specified size. The size and type are derived from the values of src, dsize,fx, and fy.

The resize function has two required arguments:

  • src: input image
  • dsize: output image size

Optional arguments that are often used include:

  • fx: The scale factor along the horizontal axis. When this is 0, the factor is computed as dsize.width/src.cols.
  • fy: The scale factor along the vertical axis. When this is 0, the factor is computed as dsize.height/src.rows.
import cv2 as cv
import matplotlib.pyplot as plt

img = cv.imread(cv.samples.findFile("starry_night.jpg"), cv.IMREAD_COLOR)
img_rgb = cv.cvtColor(img, cv.COLOR_BGR2RGB)

plt.figure(figsize=[18, 5])
plt.subplot(1, 3, 1)  # row 1, column 3, count 1

cropped_region = img_rgb[200:400, 300:600]
resized_img_5x = cv.resize(cropped_region, None, fx=5, fy=5)
plt.imshow(resized_img_5x)
plt.title("Resize Cropped Image with Scale 5X")

width = 200
height = 300
dimension = (width, height)
resized_img = cv.resize(img_rgb, dsize=dimension, interpolation=cv.INTER_AREA)

plt.subplot(1, 3, 2)
plt.imshow(resized_img)
plt.title("Resize Image with Custom Size")

desired_width = 500
aspect_ratio = desired_width / img_rgb.shape[1]
desired_height = int(resized_img.shape[0] * aspect_ratio)
dim = (desired_width, desired_height)
resized_cropped_region = cv.resize(img_rgb, dsize=dim, interpolation=cv.INTER_AREA)

plt.subplot(1, 3, 3)
plt.imshow(resized_cropped_region)
plt.title("Keep Aspect Ratio - Resize Image")
plt.show()
<figure class="wp-block-image size-large"></figure>

Flipping images

Syntax: dst = cv.flip( src, flipCode )

  • dst: output array of the same size and type as src.

The flip function flips the array in one of three different ways.

The flip function has two required arguments:

  • src: the input image
  • flipCode: a flag to specify how to flip the image
    • Use 0 to flip the image on the x-axis.
    • Use a positive value (for example, 1) to flip the image on the y-axis.
    • Use a negative value (for example, -1) to flip the image on both axes.
import cv2 as cv
import matplotlib.pyplot as plt
img = cv.imread(cv.samples.findFile("starry_night.jpg"),cv.IMREAD_COLOR)
img_rgb = cv.cvtColor(img, cv.COLOR_BGR2RGB)

img_rgb_flipped_horz = cv.flip(img_rgb, 1)
img_rgb_flipped_vert = cv.flip(img_rgb, 0)
img_rgb_flipped_both = cv.flip(img_rgb, -1)

plt.figure(figsize=[18,5])
plt.subplot(141);plt.imshow(img_rgb_flipped_horz);plt.title("Horizontal Flip");
plt.subplot(142);plt.imshow(img_rgb_flipped_vert);plt.title("Vertical Flip");
plt.subplot(143);plt.imshow(img_rgb_flipped_both);plt.title("Both Flipped");
plt.subplot(144);plt.imshow(img_rgb);plt.title("Original");
plt.show()
<figure class="wp-block-image size-large"></figure>

Further information

More details about OpenCV are available in the documentation.

Thank you.

power-profiles-daemon: Follow-up

Posted by Bastien Nocera on August 05, 2021 02:50 PM

Just about a year after the original announcement, I think it's time to see the progress on power-profiles-daemon.

Note that I would still recommend you read the up-to-date project README if you have questions about why this project was necessary, and why a new project was started rather than building on an existing one.

 The project was born out of the need to make a firmware feature available to end-users for a number of lines of Lenovo laptops for them to be fully usable on Fedora. For that, I worked with Mark Pearson from Lenovo, who wrote the initial kernel support for the feature and served as our link to the Lenovo firmware team, and Hans de Goede, who worked on making the kernel interfaces more generic.

More generic, but in a good way

 With the initial kernel support written for (select) Lenovo laptops, Hans implemented a more generic interface called platform_profile. This interface is now the one that power-profiles-daemon will integrate with, and means that it also supports a number of Microsoft Surface, HP, Lenovo's own Ideapad laptops, and maybe Razer laptops soon.

 The next item to make more generic is Lenovo's "lap detection" which still relies on a custom driver interface. This should be soon transformed into a generic proximity sensor, which will mean I get to work some more on iio-sensor-proxy.

Working those interactions

 power-profiles-dameon landed in a number of distributions, sometimes enabled by default, sometimes not enabled by default (sigh, the less said about that the better), which fortunately meant that we had some early feedback available.

 The goal was always to have the user in control, but we still needed to think carefully about how the UI would look and how users would interact with it when a profile was temporarily unavailable, or the system started a "power saver" mode because battery was running out.

 The latter is something that David Redondo's work on the "HoldProfile" API made possible. Software can programmatically switch to the power-saver or performance profile for the duration of a command. This is useful to switch to the Performance profile when running a compilation (eg. powerprofilesctl jhbuild --no-interact build gnome-shell), or for gnome-settings-daemon to set the power-saver profile when low on battery.

 The aforementioned David Redondo and Kai Uwe Broulik also worked on the KDE interface to power-profiles-daemon, as Florian Müllner implemented the gnome-shell equivalent.

Promised by me, delivered by somebody else :)

 I took this opportunity to update the Power panel in Settings, which shows off the temporary switch to the performance mode, and the setting to automatically switch to power-saver when low on battery.

Low-Power, everywhere

 Talking of which, while it's important for the system to know that they're targetting a power saving behaviour, it's also pretty useful for applications to try and behave better.
 
 Maybe you've already integrated with "low memory" events using GLib, but thanks to Patrick Griffis you can be an event better ecosystem citizen and monitor whether the system is in "Power Saver" mode and adjust your application's behaviour.
 
 This feature will be available in GLib 2.70 along with documentation of useful steps to take. GNOME Software will already be using this functionality to avoid large automated downloads when energy saving is needed.

Availability

 The majority of the above features are available in the GNOME 41 development branches and should get to your favourite GNOME-friendly distribution for their next release, such as Fedora 35.

New badge: Fedora Week of Diversity !

Posted by Fedora Badges on August 05, 2021 10:59 AM
Fedora Week of DiversityYou contributed or participated in the Fedora Week of Diversity 2021!

Would you use this as your homepage?

Posted by Fedora Community Blog on August 05, 2021 08:00 AM

The Design team have been working to revamp start.fedoraproject.org which is the default homepage in a fresh Fedora Linux installation. We are super excited to show you the progress we have made so far.

Thanks to the amazing feedback we got from you, we have further improved the first mock-up:

  • Moved a bunch of things around.
  • Reduced unused space.
  • Added a search engine field that follows the default search engine in your browser settings.

Tell us what you think. Would you use this as your homepage now that it has a search engine field? How do you think we can further improve it?

<figure class="wp-block-image size-large"></figure>

OR

<figure class="wp-block-image size-large"></figure>

In you are interested in seeing more, check out the draft on Figma.

The post Would you use this as your homepage? appeared first on Fedora Community Blog.

Email tròn 50 tuổi

Posted by Truong Anh Tuan on August 04, 2021 11:28 PM
Có thể bạn chưa biết, phần mềm Email đầu tiên được Ray Samuel Tomlinson, sinh ngày 23/4/1941 mất ngày 5/3/2016, một lập trình viên máy tính tiên phong người Mỹ, phát triển chạy trên mạng ARPNET, tiền thân của Internet ngày nay, vào năm 1971. Đó là hệ thống đầu tiên cho phép gửi thưContinue reading "Email tròn 50 tuổi <3"

Special thanks to Nest Platinum Sponsor Amazon AWS

Posted by Fedora Community Blog on August 04, 2021 04:47 PM

It takes a lot of work to put on our annual contributor conference. Special thanks this year to Amazon AWS for their platinum sponsorship! We really appreciate their generosity, as well as the support and resources for Fedora Cloud, Fedora CoreOS, and more.

The post Special thanks to Nest Platinum Sponsor Amazon AWS appeared first on Fedora Community Blog.

New badge: Museum Visitor !

Posted by Fedora Badges on August 04, 2021 02:41 PM
Museum Visitor You visited the 8-bit Fedora Museum at Nest 2021

crocus misrendering of the week

Posted by Dave Airlie on August 04, 2021 08:04 AM

 I've been chasing a crocus misrendering bug show in a qt trace.


The bottom image is crocus vs 965 on top. This only happened on Gen4->5, so Ironlake and GM45 were my test machines. I burned a lot of time trying to work this out. I trimmed the traces down, dumped a stupendous amount of batchbuffers, turned off UBO push constants, dump all the index and vertex buffers, tried some RGBx changes, but nothing was rushing to hit me, except that the vertex shaders produced were different.

However they were different for many reasons, due to the optimization pipelines the mesa state tracker runs vs the 965 driver. Inputs and UBO loads were in different places so there was a lot of noise in the shaders.

I ported the trace to a piglit GL application so I could easier hack on the shaders and GL, with that I trimmed it down even further (even if I did burn some time on a misplace */+ typo).

Using the ported app, I removed all uniform buffer loads and then split the vertex shader in half (it was quite large, but had two chunks). I finally then could spot the difference in the NIR shaders.

What stood out was the 965 shader had an if which the crocus shader has converted to a bcsel. This is part of peephole optimization and the mesa/st calls it, and sure enough removing that call fixed the rendering, but why? it is a valid optimization.

In a parallel thread on another part of the planet, Ian Romanick filed a MR to mesa https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/12191 fixing a bug in the gen4/5 fs backend with conditional selects. This was something he noticed while debugging elsewhere. However his fix was for the fragment shader backend, and my bug was in the vec4 vertex shader backend. I tracked down where the same changes were needed in the vec4 backend and tested a fix on top of his branch, and the misrendering disappeared.

It's a strange coincidence we both started hitting the same bug in different backends in the same week via different tests, but he's definitely saved me a lot of pain in working this out! Hopefully we can combine them and get it merged this week.

Also thanks to Angelo on the initial MR for testing crocus with some real workloads.

Apps for daily needs part 3: image editors

Posted by Fedora Magazine on August 04, 2021 08:00 AM

Image editors are applications that are liked and needed by many people, from professional designers, students, or for those who have certain hobbies. Especially in this digital era, more and more people need image editors for various reasons. This article will introduce some of the open source image editors that you can use on Fedora Linux. You may need to install the software mentioned. If you are unfamiliar with how to add software packages in Fedora Linux, see my earlier article Things to do after installing Fedora 34 Workstation. Here is a list of a few apps for daily needs in the image editors category.

GIMP

GIMP (GNU Image Manipulation Program) is a raster graphics editor used for photo retouching, image composition, and image authoring. It has almost the same functionality as Adobe Photoshop. You can use GIMP to do a lot of the things you can do with Photoshop. Because of that, GIMP has become the most popular application as an open source alternative to Adobe Photoshop.

GIMP has a lot of features for manipulating images, especially for raster images. You can fix or change the color of your photos using GIMP. You can select a part of the image, crop it, and then merge it with other pieces of the image. GIMP also has many effects that you can apply to your images, including blur, shadow, noise, etc. Many people use GIMP to repair damaged photos, improve image quality, crop unwanted parts of images, create posters and various graphic design works, and much more. Moreover you can also add plugins and scripts in GIMP, making it even more fully featured.

<figure class="wp-block-image size-large">GIMP as image editors for daily needs</figure>

More information is available at this link: https://www.gimp.org/


Inkscape

Inkscape is a popular open source application used to create and edit vector graphics. It is a feature-rich vector graphics editor which makes it competitive with other similar proprietary applications, such as Adobe Illustrator and Corel Draw. Because of that, many professional illustrators use it to create vector-based artwork.

You can use Inkscape for making artistic and technical illustrations, such as logos, diagrams, icons, desktop wallpapers, flowcharts, cartoons, and much more. Moreover, Inkscape can handle various graphic file formats. In addition, you can also add add-ons to make your work easier.

<figure class="wp-block-image size-large">Inkscape as image editors for daily needs</figure>

More information is available at this link: https://inkscape.org/


Krita

Krita looks like GIMP or Inkscape at first glance. But actually it is an application that is quite different, although it has some similar functions. Krita is an application for creating digital paintings like those made by artists. You can use Krita for making concept art, illustration, comics, texture, and matte paintings.

Krita has over 100 professionally made brushes that come preloaded. It also has a brush stabilizer feature with 3 different ways to smooth and stabilize your brush strokes. Moreover, you can customize your brushes with over 9 unique brush engines. Krita is the right application for those of you who like digital painting activities.

<figure class="wp-block-image size-large">Krita as image editors for daily needs</figure>

More information is available at this link: https://krita.org/en/


darktable

darktable is perfect for photographers or for those who want to improve the quality of their photos. darktable focuses more on image editing specifically on non-destructive post-production of raw images. Therefore, it provides professional color management that supports automatic display profile detection. In addition, you can also use darktable to handle multiple images with filtering and sorting features. So you can search your collections by tags, rating, color labels, and many more. It can import various image formats, such as JPEG, CR2, NEF, HDR, PFM, RAF, etc.

<figure class="wp-block-image size-large">Darktable as image editors for daily needs</figure>

More information is available at this link: https://www.darktable.org/


Conclusion

This article presented four image editors as apps for your daily needs that you can use on Fedora Linux. Each application represents a sub-category of image editor applications. Actually there are many other image editors that you can use in Fedora Linux. You can also use RawTherapee or Photivo as a dartkable alternative. In addition there is Pinta as an alternative to GIMP, and MyPaint as an alternative to Krita. Hopefully this article can help you to choose the right image editors. If you have experience in using these applications, please share your experience in the comments.

Community Blog monthly summary: July 2021

Posted by Fedora Community Blog on August 04, 2021 08:00 AM
Community Blog update

This is the latest in our monthly series summarizing the past month on the Community Blog. Please leave a comment below to let me know what you think.

Stats

In July, we published 12 posts. The site had 2,979 visits from 1,931 unique viewers. 150 visits came from Twitter, while 53 came from Distrowatch, 35 came from Fedora Planet, and 32 came from Instapaper.

The most read post last month was Fedora Linux 35 development schedule, with 891 views. The most read post that was published last month was Update: Nest With Fedora CfP & Registration open, with 119 views.

Badges

Last month, no one earned new badges. Write more; get badges!

Your content here!

The Community Blog is the place to publish community-facing updates on what you’re working on in Fedora. The process is easy, so submit early and submit often.

The post Community Blog monthly summary: July 2021 appeared first on Fedora Community Blog.

Cockpit 250

Posted by Cockpit Project on August 04, 2021 12:00 AM

Cockpit is the modern Linux admin interface. We release regularly.

Here are the release notes from Cockpit 250 and cockpit-machines 249:

Shell: Improve admin switcher and session menu

Cockpit has a “limited access” mode with lowered privileges, where browsing generally works, but changing things that require administration rights generally does not.

If someone is stuck in “limited access” mode without knowing how to switch, it would appear that Cockpit is “broken” or cannot perform tasks it should be able to do. To make it more obvious how to switch modes, Cockpit now has several “eye-catching” changes to make switching easier to notice. These changes are in the shell, which is visible on every page within Cockpit, and the overview page’s alert.

  • On the overview alert, a warning color has been used to draw attention
  • A lock icon has been used in both the overview alert and the shell privilege escalation icon
  • The shell’s escalation action now resembles a button

panel-or8

All of the above changes only affect “limited access” mode. Normal administration mode looks the same as before.

The menu on the top right is now called “Session” instead of showing an user icon. This clarifies that the settings in that menu apply to remote hosts as well, which possibly run as a different user.

Thanks to Verhoeckx for discussing and suggesting these design changes!

Software Updates: Introduce basic kpatch support

Some operating systems (Red Hat Enterprise Linux for now) support live kernel patching (“kpatch”). The Software updates page shows if kpatch is supported and if there are any patches active. You can enable kpatches for the currently running kernel and subscribe to patches for future kernel versions.

kpatch-or8

Machines: Migration of a virtual machine

The Machines page can now migrate a VM to a different machine. It supports live and temporary migration. Commonly, the VM’s storage is on shared storage, which avoids having to copy the data to the remote machine and makes the migration process much faster and more robust. As it is not possible to automatically detect whether the storage is shared, the user has to explicitly tell whether the storage must be copied.

mig2-or8 mig1-or8

Try it out

Cockpit 250 and cockpit-machines 249 are available now:

My Google Pixel C: the end of an era

Posted by Peter Czanik on August 03, 2021 06:53 AM
I got my Google Pixel C tablet in early 2016, well over five years ago. I use it ever since almost every day. A big part of it is that I also have the Pixel C keyboard accessory. I prefer touch typing and funnily enough that does not work on a touch screen. It needs a real keyboard. And that keyboard died today. My Pixel C can still recognize the attached keyboard, but it does not work any more.

Sporadic Authentication Issues

Posted by Fedora Infrastructure Status on August 02, 2021 07:00 PM

Sporadically, a process on our authentication servers fails, causing user logins to fedora applications to fail until restarted. We are investigating this issue. Please see the ticket below and in particular: https://pagure.io/fedora-infrastructure/issue/9990#comment-745972 Sorry for any trouble.

New badge: Nest Attendee 2021 !

Posted by Fedora Badges on August 02, 2021 06:15 PM
Nest Attendee 2021You attended Nest with Fedora 2021!

Nest with Fedora: Thanks to our Sponsors!

Posted by Fedora Community Blog on August 02, 2021 05:22 PM
Eggs in a bird nest

Fedora’s annual contributor conference Nest with Fedora is this week: August 5th–7th. Even with the virtual format, we are so excited to see everyone together! Free registration for Nest with Fedora is still open and you can check out the schedule in the wiki. Nest with Fedora is made possible by funding from our sponsors. Their assistance brings us everything from the conference platform to promotion to swag.

A big “Thank You!” goes to our sponsoring organizations for their support bringing Fedora Friends together in 2021. Thank you Red Hat, AWS, Lenovo, AlmaLinux, openSUSE, GitLab, Datto, Shells, and It’s FOSS. <meta content="text/html; charset=utf-8" http-equiv="content-type"/>We welcome attendees to join us on Thursday August 5th at 16:30-17:30 UTC for a social session with Nest with Fedora’s sponsors.

<figure class="wp-block-gallery columns-2"></figure> <figure class="wp-block-gallery columns-2"></figure> <figure class="wp-block-gallery columns-1"></figure> <figure class="wp-block-gallery columns-3"></figure> <figure class="wp-block-gallery columns-2"></figure>

The post Nest with Fedora: Thanks to our Sponsors! appeared first on Fedora Community Blog.

Next Open NeuroFedora meeting: 02 August 1300 UTC

Posted by The NeuroFedora Blog on August 02, 2021 08:08 AM
Photo by William White on Unsplash

Photo by William White on Unsplash.


Please join us at the next regular Open NeuroFedora team meeting on Monday 02 August at 1300UTC in #fedora-neuro on IRC (Libera.chat). The meeting is a public meeting, and open for everyone to attend. You can join us over:

You can use this link to convert the meeting time to your local time. Or, you can also use this command in the terminal:

$ date --date='TZ="UTC" 1300 today'

The meeting will be chaired by @ankursinha. The agenda for the meeting is:

We hope to see you there!

Use OpenCV on Fedora Linux ‒ part 1

Posted by Fedora Magazine on August 02, 2021 08:00 AM

The technology world changes daily and the demands for computer vision, artificial intelligence, and machine learning are increasing. The technology that allows computers and mobile phones to see their surroundings is called computer vision. Work on re-creating a human eye started in the 50s. Since then, computer vision technology has come a long way. Computer vision has already made its way to our mobile phones via different applications. This article will introduce OpenCV on Fedora Linux.

What is OpenCV?

OpenCV (Open Source Computer Vision Library) is an open-source computer vision and machine learning software library. OpenCV was built to provide a common infrastructure for computer vision applications and to accelerate the use of machine perception in the commercial products. It has more than 2500 optimized algorithms, which includes a comprehensive set of both classic and state-of-the-art computer vision and machine learning algorithms. These algorithms can be used to detect and recognize faces, identify objects, classify human actions in videos and establish markers to overlay it with augmented reality and much more.

opencv.org – about

Install OpenCV on Fedora Linux

To get started with OpenCV, install it from the Fedora Linux repositories.

$ sudo dnf install opencv opencv-contrib opencv-doc python3-opencv python3-matplotlib python3-numpy

Note: On Fedora Silverblue or CoreOs, Python 3.9 is part of the core commit. Layer OpenCV and required tools with: rpm-ostree install opencv opencv-doc python3-opencv python3-matplotlib python3-numpy.

Next, enter the following commands in a terminal to verify that OpenCV is installed (user input shown in bold).

$ python
Python 3.9.6 (default, Jul 16 2021, 00:00:00) 
[GCC 11.1.1 20210531 (Red Hat 11.1.1-3)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import cv2 as cv
>>> print( cv.__version__ )
4.5.2
>>> exit()

The current OpenCV version should be displayed when you enter the print command as shown above. This indicates that OpenCV and the Python-OpenCV libraries have been installed successfully.

Additionally, if you want to take notes and write code with Jupyter Notebook and learn more about data science tools, check out the earlier Fedora Magazine article: Jupyter and Data Science in Fedora.

Get started with OpenCV

After installation is complete, load a sample image using Python and the OpenCV libraries (press the S key to save a copy of the image in png format and finish the program):

Contents of starry_night.py:

import cv2 as cv
import sys
img = cv.imread(cv.samples.findFile("starry_night.jpg"))
if img is None:
    sys.exit("Could not read the image.")
cv.imshow("Display window", img)
k = cv.waitKey(0)
if k == ord("s"):
    cv.imwrite("starry_night.png", img)
$ python starry_night.py
<figure class="aligncenter size-large is-resized">The Starry Night - Vincent van Gogh</figure>

Gray-scale the image by adding the parameter 0 to the cv.imread function as shown below.

img = cv.imread(cv.samples.findFile("starry_night.jpg"),0)
<figure class="aligncenter size-large is-resized"></figure>

These are some alternative values that can be used for the second parameter of the cv.imread function.

  • cv2.IMREAD_GRAYSCALE or 0: Load the image in grayscale mode.
  • cv2.IMREAD_COLOR or 1: Load the image in color mode. Any transparency in the image will be removed. This is the default.
  • cv2.IMREAD_UNCHANGED or -1: Load the image unaltered; including alpha channel.

Display image attributes using OpenCV

Image attributes include the number of rows, columns, and channels; the type of image data; the number of pixels; etc. Suppose you wanted to access the image’s shape and its datatype. This is how you would do it:

import cv2 as cv

img = cv.imread(cv.samples.findFile("starry_night.jpg"))
print("Image size is", img.shape)
print("Data type of image is", img.dtype)
Image size is (600, 752, 3)
Data type of image is uint8
print(f"Image 2D numpy array \n {img}")
Image 2D numpy array 
 [[[0 0 0]
  [0 0 0]
  [0 0 0]
  ...
  [0 0 0]
  [0 0 0]
  [0 0 0]]

 [[0 0 0]
  [0 0 0]
  [0 0 0]
  ...
  • img.shape: return a tuple of the number of rows, columns, and channels (if it is a color image)
  • img.dtype: return the datatype of the image

Next display image with Matplotlib:

import cv2 as cv
import matplotlib.pyplot as plt
img = cv.imread(cv.samples.findFile("starry_night.jpg"),0)
plt.imshow(img)
plt.show()
<figure class="aligncenter size-large is-resized"></figure>

What happened?

The image was read in as a gray-scale image, however it won’t necessarily display in gray-scale when using Matplotlib’s imshow fucntion. This is because the imshow function uses a different color map by default. To specify that a gray-scale color map should be used, set the second parameter of the imshow function to cmap=’gray’ as shown below.

plt.imshow(img,cmap='gray')
<figure class="aligncenter size-large is-resized"></figure>

This problem is also going to happen when opening a picture in color mode because Matplotlib expects the image in RGB (red, green, blue) format whereas OpenCV stores images in BGR (blue, green, red) format. For correct display, you need to reverse the channels of the BGR image.

import cv2 as cv
import matplotlib.pyplot as plt
img = cv.imread(cv.samples.findFile("starry_night.jpg"),cv.IMREAD_COLOR)
fig, (ax1, ax2) = plt.subplots(1,2)
ax1.imshow(img)
ax1.set_title('BGR Colormap')
ax2.imshow(img[:,:,::-1])
ax2.set_title('Reversed BGR Colormap(RGB)')
plt.show()
<figure class="aligncenter size-large"></figure>

Splitting and merging color channels

import cv2 as cv
import matplotlib.pyplot as plt

img = cv.imread(cv.samples.findFile("starry_night.jpg"),cv.IMREAD_COLOR)
b,g,r = cv.split(img)

fig,ax = plt.subplots(2,2)

ax[0,0].imshow(r,cmap='gray')
ax[0,0].set_title("Red Channel");
ax[0,1].imshow(g,cmap='gray')
ax[0,1].set_title("Green Channel");
ax[1,0].imshow(b,cmap='gray')
ax[1,0].set_title("Blue Channel");

# Merge the individual channels into a BGR image
imgMerged = cv.merge((b,g,r))
# Show the merged output
ax[1,1].imshow(imgMerged[:,:,::-1])
ax[1,1].set_title("Merged Output");
plt.show()
<figure class="aligncenter size-large"></figure>
  • cv2.split: Divide a multi-channel array into several single-channel arrays.
  • cv2.merge: Merge several arrays to make a single multi-channel array. All the input matrices must have the same size.

Note: Images with more white have a higher density of color. Contrarily, images with more black have a lower density of color. In the above example the red color has the lowest density.

Converting to different color spaces

The cv2.cvtColor function converts an input image from one color space to another. When transforming between the RGB and BGR color spaces, the order of the channels should be specified explicitly (RGB2BGR or BGR2RGB). Note that the default color format in OpenCV is often referred to as RGB but it is actually BGR (the bytes are reversed). So the first byte in a standard (24-bit) color image will be an 8-bit blue component, the second byte will be green, and the third byte will be red. The fourth, fifth, and sixth bytes would then be the second pixel (blue, then green, then red), and so on.

import cv2 as cv
import matplotlib.pyplot as plt
img = cv.imread(cv.samples.findFile("starry_night.jpg"),cv.IMREAD_COLOR)
img_rgb = cv.cvtColor(img, cv.COLOR_BGR2RGB)
plt.imshow(img_rgb)
plt.show()
<figure class="aligncenter size-large is-resized"></figure>

Further information

More details on OpenCV are available in the online documentation.

Thank you.

Episode 282 – The security of Rust: who left all this awesome in here?

Posted by Josh Bressers on August 02, 2021 12:01 AM

Josh and Kurt talk about a story from Microsoft declaring Rust the future of safe programming, replacing C and C++. We discuss how tooling affects progress and why this isn’t always obvious when you’re in the middle of progress.

<audio class="wp-audio-shortcode" controls="controls" id="audio-2502-2" preload="none" style="width: 100%;"><source src="https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_282_The_security_of_Rust_who_left_all_this_awesome_in_here.mp3?_=2" type="audio/mpeg">https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_282_The_security_of_Rust_who_left_all_this_awesome_in_here.mp3</audio>

Show Notes

Friday’s Fedora Facts: 2021-30

Posted by Fedora Community Blog on July 30, 2021 07:28 PM

Here’s your weekly Fedora report. Read what happened this week and what’s coming up. Your contributions are welcome (see the end of the post)!

Nest With Fedora registration is open now. Join us August 5–7.

The Fedora Linux 35 mass rebuild has completed.

I have weekly office hours on Wednesdays in the morning and afternoon (US/Eastern time) in #fedora-meeting-1. Drop by if you have any questions or comments about the schedule, Changes, elections, or anything else. See the upcoming meetings for more information.

Announcements

CfPs

<figure class="wp-block-table">
ConferenceLocationDateCfP
SeaGLvirtual5–6 Novcloses 5 August
Linux Foundation Member SummitNapa, CA, US2–4 Novcloses 8 August
CentOS Dojovirtual7–8 Octcloses 6 September
Ohio Linux FestColumbus, OH, USearly Deccloses 1 October
</figure>

Help wanted

Prioritized Bugs

<figure class="wp-block-table">
Bug IDComponentStatus
1953675kf5-akonadi-serverNEW
1951492annobinASSIGNED
</figure>

Upcoming meetings

Releases

Fedora Linux 35

Schedule

  • 2021-08-10 — F35 branches from Rawhide, F36 development begins
  • 2021-08-10 — Change complete (testable) deadline
  • 2021-08-24 — Change complete (100%) deadline

For the full schedule, see the schedule website.

Changes

<figure class="wp-block-table">
ProposalTypeStatus
tzdata-minimalSelf-ContainedWithdrawn
libffi 3.4System-WideDeferred to F36
Enhanced Inscript as default Indic IMSelf-ContainedApproved
Switch to WirePlumber as the PipeWire session managerSelf-ContainedFESCo #2653
Use power-profiles-daemon on WorkstationSelf-ContainedFESCo #2655
Restart User Services after UpgradeSystem-WideAnnounced
</figure>

Changes approved, rejected, or withdrawn will be removed from this table the next week. See the ChangeSet page for a full list of approved changes.

Fedora Linux 36

Changes

<figure class="wp-block-table">
ProposalTypeStatus
libffi 3.4System-WideFESCo #2650
</figure>

Contributing

Have something you want included? You can file an issue or submit a pull request in the fedora-pgm/pgm_communication repo.

The post Friday’s Fedora Facts: 2021-30 appeared first on Fedora Community Blog.

Makeshift Kubernetes external load balancer with haproxy

Posted by Tomasz Torcz on July 30, 2021 12:56 PM

Some time ago I've replaced Google Analytics with Plausible. It works great, except for one tiny thing. The map of visitors was empty. Due to various layers of Network Adress Translations in k3s networking setup, the original client IP address information was not reaching analytics engine.

There are solutions – there is a PROXY Protocol exactly for that case. And Traefik, which handles ingress in k3s, supports PROXY. Only a bit of gymnastic was needed.

Legacy IPv4 traffic entry point to my bare-metal cluster has a form of a small in-the-cloud virtual machine. It routes incoming TCP/443 traffic over the VPN into the cluster. The VM itself is not a part of kubernetes setup – I cannot run any pods on it. I've decided to use Ansible to configure it.

The outcome lives in k8s-haproxy-external-lb and gives me following map:

/dżogstaff/2021.07.30-plausible-map.png

(greetings Australia, have you found information about the red LED on Sonoff?)

There are few moving parts, but with Python, Kubernetes and Ansible, the result is suprisingly simple:

  • there's a persistent pod running on the k8s cluster, watching EndPoints exposed by Traefik. When a change occurs (traefik pod restart, replica count modification, etc.) – ansible playbook is triggered. This pod may be seen as a k8s controller.

  • ansible playbook collects Traefik pod's IP addresses and ports. JSON parsing in ansible is a bit suboptimal: … | first | first | first looks bad but works.

  • still using ansible, haproxy configuration file is created, put on the edge nodes, and the service is restarted. I've selected haproxy because:

  • haproxy passes received traffic directly to Traefik. This happens at the TCP level. TLS is terminated at Traefik, and certificates do not leave kubernetes cluster.

Some minimal preparations were needed. Communication between edge node and kubernetes pod network had to be established. This was done in an instant, thanks to Wireguard. SSH keypair for ansible had to be put in a k8s Secret and distributed among edge nodes. Finally, small fix was needed in ansible itself: local connection plugin was not happy when run in a container, as random user without an entry in /etc/passwd.

Traefik had to be configured to trust PROXY protocol information and generate X-Forwarded-For headers. Plausible utilized information in those headers without additional tinkering.

Configuration details are described at https://github.com/zdzichu/k8s-haproxy-external-lb.

4 cool new projects to try in Copr from July 2021

Posted by Fedora Magazine on July 30, 2021 08:00 AM

Copr is a collection of personal repositories for software that isn’t carried in Fedora Linux. Some software doesn’t conform to standards that allow easy packaging. Or it may not meet other Fedora Linux standards, despite being free and open-source. Copr can offer these projects outside the Fedora Linux set of packages. Software in Copr isn’t supported by Fedora infrastructure or signed by the project. However, it can be a neat way to try new or experimental software.

This article presents a few new and interesting projects in Copr. If you’re new to using Copr, see the Copr User Documentation for how to get started.

Wike

Wike is a Wikipedia reader for the GNOME Desktop with search integration in the GNOME Shell. It provides distraction-free access to the online encyclopedia. The interface is minimalistic but it supports switching an article between multiple languages, bookmarks, article table of contents, dark mode, and more.

<figure class="wp-block-image size-large"></figure>

Installation instructions

The repo currently provides Wike for Fedora 33, 34, and Fedora Rawhide. To install it, use these commands:

sudo dnf copr enable xfgusta/wike
sudo dnf install wike

DroidCam

We are living through confusing times, being isolated at our homes, and the majority of our interactions with friends and coworkers take place on some video conference platform. Don’t waste your money on an overpriced webcam if you carry one in your pocket already. DroidCam lets you pair your phone with a computer and use it as a dedicated webcam. The connection made through a USB cable or over WiFi. DroidCam provides remote control of the camera and allows zooming, using autofocus, toggling the LED light, and other convenient features.

<figure class="wp-block-image size-large"></figure>

Installation instructions

The repo currently provides DroidCam for Fedora 33 and 34. Before installing it, please update your system and reboot, or make sure you are running the latest kernel version and have an appropriate version of kernel-headers installed.

sudo dnf update
sudo reboot

Droidcam depends on v4l2loopback which must be installed manually from the RPM Fusion Free repository.

sudo dnf install https://download1.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm
sudo dnf install v4l2loopback
sudo modprobe v4l2loopback

Now install the droidcam package:

sudo dnf copr enable meeuw/droidcam
sudo dnf install droidcam

Nyxt

Nyxt is a keyboard-oriented, infinitely extensible web browser designed for power users. It was heavily inspired by Emacs and as such is implemented and configured in Common Lisp providing familiar key-bindings (EmacsviCUA).

Other killer features that cannot be missed are a built-in REPL, tree historybuffers instead of tabs, and so much more.

Nyxt is web engine agnostic so don’t worry about pages rendering in unexpected ways.

<figure class="wp-block-image size-large"></figure>

Installation instructions

The repo currently provides Nyxt for Fedora 33, 34, and Fedora Rawhide. To install it, use these commands:

sudo dnf copr enable teervo/nyxt
sudo dnf install nyxt

Bottom

Bottom is a system monitor with a customizable interface and multitude of features, It took inspiration from gtopgotop, and htop. As such, it supports processes monitoring, CPURAM, and network usage monitoring. Besides those, it also provides more exotic widgets such as disk capacity usage, temperature sensors, and battery usage.

Bottom utilizes the screen estate very efficiently thanks to the customizable layout of widgets as well as the possibility to focus on just one widget and maximizing it.

<figure class="wp-block-image size-large"></figure>

Installation instructions

The repo currently provides Bottom for Fedora 33, 34, and Fedora Rawhide. It is also available for EPEL 7 and 8. To install it, use these commands:

sudo dnf copr enable opuk/bottom
sudo dnf install bottom

Use btm command to run the program.

PHP version 7.4.22 and 8.0.9

Posted by Remi Collet on July 30, 2021 05:31 AM

RPMs of PHP version 8.0.9 are available in remi-php80 repository for Fedora 32-34 and Enterprise Linux (RHEL, CentOS).

RPMs of PHP version 7.4.22 are available in remi repository for Fedora 32-34 and remi-php74 repository Enterprise Linux (RHEL, CentOS).

emblem-notice-24.pngNo security fix this month, so no update for version 7.3.29.

emblem-important-2-24.pngPHP version 7.2 have reached its end of life and is no longer maintained by the PHP project.

These versions are also available as Software Collections in the remi-safe repository and as module for Fedora 32-34 and EL-8.

Version announcements:

emblem-notice-24.pngInstallation: use the Configuration Wizard and choose your version and installation mode.

Replacement of default PHP by version 8.0 installation (simplest):

yum-config-manager --enable remi-php80
yum update

or, the modular way (Fedora and EL 8):

dnf module reset php
dnf module enable php:remi-8.0
dnf update php\*

Parallel installation of version 8.0 as Software Collection

yum install php80

Replacement of default PHP by version 7.4 installation (simplest):

yum-config-manager --enable remi-php74
yum update

or, the modular way (Fedora and EL 8):

dnf module reset php
dnf module enable php:remi-7.4
dnf update php\*

Parallel installation of version 7.4 as Software Collection

yum install php74

Replacement of default PHP by version 7.3 installation (simplest):

yum-config-manager --enable remi-php73
yum update php\*

or, the modular way (Fedora and EL 8):

dnf module reset php
dnf module enable php:remi-7.3
dnf update php\*

Parallel installation of version 7.3 as Software Collection

yum install php73

And soon in the official updates:

emblem-important-2-24.pngTo be noticed :

  • EL-8 RPMs are build using RHEL-8.4
  • EL-7 RPMs are build using RHEL-7.9
  • EL-7 builds now use libicu65 (version 65.1)
  • EL builds now uses oniguruma5php (version 6.9.5, instead of outdated system library)
  • oci8 extension now uses Oracle Client version 21.1
  • a lot of extensions are also available, see the PHP extensions RPM status (from PECL and other sources) page

emblem-notice-24.pngInformation:

Base packages (php)

Software Collections (php73 / php74 / php80)

Syslog-ng 3.33: the MQTT destination

Posted by Peter Czanik on July 29, 2021 06:37 AM
Syslog-ng 3.33: the MQTT destination Version 3.33 of syslog-ng introduced an MQTT destination. It uses the paho-c client library to send log messages to an MQTT broker. The current implementation supports version 3.1 and 3.1.1 of the protocol over non-encrypted connections, but this is only a first step. From this blog, you can learn how to configure and test the mqtt() destination in syslog-ng. Read my blog at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-3-33-the-mqtt-destination

SystemReady ES support for MacchiatoBin

Posted by Peter Robinson on July 28, 2021 09:24 AM

I’ve had a MacchiatoBin Double Shot board for some time. It runs various services for my local network and generally just works. I run a TianoCore EDK2 firmware on it using ACPI. It’s purely a network device so I don’t bother with any form of graphics and in the very few occasions I need to access it locally I do so via the built in USB serial TTL.

Recently Solid Run announced the MacciatoBin is now SystemReady ES certified. Excellent news! I’ve worked with Arm for some time on both the SytemReady ES (Embedded Server) and SystemReady IR (IoT Ready) standards and recently the certification program has been finalised so it’s nice to start to see the fruits from all the hard work myself, and may others, have done over a number of years appear.

The EDK2 firmware I was running was coming up to two years old and there’s been a number of enhancements to the various components of the firmwares that make up a complete update so I decided to download the latest firmware and update it. Eventually I am sure Solid Run will have these published to LVFS to make the process even easier but I know that to get to this stage has been a LOT of effort so it’s still a great step forward.

The first step of updating a EDK2 firmware is to download it and put it on the EFI partition:

peter@macbin:~ $ wget https://github.com/Semihalf/edk2-platforms/wiki/releases/flash-image-a8k-mcbin.bin_r20210630
peter@macbin:~ $ sudo mv flash-image-a8k-mcbin.bin_r20210630 /boot/efi
peter@macbin:~ $ sudo reboot

On reboot you’re given a prompt to interrupt the boot process. From the menu select the option for the shell:

Shell> fs0:
FS0:\> ls
Directory of: FS0:\
04/06/2021  19:08          4,096  EFI
07/25/2021  17:01           2,855,040  flash-image-a8k-mcbin.bin_r20210630
          1 File(s)   2,855,040 bytes
          1 Dir(s)

FS0:\> fupdate flash-image-a8k-mcbin.bin_r20210630
Detected w25q32bv SPI NOR flash with page size 256 B, erase size 4 KB, total 4 MB
Updating, 99%
fupdate: Update 2855040 bytes at offset 0x0 succeeded!
FS0:\> reset

It then reboots and we’re done, you see a very similar output to previously with some updated versions of various firmware and before long you’re back through grub and running Fedora again. Painless!

I’m really happy to see this is such a straightforward process, and I’m looking forward to seeing more features, enhancements and fixes to the firmware including capsule updates and the associated LVFS/fwupdmgr support, and improvements around firmware security (fwupdmgr –force security). Top marks to the Solid Run team!

It's templates all the way down - part 4

Posted by Peter Hutterer on July 28, 2021 03:22 AM

Part 1, Part 2, Part 3

After getting thouroughly nerd-sniped a few weeks back, we now have FreeBSD support through qemu in the freedesktop.org ci-templates. This is possible through the qemu image generation we have had for quite a while now. So let's see how we can easily add a FreeBSD VM (or other distributions) to our gitlab CI pipeline:


.freebsd:
variables:
FDO_DISTRIBUTION_VERSION: '13.0'
FDO_DISTRIBUTION_TAG: 'freebsd.0' # some value for humans to read

build-image:
extends:
- .freebsd
- .fdo.qemu-build@freebsd
variables:
FDO_DISTRIBUTION_PACKAGES: "curl wget"
Now, so far this may all seem quite familiar. And indeed, this is almost exactly the same process as for normal containers (see Part 1), the only difference is the .fdo.qemu-build base template. Using this template means we build an image babushka: our desired BSD image is actual a QEMU RAW image sitting inside another generic container image. That latter image only exists to start the QEMU image and set up the environment if need be, you don't need to care what distribution it runs out (Fedora for now).

Because of the nesting, we need to handle this accordingly in our script: tag for the actual test job - we need to start the image and make sure our jobs are actually built within. The templates set up an ssh alias "vm" for this and the vmctl script helps to do things on the vm:


test-build:
extends:
- .freebsd
- .fdo.distribution-image@freebsd
script:
# start our QEMU image
- /app/vmctl start

# copy our current working directory to the VM
# (this is a yaml multiline command to work around the colon)
- |
scp -r $PWD vm:

# Run the build commands on the VM and if they succeed, create a .success file
- /app/vmctl exec "cd $CI_PROJECT_NAME; meson builddir; ninja -C builddir" && touch .success || true

# Copy results back to our run container so we can include them in artifacts:
- |
scp -r vm:$CI_PROJECT_NAME/builddir .

# kill the VM
- /app/vmctl stop

# Now that we have cleaned up: if our build job before
# failed, exit with an error
- [[ -e .success ]] || exit 1
Now, there's a bit to unpack but with the comments above it should be fairly obvious what is happening. We start the VM, copy our working directory over and then run a command on the VM before cleaning up. The reason we use touch .success is simple: it allows us to copy things out and clean up before actually failing the job.

Obviously, if you want to build any other distribution you just swap the freebsd out for fedora or whatever - the process is the same. libinput has been using fedora qemu images for ages now.

DHCPv6 prefix delegation with systemd-networkd

Posted by Major Hayden on July 28, 2021 12:00 AM
My home internet comes from Spectrum (formerly Time Warner Cable) and they offer IPv6 addresses for cable modem subscribers. One of the handy features they provide is DHCPv6 prefix delegation. If you’re not familiar with that topic, here’s a primer on how you get IPv6 addresses: SLAAC: Your machine selects an IPv6 address based on router advertisements DHCPv6: Your machine makes a DHCPv6 request (a lot like DHCP requests) and gets an address back to use DHCPv6 with prefix delegation: Your machine makes a special DHCPv6 request where you provide a hint about the size of the IPv6 network prefix you want.

Getting started with Maxima in Fedora Linux

Posted by Fedora Magazine on July 28, 2021 12:00 AM

Maxima is an open source computer algebra system (CAS) with powerful symbolic, numerical, and graphical capabilities. You can perform matrix operations, differentiation, integration, solve ordinary differential equations as well as plot functions and data in two and three dimensions. As such, it is helpful for anyone interested in science and math. This article goes through installing and using Maxima in Fedora Linux.

Installing Maxima

Maxima is a command line system. You can install Maxima from the official Fedora repository using the following command:

sudo dnf install maxima

You can then use Maxima from the terminal by invoking the command maxima.

<figure class="wp-block-image size-large is-resized" id="maxima-terminal">Maxima session in gnome terminal in Fedora Linux<figcaption>Maxima session in gnome terminal in Fedora Linux 34</figcaption></figure>

Installing wxMaxima

wxMaxima is a document based interface for Maxima. To install it in Fedora Linux, use the following command:

sudo dnf install wxmaxima

You can launch wxMaxima either by invoking the command wxmaxima in the terminal or clicking its application icon from the app grid or menu.

<figure class="wp-block-image size-large is-resized">wxMaxima session in Fedora Linux<figcaption>wxMaxima session in Fedora Linux 34</figcaption></figure>

Basic Commands

After calling maxima, you should see terminal output as in the figure above.

The (%i1) is the input label where you enter the commands. Command in Maxima is an expression that can span over many lines and is closed with a semicolon (;). The o labels denote the outputs. Comments are enclosed between /* and */. You can use the special symbol percent (%) to refer to the immediately preceding result computed by Maxima. If you don’t want to print a result, you can finish your command with $ instead of ;. Here are basic arithmetic commands in Maxima:

 (%i1) (19 + 7)/(52 - 2 * 13);
 (%o1)                                  1
 (%i2) 127 / 5;
                                       127
 (%o2)                                 ---
                                        5
 (%i3) float (127 / 5); 
 (%o3)                                25.4
 (%i4) 127.0 / 5;     
 (%o4)                                25.4
 (%i5) sqrt(2.0);
 (%o5)                          1.414213562373095
 (%i6) sin(%pi/2);
 (%o6)                                 1
 (%i7) abs(-12);
 (%o7)                                12
 (%i8) 2+3*%i + 5 - 4*%i;             /*complex arithmetic*/
 (%o8)                              7 - %i

To end the Maxima session, type the command:

quit();

Algebra

Maxima can expand and factor polynomials:

(%i1) (x+y)^3 + (x+y)^2 + (x+y);
                                3          2
(%o1)                    (y + x)  + (y + x)  + y + x
(%i2) expand(%);
          3        2    2      2                  3    2
(%o2)    y  + 3 x y  + y  + 3 x  y + 2 x y + y + x  + x  + x
(%i3) factor(%);
                          2                2
(%o3)           (y + x) (y  + 2 x y + y + x  + x + 1)

To substitute y with z and x with 5, refer the output label above and use the following command:

(%i4) %o3, y=z, x=5;
                                    2
(%o4)                     (z + 5) (z  + 11 z + 31)

You can easily manipulate trigonometric identities:

(%i1) sin(x) * cos(x+y)^2;
                                       2
(%o1)                        sin(x) cos (y + x)
(%i2) trigexpand(%);
                                                         2
(%o2)              sin(x) (cos(x) cos(y) - sin(x) sin(y))
(%i3) trigreduce(%o1);
                   sin(2 y + 3 x) - sin(2 y + x)   sin(x)
(%o3)              ----------------------------- + ------
                                 4                   2

You can also solve algebraic equations in one or more variables:

(%i1) solve(x^2+5*x+6);
 (%o1)                         [x = - 3, x = - 2]
(%i2) solve(x^3 + 1);
                  sqrt(3) %i - 1      sqrt(3) %i + 1
 (%o2)     [x = - --------------, x = --------------, x = - 1]
                        2                   2
(%i3) eqns: [x^2 + y^2 = 9, x + y = 3];
                              2    2
 (%o3)                      [y  + x  = 9, y + x = 3]
 (%i4) solve(eqns, [x,y]);
 (%o4)                 [[x = 3, y = 0], [x = 0, y = 3]]

Calculus

Define f to be a function of x. You can then find the limit, derivative and integral of the function:

(%i1) f: x^2;
                                       2
 (%o1)                                x
 (%i2) limit(f,x,0);
 (%o2)                                  0
 (%i3) limit(1/f,x,0);
 (%o3)                                 inf
 (%i4) diff(f, x);
 (%o4)                                2 x
 (%i5) integrate(f, x);
                                       3
                                      x
 (%o5)                                --
                                      3

To find definite integrals, slightly modify the syntax above.

 (%i6) integrate(f, x, 1, inf);
 defint: integral is divergent.
  -- an error. To debug this try: debugmode(true);
 (%i7) integrate(1/f, x, 1, inf);
 (%o7)                                 1

Maxima can perform Taylor expansion. Here’s the Taylor expansion of sin(x) up to order 5 terms.

(%i1) taylor(sin(x), x, 0, 5);
                                   3    5
                                  x    x
 (%o1)/T/                     x - -- + --- + . . .
                                  6    120

To represent derivatives in unevaluated form, use the following syntax.

(%i2) 'diff(y,x);
                                       dy
 (%o2)                                 --
                                       dx

The ode2 function can solve first and second order ordinary differential equations (ODEs).

(%i1) 'diff(y,x,2) + y = 0;
                                    2
                                   d y
 (%o1)                             --- + y = 0
                                     2
                                   dx
 (%i2) ode2(%o1,y,x);
 (%o2)                     y = %k1 sin(x) + %k2 cos(x)

Matrix Operations

To enter a matrix, use the entermatrix function. Here’s an example of a general 2×2 matrix.

(%i1) A: entermatrix(2,2);
 Is the matrix  1. Diagonal  2. Symmetric  3. Antisymmetric  4. General
 Answer 1, 2, 3 or 4 : 
 4;
 Row 1 Column 1: 
 1;
 Row 1 Column 2: 
 2;
 Row 2 Column 1: 
 3;
 Row 2 Column 2: 
 4;
 Matrix entered.
                                    [ 1  2 ]
 (%o1)                              [      ]
                                    [ 3  4 ]

You can then find the determinant, transpose, inverse, eigenvalues and eigenvectors of the matrix.

(%i2) determinant(A);
 (%o2)                                 - 2
 (%i3) transpose(A);
                                    [ 1  3 ]
 (%o3)                              [      ]
                                    [ 2  4 ]
(%i4) invert(A);
                                  [ - 2   1  ]
                                  [          ]
 (%o4)                            [  3     1 ]
                                  [  -   - - ]
                                  [  2     2 ]
(%i5) eigenvectors(A);
            sqrt(33) - 5  sqrt(33) + 5
 (%o5) [[[- ------------, ------------], [1, 1]], 
                 2             2
               sqrt(33) - 3         sqrt(33) + 3
       [[[1, - ------------]], [[1, ------------]]]]
                    4                    4

In the output label (%o5) the first array gives the eigenvalues, the second array gives the multiplicity of the respective eigenvalues, and the next two arrays give the corresponding eigenvectors of the matrix A.

Plotting

Maxima can use either Gnuplot, Xmaxima or Geomview as graphics program. Maxima package in Fedora Linux comes with gnuplot as a dependency, so Maxima uses gnuplot_pipes as the plotting format. To check the plotting format, use the following command inside Maxima.

get_plot_option(plot_format);

Below are some plotting examples.

(%i1) plot2d([sin(x), cos(x)], [x, -2*%pi, 2*%pi]);
<figure class="wp-block-image size-large">Two dimensional plot of sin and cos functions.<figcaption>2d plot using Maxima</figcaption></figure>
(%i2) plot3d(sin(sqrt(x^2+y^2)), [x, -7, 7], [y, -7, 7]);
<figure class="wp-block-image size-large">Three dimensional plot using maxima.<figcaption>3d plot using Maxima</figcaption></figure>
(%i3) mandelbrot ([iterations, 30], [x, -2, 1], [y, -1.2, 1.2],
             [grid,400,400]);
<figure class="wp-block-image size-large">Plot of the Mandelbrot set.<figcaption>The Mandelbrot Set</figcaption></figure>

You can read more about Maxima and its capabilities in its official website and documentation.

Fedora Linux has plethora of tools for scientific use. You can find the widely used ones in the Fedora Scientific Guide.

CORS headers with gRPC-Gateway

Posted by Fabio Alessandro Locati on July 28, 2021 12:00 AM
A few years ago, I wrote a blog post on managing CORS headers with Negroni. Lately, I’ve created a new API server that needed to be accessible from the browser, but this time I used a different technology, more precisely gRPC-Gateway. Few months after I wrote that blog post, I stopped writing new REST services by hand. I did not rewrite all the services that used the old paradigm just because they needed a fix or a new feature, but for all new services, I moved to gRPC with gRPC-Gateway.

Running openSUSE in a FreeBSD jail using Bastille

Posted by Peter Czanik on July 27, 2021 03:51 PM
Why? Last week, when the latest version of Bastille, a jail (container) management system for FreeBSD was released, it also included experimental Linux support. Its author needed Ubuntu, so that was implemented. I prefer openSUSE, so with some ugly hacks I could get openSUSE up and running in Bastille. I was asked to document it in a blog. This topic does not fit the sudo or syslog-ng blogs, where I regularly contribute.

libinput and hold gestures

Posted by Peter Hutterer on July 27, 2021 05:58 AM

Thanks to the work done by <https:>Josè Expòsito, libinput 1.19 will ship with a new type of gesture: Hold Gestures. So far libinput supported swipe (moving multiple fingers in the same direction) and pinch (moving fingers towards each other or away from each other). These gestures are well-known, commonly used, and familiar to most users. For example, GNOME 40 recently has increased its use of touchpad gestures to switch between workspaces, etc. Swipe and pinch gestures require movement, it was not possible (for callers) to detect fingers on the touchpad that don't move.

This gap is now filled by Hold gestures. These are triggered when a user puts fingers down on the touchpad, without moving the fingers. This allows for some new interactions and we had two specific ones in mind: hold-to-click, a common interaction on older touchscreen interfaces where holding a finger in place eventually triggers the context menu. On a touchpad, a three-finger hold could zoom in, or do dictionary lookups, or kill a kitten. Whatever matches your user interface most, I guess.

The second interaction was the ability to stop kinetic scrolling. libinput does not actually provide kinetic scrolling, it merely provides the information needed in the client to do it there: specifically, it tells the caller when a finger was lifted off a touchpad at the end of a scroll movement. It's up to the caller (usually: the toolkit) to implement the kinetic scrolling effects. One missing piece was that while libinput provided information about lifting the fingers, it didn't provide information about putting fingers down again later - a common way to stop scrolling on other systems.

Hold gestures are intended to address this: a hold gesture triggered after a flick with two fingers can now be used by callers (read: toolkits) to stop scrolling.

Now, one important thing about hold gestures is that they will generate a lot of false positives, so be careful how you implement them. The vast majority of interactions with the touchpad will trigger some movement - once that movement hits a certain threshold the hold gesture will be cancelled and libinput sends out the movement events. Those events may be tiny (depending on touchpad sensitivity) so getting the balance right for the aforementioned hold-to-click gesture is up to the caller.

As usual, the required bits to get hold gestures into the wayland protocol are either in the works, mid-flight or merge-ready so expect this to hit the various repositories over the medium-term future.

Command line quick tips: wc, sort, sed and tr

Posted by Fedora Magazine on July 26, 2021 08:00 AM

Linux distributions are great to use and they have some tricks under their sleeves which users may not be aware of. Let’s have a look at some command line utilities which really come in handy when you’re the guy that likes to stick with the terminal rather than using a GUI. 

We all know that using a terminal is more efficient to use the system. In case you are editing or playing with text files on a terminal then these tools will surely make your life easy.

For this article let’s have a look at wc, sort, tr, and sed commands.

wc

wc is a utility whose name stands for “word count”. As the name suggests it will count the lines, words or byte count from any file. 

Let’s see how it works:

$ wc filename
lines words characters filename

So in output we get the total number of newlines in the file, total number of words, total number of characters, and the filename.

To get some specific output we have to use options:

  • -c To print the byte counts
  • -l   To print the newline counts
  • -w To print the word counts
  • -m To print the character counts

wc demo

Let’s see it in action:

Here we start with a text file, loremipsm.txt. First, we print out the file and then use wc on it.

$ cat loremipsm.txt
Linux is the best-known and most-used open source operating system.
As an operating system, Linux is software that sits underneath all of the other software on a computer,
receiving requests from those programs and replaying these requests to the computer's hardware.

$ wc loremipsm.txt
3 41 268 loremipsm.txt

Suppose I only want to see the byte count of the file: 

$ wc -c loremipsm.txt
268 loremipsm.txt

For the newline count of the file:

$ wc -l loremipsm.txt
3 loremipsm.txt

To see the word count of the file:

$ wc -w loremipsm.txt
41 loremipsm.txt

Now only the character count of the file:

$ wc -m loremipsm.txt
268 loremipsm.txt

sort

The sort command is one of the most useful tools. It will sort the data in a file. Sorting is by either characters or numbers in ascending or descending order. It can also be used to sort or randomize the lines of files.

Using sort can be very simple.  All we need to do is provide the name of the file.

$ sort filename

By default it sorts the data in alphabetical order. One thing to note is that the sort command just displays the sorted data. It does not overwrite the file.

Some useful options for sort

  • -r  To sort the lines in the file in reverse order
  • -R To shuffle the lines in the file into random order
  • -o To save the output in another file
  • -k To sort as per specific column
  • -t To mention the field separator
  • -n To sort the data according to numerical value

sort demo

Let’s use sort in some short demos:

We have a file, list.txt, containing names and numeric values separated by commas.

First let’s print out the file and just do simple sorting.

$ cat list.txt
Cieran Wilks, 9
Adelina Rowland, 4
Hayden Mcfarlnd, 1
Ananya Lamb, 5
Shyam Head, 2
Lauryn Fuents, 8
Kristian Felix, 10
Ruden Dyer, 3
Greyson Meyers, 6
Luther Cooke, 7

$ sort list.txt
Adelina Rowland, 4
Ananya Lamb, 5
Cieran Wilks, 9
Greyson Meyers, 6
Hayden Mcfarlnd, 1
Kristian Felix, 10
Lauryn Fuents, 8
Luther Cooke, 7
Ruden Dyer, 3
Shyam Head, 2

Now sort the data in the reverse order.

$ sort -r list.txt
Shyam Head, 2
Ruden Dyer, 3
Luther Cooke, 7
Lauryn Fuents, 8
Kristian Felix, 10
Hayden Mcfarlnd, 1
Greyson Meyers, 6
Cieran Wilks, 9
Ananya Lamb, 5
Adelina Rowland, 4

Let’s shuffle the data.

$ sort -R list.txt
Cieran Wilks, 9
Greyson Meyers, 6
Adelina Rowland, 4
Kristian Felix, 10
Luther Cooke, 7
Ruden Dyer, 3
Lauryn Fuents, 8
Hayden Mcfarlnd, 1
Ananya Lamb, 5
Shyam Head, 2

Let’s make it more complex. This time we sort the data according to the second field, which is the numeric value, and save the output in another file using the -o option.

$ sort -n -k2 -t ',' -o sorted_list.txt list.txt
$ ls 
   sorted_list.txt    list.txt
$ cat sorted_list.txt
Hayden Mcfarlnd, 1
Shyam Head, 2
Ruden Dyer, 3
Adelina Rowland, 4
Ananya Lamb, 5
Greyson Meyers, 6
Luther Cooke, 7
Lauryn Fuents, 8
Cieran Wilks, 9
Kristian Felix, 10

Here we used -n to sort in numerical order, -k to specify the field to sort (2 in this case) -t to indicate the delimiter or field-separator (a comma) and -o to save the output in the file sorted_list.txt

sed

Sed is a stream editor that will filter and transform text in the output. This means we are not making changes in the file, only to the output. We can also save the changes in a new file if needed. Sed comes with a lot of options that are useful in filtering or editing the data. 

The syntax for sed is:

$ sed [OPTION] ‘PATTERN’ filename

Some of the options used with sed:

  • -n : To suppress the printing 
  • p: To print the current pattern 
  • d : To delete the pattern 
  • q : To quit the sed script

sed demo

Lets see sed in action. We start with the file data with the fields indicating number, name, age and operating system.

Printing the lines twice if they occur in a specific range of lines.

$ cat data
1    Vicky Grant      20   linux
2    Nora Burton    19   Mac
3    Willis Castillo   21  Windows
4    Gilberto Mack 30   Windows
5    Aubrey Hayes  17   windows
6    Allan Snyder    21   mac
7    Freddie Dean   25   linux
8    Ralph Martin    19   linux
9    Mindy Howard  20   Mac

$ sed '3,7 p' data
1    Vicky Grant      20   linux
2    Nora Burton    19   Mac
3    Willis Castillo   21  Windows
3    Willis Castillo   21  Windows
4    Gilberto Mack 30   Windows
4    Gilberto Mack 30   Windows
5    Aubrey Hayes  17   windows
5    Aubrey Hayes  17   windows
6    Allan Snyder    21   mac
6    Allan Snyder    21   mac
7    Freddie Dean   25   linux
7    Freddie Dean   25   linux
8    Ralph Martin    19   linux
9    Mindy Howard 20   Mac

Here the operation is specified in single quotes indicating lines 3 through 7 and using ‘p’ to print the pattern found. The default behavior of sed is to print every line after parsing it. This means lines 3 through 7 appear twice because of the ‘p’ instruction.

So how can you print specific lines from the file? Use the ‘-n’ option to eliminate lines that do not match from the output.

$ sed -n '3,7 p' data
3    Willis Castillo     21    Windows
4    Gilberto Mack    30   Windows
5    Aubrey Hayes     17   windows
6    Allan Snyder       21   mac
7    Freddie Dean      25  linux

Only lines 3 through 7 will appear using ‘-n’ .

Omitting specific lines from the file. This uses the ‘d’ to delete the lines from the output.

$ sed '3 d' data
1    Vicky Grant      20    linux
2   Nora Burton     19    Mac
4   Gilberto Mack  30    Windows
5   Aubrey Hayes   17    windows
6   Allan Snyder     21    mac
7   Freddie Dean    25   linux
8   Ralph Martin    19    linux
9   Mindy Howard  20   Mac

$ sed '5,9 d' data
1    Vicky Grant     20   linux
2   Nora Burton    19   Mac
3   Willis Castillo   21   Windows
4   Gilberto Mack 30   Windows

Searching for a specific keyword in the file.

$ sed -n '/linux/ p' data
7    Freddie Dean   25  linux
8    Ralph Martin   19   linux

$ sed -n '/linux/I p' data
1     Vicky Grant      20  Linux
7     Freddie Dean  25  linux
8     Ralph Martin   19  linux

In these examples we have a regular expression which appears in ‘/ /’. If we have similar words in the file but not with proper case then we use the “I” to make the search case insensitive. Recall that the -n eliminates the lines that do not match from the output.

Replacing the words in the file.

$ sed 's/linux/linus/' data
1   Vicky Grant      20   Linux
2   Nora Burton    19   Mac
3   Willis Castillo   21   Windows
4   Gilberto Mack  30  Windows
5   Aubrey Hayes   17  windows
6   Allan Snyder     21  mac
7   Freddie Dean    25 linus
8   Ralph Martin    19  linus
9   Mindy Howard 20  Mac

Here ‘s/ / /’ denotes that it is a regex. The located word and then the new word to replace it appear between the two ‘/’.

tr

The tr command will translate or delete characters. It can transform the lowercase letters to uppercase or vice versa, eliminate repeating characters, and delete specific characters.

One thing weird about tr is that it does not take files as input like wc, sort and sed do. We use “|” (the pipe symbol) to provide input to the tr command.

$ cat filename | tr [OPTION]

Some options used with tr:

  • -d : To delete the characters in first set of output
  • -s : To replace the repeated characters with single occurrence

tr demo

Now let’s use the tr command with the file letter to convert all the characters from lowercase to uppercase.

$ cat letter
Linux is too easy to learn,
And you should try it too.

$ cat letter | tr 'a-z' 'A-Z'
LINUX IS TOO EASY TO LEARN,
AND YOU SHOULD TRY IT TOO.

Here ‘a-z’ ‘A-Z’ denotes that we want to convert characters in the range from “a” to “z” from lowercase to uppercase.

Deleting the “o” character  from the file.

$ cat letter | tr -d 'o'
Linux is t easy t learn,
And yu shuld try it t.

Squeezing the character “o” from the file means that if “o” is repeated in line then it will remove it and print it only once. 

$ cat letter | tr -s 'o'
Linux is to easy to learn,
And you should try it to.

Conclusion

This was a quick demonstration of the wc, sort, sed and tr commands. These commands make it easy to manipulate the text files on the terminal in a quick and efficient way. You may use the man command to learn more about these commands.

آموزش کنترل ماشین مجازی در OpenStack

Posted by Fedora fans on July 26, 2021 06:30 AM
openstack

برای کنترل (start, stop, pause, unpause, suspend, resume, reboot) ماشین های مجازی یا همان instance ها در OpenStack  می توان از طریق پنل گرافیکی (Horizon) و یا خط فرمان اقدام کرد که در این مطلب قصد داریم تا از طریق خط فرمان ماشین های مجازی خود را کنترل کنیم.

نکته: در تمامی دستورهای زیر بجای myInstance باید نام Instance و یا همان ماشین مجازی (VM) خود را بنویسید.

  • برای Pause کردن instance می توان از دستور زیر استفاده کرد (با اجرای این دستور وضعیت VM روی RAM ذخیره خواهد شد) :

$ openstack server pause myInstance

  • برای unpause کردن instance می توان از دستور زیر استفاده کرد:

$ openstack server unpause myInstance

  • برای Suspend کردن instance می توان از دستور زیر استفاده کرد:

$ openstack server suspend myInstance

  • برای resume کردن instance می توان از دستور زیر استفاده کرد:

$ openstack server resume myInstance

  • برای Stop یا همان Shut Off کردن instance می توان از دستور زیر استفاده کرد:

$ openstack server stop myInstance

  • برای Start کردن instance می توان از دستور زیر استفاده کرد:

$ openstack server start myInstance

  • برای Soft reboot کردن instance می توان از دستور زیر استفاده کرد (هنگام reboot کردن یک instance به صورت پیش فرض Soft reboot انجام خواهد شد) :

$ openstack server reboot myInstance

  • برای Hard reboot کردن instance می توان از دستور زیر استفاده کرد:

 

$ openstack server reboot --hard myInstance
  • برای مشاهده ی status یا همان وضعیت یک instance می توانید از دستور زیر استفاده کنید:

$ openstack server show myInstance

 

The post آموزش کنترل ماشین مجازی در OpenStack first appeared on طرفداران فدورا.

Episode 281 – If you spy on journalists, you’re the bad guys

Posted by Josh Bressers on July 26, 2021 12:01 AM

Josh and Kurt talk about the news that the NSO Group is widely distributing spyware onto a large number of devices. This news should be a wake up call for anyone creating devices and systems that could be attacked, it’s time to segment services. There’s not a lot individuals can do at this point, but we have some ideas at the end of the episode.

<audio class="wp-audio-shortcode" controls="controls" id="audio-2498-3" preload="none" style="width: 100%;"><source src="https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_281_If_you_spy_on_journalists_youre_the_bad_guys.mp3?_=3" type="audio/mpeg">https://traffic.libsyn.com/secure/opensourcesecuritypodcast/Episode_281_If_you_spy_on_journalists_youre_the_bad_guys.mp3</audio>

Show Notes

2021H1 recap: Fedora 34, CentOS Dojo, team switch, and back on leave

Posted by Michel Alexandre Salim on July 24, 2021 12:00 AM
Half of 2021 is gone already! I’m back on parental leave, but want to post a quick recap of the past few months. Parental leave I’m out from July 15 until the end of October. I am signed up to some virtual conferences this summer and fall, but do not anticipate really being there except for a few selected talks. Best way to reach me is async via Matrix or email (see links on the main page).

Friday’s Fedora Facts: 2021-29

Posted by Fedora Community Blog on July 23, 2021 07:46 PM

Here’s your weekly Fedora report. Read what happened this week and what’s coming up. Your contributions are welcome (see the end of the post)!

The Nest With Fedora CfP closes today! Registration is open now.

Fedora Linux 35 mass rebuild is underway.

I have weekly office hours on Wednesdays in the morning and afternoon (US/Eastern time) in #fedora-meeting-1. Drop by if you have any questions or comments about the schedule, Changes, elections, or anything else. See the upcoming meetings for more information.

Announcements

CfPs

<figure class="wp-block-table">
ConferenceLocationDateCfP
Nest With Fedoravirtual5-7 Augcloses 23 July
SeaGLvirtual5–6 Novcloses 5 August
CentOS Dojovirtual7–8 Octcloses 6 September
Ohio Linux FestColumbus, OH, USearly Deccloses 1 October
</figure>

Help wanted

Prioritized Bugs

<figure class="wp-block-table">
Bug IDComponentStatus
1953675kf5-akonadi-serverNEW
1951492annobinASSIGNED
</figure>

Upcoming meetings

Releases

Fedora Linux 35

Schedule

  • 2021-08-10 — F35 branches from Rawhide, F36 development begins
  • 2021-08-10 — Change complete (testable) deadline
  • 2021-08-24 — Change complete (100%) deadline

For the full schedule, see the schedule website.

Changes

<figure class="wp-block-table">
ProposalTypeStatus
tzdata-minimalSelf-ContainedFESCo #2647
GHC 8.10 and Stackage lts-18Self-ContainedApproved
libffi 3.4System-WideFESCo #2650
Enhanced Inscript as default Indic IMSelf-ContainedFESCo #2651
Switch to WirePlumber as the PipeWire session managerSelf-ContainedAnnounced
Use power-profiles-daemon on WorkstationSelf-ContainedAnnounced
</figure>

Changes approved, rejected, or withdrawn will be removed from this table the next week. See the ChangeSet page for a full list of approved changes.

Contributing

Have something you want included? You can file an issue or submit a pull request in the fedora-pgm/pgm_communication repo.

The post Friday’s Fedora Facts: 2021-29 appeared first on Fedora Community Blog.

New badge: Fedora Community Outreach Task Force !

Posted by Fedora Badges on July 23, 2021 05:46 PM
Fedora Community Outreach Task ForceYou helped in revamping the Fedora Ambassadors program as a Fedora Community Outreach Task Force member!

New badge: GUADEC 2021 !

Posted by Fedora Badges on July 23, 2021 02:36 PM
GUADEC 2021You visited a Fedora office hour at GUADEC 2021

threads and libxcb: problems now we have two

Posted by Adam Jackson on July 22, 2021 08:59 PM

If you want to write an X application, you need to use some library that speaks the X11 protocol. For a long time this meant libX11, often called xlib, which - like most things about X - is a fantastic bit of engineering that is very much a product of its time with some confusing baroque bits. Overall it does a very nice job of hiding the icky details of the protocol from the application developer.

One of the details it hides has to do with how resource IDs are allocated in X. A resource ID (an XID, in the jargon) is a 32 29-bit integer that names a resource - window, colormap, what have you. Those 29 bits are split up netmask/hostmask style, where the top 8 or so uniquely identify the client, and the rest identify the resource belonging to that client. When you create a window in X, what you really tell the server is "I want a window that's initially this size, this background color (etc.) and from now on when I say (my client id + 17) I mean that window." This is great for performance because it means resource allocation is assumed to succeed and you don't have to wait for a reply from the server.

Key to all this is that in xlib the XID is the return value from the call that issues the resource creation request. Internally the request gets queued into the protocol's write buffer, but the client can march ahead and issue the next few commands as if creation had succeeded - because it probably did, and if it didn't you're probably going to crash anyway.

So to allocate XIDs the client just marches forward through its XID range. What happens when you hit the end of the range? Before X11R4, you'd crash, because xlib doesn't keep track of which XIDs it's allocated, just the lowest one it hasn't allocated yet. Starting in R4 the server added an extension called XC-MISC that lets the client ask the server for a list of unused XIDs, so when xlib hits the end of the range it can request a new range from the server.

But. UI programming tends to want threads, and xlib is perhaps not the most thread-friendly. So XCB was invented, which sacrifices some of xlib's ease of use for a more direct binding to the protocol and (in theory) an explicitly thread-safe design. We then modified xlib and XCB to coexist in the same process, using the same I/O buffers, reply and event management, etc.

This literal reflection of the protocol into the API has consequences. In XCB, unlike xlib, XID generation is an explicit step. The client first calls into XCB to allocate the XID, and then passes that XID to the creation request in order to give the resource a name.

Which... sorta ruins that whole thread-safety thing.

Let's say you call xcb_generate_id in thread A and the XID it returns is the last one in your range. Then thread B schedules in and tries to allocate another XID. You'll ask the server for a new range, but since thread A hasn't called its resource creation request yet, from the server's perspective that "allocated" XID looks like it's still free! So now, whichever thread issues their resource creation request second will get BadIDChoice thrown at them if the other thread's resource hasn't been destroyed in the interim.

A library that was supposed to be about thread safety baked a thread safety hazard into the API. Good work, team.

How do you fix this without changing the API? Maybe you could keep a bitmap on the client side that tracks XID allocation, that's only like 256KB worst case, you can grow it dynamically and most clients don't create more than a few dozen resources anyway. Make xcb_generate_id consult that bitmap for the first unallocated ID, and mark it used when it returns. Then track every resource destruction request and zero it back out of the bitmap. You'd only need XC-MISC if some other client destroyed one of your resources and you were completely out of XIDs otherwise.

And you can implement this, except. One, XCB has zero idea what a resource destruction request is, that's simply not in the protocol description. Not a big deal, you can fix that, there's only like forty destructors you'd need to annotate. But then two, that would only catch resource destruction calls that flow through XCB's protocol binding API, which xlib does not, xlib instead pushes raw data through xcb_writev. So now you need to modify every client library (libXext, libGL, ...) to inform XCB about resource destruction.

Which is doable. Tedious. But doable.

I think.

I feel a little weird writing about this because: surely I can't be the first person to notice this.

A revamp of our beloved Fedora characters

Posted by Fedora Community Blog on July 22, 2021 08:00 AM
A happy smiling hot dog, reclining sunglasses-wearing badger, and radioactive panda are gathered around bold text that reads "Fedora Character Revamp"

If you’ve been hanging around the Fedora Design team lately—or dropped by one of our recent Fedora Design Team Live Sessions —you may be aware of a very cool artwork project one of our interns has been working on. Lauryn Dake has done a revamp of the character designs for the entire cast of Fedora characters, including the Beefy Miracle, panda, and badges badger!

The idea here is our current character artwork is a bit dis-jointed. For example, the pandas in our badge system are drawn in a very different style than the badger, and the original Beefy Miracle artwork is in yet another older style. We want to give our characters all a fresher, more expressive look. Also, this allows them to hang together more cohesively under the same style / approach.

<figure class="wp-block-gallery columns-4 is-cropped"><figcaption class="blocks-gallery-caption">A selection of older Fedora character artwork: A smiling hotdog with animated mustard squirt (The Beefy Miracle), a blue and white panda waving on a Fedora bubble-shaped badge, a badger rocking out on a blue guitar in front a green starburst on a Fedora badge, and an orange panda and black and white badger as winged angels in front of a cloudy sky on a Fedora badge.</figcaption></figure>

We wanted to share this ongoing project with you and get your feedback and ideas. How is your team using these characters? What poses for these characters would be helpful for you to have graphics of? What formats would you like some of the artwork in?

Meet the Fedora Panda

<figure class="wp-block-image size-large"><figcaption>The New Fedora Panda character sheet – a happy go-lucky panda with glowing ears and a glowing nuclear symbol on her stomach, in a variety of poses including cheering, apologizing, and running with a stack of papers. The panda is sometimes highlighted in glowing green, sometimes yellow, sometimes red. </figcaption></figure>

Our Panda has retained the nuclear symbol on her belly in Lauryn’s revamp (you may recall the old Fedora 404 pages that featured this glowing mark on her belly) and Lauryn has introduced a concept of the mark shifting colors here on this character sheet. How do you think we could use the different colors?

<figure class="wp-block-image size-large"><figcaption>Basic New Fedora panda character sheet: showing a cartoon panda with large reflective eyes and a green nuclear symbol glowing on her stomach and glowing green coming from the inside of her ears. This shows her from the front and rear perspectives.</figcaption></figure>

Meat^w Meet the Beefy Miracle

<figure class="wp-block-image size-large"><figcaption>The new Beefy Miracle character sheet: Showing a happy hot dog with beady eyes and gloved/shoed stick appendages in a variety of poses, including expressing an idea with a light bulb overhead, relaxing with arms folded behind his head, and a happily splayed out standing pose with a rainbow of condiments appearing above (red ketchup, yellow mustard, green relish, purple onion.) </figcaption></figure>

Here’s an updated version of the Beefy Miracle. You can see he has the same beady, twinkling eyes, and of course the mustard is still indicating progress.

<figure class="wp-block-image size-large"><figcaption>Basic new Beefy Miracle character sheet: Showing our happy hotdog friend with a friendly wave from both the front and the rear perspective.</figcaption></figure>

Meet Badger

<figure class="wp-block-image size-large"><figcaption>Basic new Badger character sheet: The new Fedora badger design – a dark and light grey woodland creature wearing large reflective black sunglasses and a red Chewbacca-like sash, a large fluffy tail framing their comparatively skinny, tear-drop shaped body.</figcaption></figure>

Here is Badger, wearing their shades.

<figure class="wp-block-image size-large"><figcaption>The new badger character sheet: Showing the badger in a variety of poses, including proudly holding up a Fedora logo, rubbing their hands together with a large toothy grin, and sitting on the ground staring up at the sky. </figcaption></figure>

Minor Characters

There are a few other minor characters in the Fedora character universe that Lauryn is also taking a look at. (More information in the ticket.)

<figure class="wp-block-image size-large"></figure>

How will these designs be used?

We want to use these awesome designs in community-focused materials to maintain a sense of fun in the Fedora community!

One initial project that is already looking to use these designs is “How Do You Fedora?” video series kicked off by another intern, Gabbie Chang. Fedora Design team member Kyle Conway has been working on designing title cards and overlays for this video series and incorporating these character designs:

<figure class="wp-block-image size-large"></figure>

If you have ideas for how you’d like to see these designs used in Fedora, reach out to the Fedora design team or drop a note here in the comments!

If you have any experience with Synfig, we are looking to potentially create animations of the characters and could use your expertise. 🙂

Meet the Designer

Hi everyone!  My name is Lauryn Dake. I’m an animation major at ASU, and I’ll be working as a design team intern until the fall.  I like to draw (obviously lol), as well as play chess and video games! (My favorites are Hollow Knight & Stardew Valley, because I have immaculate taste.)  I’m really excited to be here!  Nice to meet all of you 🙂

The post A revamp of our beloved Fedora characters appeared first on Fedora Community Blog.

Pimp your Gtk application with CSS

Posted by Tim Lauridsen on July 22, 2021 06:02 AM

 GTK is a powerful framework for building GUI application in Linux and other OSes. It is written in C, but there is binding for many programing languages like Python.

GTK uses a subset of CSS for styling your application. I have made a little Python Demo Application to show how to pimp your application like a pimp.

It shows the basics of how to use a CSS file with GTK python bindings and  the basics of how to write custom styling in CSS for your GTK application.  It is not meant to be good looking 😊, but to show how the styling works. It shows the basics like colors, padding, margins, borders etc, but also more advanced features like transitions and animations.

Check out the code here. (Tested in Fedora 34 Workstation)

https://github.com/timlau/gtk-demo




There is 2 versions, One for GTK3 and one for GTK4. Check out the Readme for how to run.

Video

<iframe allowfullscreen="" class="BLOG_video_class" height="566" src="https://www.youtube.com/embed/gnBAFtGN6pI" width="681" youtube-src-id="gnBAFtGN6pI"></iframe>


References.



A framebuffer hidden in plain sight

Posted by Javier Martinez Canillas on July 21, 2021 09:32 AM

Soon after I set up my Rockpro64 board, Peter Robinson told me about an annoying bug that happened on machines with a Rockchip SoC.

The problem was that the framebuffer console just went away after GRUB booted the Linux kernel. We started looking at this and Peter mentioned the following data points:

  • Enabling early console output on the framebuffer registered by the efifb driver (earlycon=efifb efi=debug) would get some output but at some point everything would just go blank.
  • The display worked when passing fbcon=map:1 and people were using that as a workaround.
  • Preventing the efifb driver to be loaded (modprobe.blacklist=efifb) would also make things to work.

So the issue seemed to be related to the efifb driver somehow but wasn’t clear what was happening.

What this driver does is to register a framebuffer device that relies on the video output configured by the firmware/bootloader (using the EFI Graphics Output Protocol) until a real driver takes over an re-initializes the display controller and other IP blocks needed for video output.

I read The Framebuffer device and The Framebuffer Console sections in the Linux documentation to get more familiar about how this is supposed to work.

What happens is that the framebuffer console is bound by default to the first framebuffer registered, which is the one registered by the efifb driver.

Later, the rockchipdrm driver is probed and a second framebuffer registered by the DRM fbdev emulation layer but the frame buffer console is still bound to the first frame buffer, that’s using the EFI GOP but this gets destroyed when the kernel re-initializes the display controller and related IP blocks (IOMMU, clocks, power domains, etc).

So why are users left with a blank framebuffer? It’s because the framebuffer is registered but it’s not attached to the console.

Once the problem was understood, it was easy to solve it. The DRM subsystem provides a drm_aperture_remove_framebuffers() helper function to remove any existing drivers that may own the framebuffer memory, but the rockchipdrm driver was not using this helper.

The proposed fix (that landed in v5.14-rc1) then is for the rockchipdrm driver to call the helper to detach any existing early framebuffer before registering its own.

After doing that, the early framebuffer is unbound from the framebuffer console and the one registered by the rockchipdrm driver takes over:

[   40.752420] fb0: switching to rockchip-drm-fb from EFI VGA

Run GitHub Actions on Fedora CoreOS

Posted by Fedora Magazine on July 21, 2021 08:00 AM

GitHub Actions is a service provided to quickly setup continuous integration and delivery (CI/CD) workflows . These workflows run on hosts called runners. GitHub provides hosted runners with a limited set of operating system choice (Windows Server, Ubuntu, MacOS).

Another option is to use self-hosted runners which gives the repository administrator more control on the runners. Self-hosted runners are dedicated to a repository or organization. The following article goes through the steps of configuring self-hosted runners using Fedora CoreOS.

Getting Started

Fedora CoreOS is a minimalist operating system designed to be easy to deploy and maintain at scale. The operating system will automaticaly update and provide, by default, the tools needed to run containers. For all of these reasons, Fedora CoreOS is a great choice to consider for running CI/CD workflows.

The first step to configure and provision a Fedora CoreOS machine is to generate an Ignition file. Butane allows you to generate Ignition’s file using a friendlier format (YAML).

Configure a Fedora CoreOS runner

To execute GitHub actions on Fedora CoreOS, the host needs the binaries and scripts used to register and run the runner. Download the binaries and scripts from the actions runner project and deploy under /usr/local/sbin/actions-runner.

version: "1.3.0"
variant: fcos
storage:
  directories:
    - path: /usr/local/sbin/actions-runner
      mode: 0755
      user:
        name: core
      group:
        name: core
  files:
    - path: /usr/local/sbin/actions-runner/actions-runner-linux.tar.gz
      overwrite: true
      contents:
        source: https://github.com/actions/runner/releases/download/v2.278.0/actions-runner-linux-x64-2.278.0.tar.gz
      mode: 0755
      user:
        name: core
      group:
        name: core

Registration and Removal token

Configuring runners for a project requires a “token”. This prevents registering or removing self-hosted runners from projects without the correct permissions. Tokens provided by Github have a one hour expiration time. If the runner restarts after this time it will require a new registration token.

The token can be problematic, in particular with Fedora CoreOS automatic updates. The update process expects that the host will restart at least once every couple weeks after receiving new data.

Luckily, it is possible to use GitHub REST API to obtain these tokens and automatically configure the runner every time the host restarts. The following manage-runner.sh script uses the APIs to retrieve a token, remove any runner already configured and register the runner with a new token.

#!/bin/bash
# Handles the Github Action runner configuration.
# Remove and Registration token expires after 1 hour, if we want our runner
# to work after a reboot (auto update) we need to refresh the tokens.

# First remove the runner with a fresh remove token
REMOVE_TOKEN=$(curl -u ${GITHUB_USER}:${GITHUB_TOKEN} -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${GITHUB_USER}/${GITHUB_REPO}/actions/runners/remove-token | jq -r '.token')
/usr/local/sbin/actions-runner/config.sh remove --token ${REMOVE_TOKEN}


# Then register the runner with a fresh registration token
REGISTRATION_TOKEN=$(curl -u ${GITHUB_USER}:${GITHUB_TOKEN} -X POST -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/${GITHUB_USER}/${GITHUB_REPO}/actions/runners/registration-token | jq -r '.token')
/usr/local/sbin/actions-runner/config.sh --url https://github.com/cverna/fcos-actions-runner --token ${REGISTRATION_TOKEN} --labels fcos --unattended

The script above uses a few environment variables that contain a GitHub username and a Personal Access Token used to authenticate the REST API requests. The Personal Access Token requires the repo permissions in order to successfully retrieve the runner registration and removal tokens. The token is security sensitive so it is better to store it in a different file with stricter permissions. In this example that file is actions-runner.

GITHUB_USER=<user>
GITHUB_REPO=<repo>
GITHUB_TOKEN=<personal_access_token> 

Following is the Butane snippet that creates these two files – manage-runner.sh and actions-runner.

    - path: /usr/local/sbin/actions-runner/manage-runner.sh
      contents:
        local: manage-runner.sh
      mode: 0755
      user:
        name: core
      group:
        name: core
    - path: /etc/actions-runner
      contents:
        local: actions-runner
      mode: 0700
      user:
        name: core
      group:
        name: core

Running Actions on Fedora CoreOS

Finally, create the systemd services that will configure and start the runner. Define the services in the Butane configuration file.

systemd:
  units:
    - name: github-runner-configure.service
      enabled: true
      contents: |
        [Unit]
        Description=Configure the github action runner for a repository
        After=network-online.target boot-complete.target
        Requires=boot-complete.target
        [Service]
        EnvironmentFile=/etc/actions-runner
        Type=oneshot
        RemainAfterExit=yes
        User=core
        WorkingDirectory=/usr/local/sbin/actions-runner
        ExecStartPre=tar xvf actions-runner-linux.tar.gz --no-same-owner
        ExecStart=/usr/local/sbin/actions-runner/manage-runner.sh
        [Install]
        WantedBy=multi-user.target
    - name: github-runner.service
      enabled: true
      contents: |
        [Unit]
        Description=Run the github action runner
        After=github-runner-configure.service
        [Service]
        WorkingDirectory=/usr/local/sbin/actions-runner
        User=core
        ExecStart=/usr/local/sbin/actions-runner/run.sh
        [Install]
        WantedBy=multi-user.target

This creates two services, github-runner-configure.service (running once when the host has finished booting) and github-runner.service (running the Actions runner binaries and waiting for new CI/CD jobs).

Now that the Butane configuration is complete, generate an Ignition file out of it and provision a Fedora CoreOS Actions runner.

$ podman run -i --rm -v $PWD:/code:z --workdir /code quay.io/coreos/butane:release --pretty --strict --files-dir /code config.yaml -o config.ignition

Once the Ignition file is generated, it can be used to provision a runner on the platforms where Fedora CoreOS is available.

<figure class="wp-block-embed is-type-wp-embed is-provider-fedora-magazine wp-block-embed-fedora-magazine">
Getting started with Fedora CoreOS
<iframe class="wp-embedded-content" data-secret="9Od3sWmxp8" frameborder="0" height="338" marginheight="0" marginwidth="0" sandbox="allow-scripts" scrolling="no" security="restricted" src="https://fedoramagazine.org/getting-started-with-fedora-coreos/embed/#?secret=9Od3sWmxp8" title="“Getting started with Fedora CoreOS” — Fedora Magazine" width="600"></iframe>
</figure>

Configure an Action to use a self-hosted runner

The following test Action workflow will test the FCOS self-hosted worker. Create the following file in your git repository .github/workflows/main.yml

# This is a basic workflow to help you get started with Actions

name: CI

# Controls when the action will run. 
on:
  # Triggers the workflow on push or pull request events but only for the main branch
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: fcos

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Runs a single command using the runners shell
      - name: Run a one-line script
        run: podman run --rm fedora-minimal:34 echo Hello World !

Note that the runs-on configuration is set up to use a runner with the label fcos.

The code presented in this article is available here.

Trouble of zoom and participant name

Posted by Kushal Das on July 21, 2021 04:10 AM

Last night I was in a panel along with Juan Andrés Guerrero-Saade organized by Aveek Sen, the topic was "Tips on how journalists can avoid getting snooped". You can watch the recording at Youtube.

But this post is not about that. It is about Zoom. Just before logging into the call, I made sure that the name is changed while joining the call, generally my daughter uses the Zoom and her name was mentioned before. I personally have almost zero zoom usage (except 2-3 times in last 1 year). But, after logging into the call, zoom again went back to the older name, and did not allow me to change it during the session. I kept trying during the session without any luck. I don't know why did they do this or why I could not find a way to change my name, but I feel this is really stupid.

llvmpipe/lavapipe: anisotropic texture filtering

Posted by Dave Airlie on July 21, 2021 01:07 AM

In order to expose OpenGL 4.6 the last missing feature in llvmpipe is anisotropic texture filtering. Adding support for this also allows lavapipe expose the Vulkan samplerAnisotropy feature.

I started writing anisotropic support > 6 months ago. At the time we were trying to deprecate the classic swrast driver, and someone pointed out it had support for anisotropic filtering. This support had also been ported to the softpipe driver, but never to llvmpipe.

I had also considered porting swiftshaders anisotropic support, but since I was told the softpipe code was functional and had users I based my llvmpipe port on that.

Porting the code to llvmpipe means rewriting it to generate LLVM IR using the llvmpipe vector processing code. This is a lot messier than just writing linear processing code, and when I thought I had it working it passes GL CTS, but failed the VK CTS. The results also to my eye looked worse than I'd have thought was acceptable, and softpipe seemed to be as bad.

Once I swung back around to this I decided to port the VK CTS test to GL and run it on softpipe and llvmpipe code. Initially llvmpipe had some more bugs to solve esp where the mipmap levels were being chosen, but once I'd finished aligning softpipe and llvmpipe I started digging into why the softpipe code wasn't as nice as I expected.

The softpipe code was based on an implementation of an Elliptical Weighted Average Filter (EWA). The paper "Creating Raster Omnimax Images from Multiple Perspective Views Using the Elliptical Weighted Average Filter" described this. I sat down with the paper and softpipe code and eventually found the one line where they diverged.[1] This turned out to be a bug introduced in a refactoring 5 years ago, and nobody had noticed or tracked it down.

I then ported the same fix to my llvmpipe code, and VK CTS passes. I also optimized the llvmpipe code a bit to avoid doing pointless sampling and cleaned things up. This code landed in [2] today.

For GL4.6 there are still some fixes in other areas.

[1] https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/11917

[2] https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/8804

Elixir Authorization Plugs

Posted by Josef Strzibny on July 21, 2021 12:00 AM

Similar to Ruby’s Rack, Plug is a general specification for composing modules between web applications and application servers. Here’s how we can use them to build authorized pipelines in your router.

Note that this post is not about whether you should do authorization at the router level. It’s likely you’ll do it as part of your business logic for the most part. But when it makes sense, you can use Plugs.

Authorization plug is a genetic plug, but one that might need to stop the execution of the request. If we import Plug.Conn we can pipe to halt/1 to do exactly that. We should also render a custom error message.

I’ll demonstrate by checking claims from a Guardian token and compare them to fix hardcoded access rights.

defmodule DigiWeb.VerifyAdminPlug do
  import Plug.Conn

  def init(options), do: options

  # This is what's get called
  def call(%Plug.Conn{} = conn, opts) do
    verify_access!(conn, opts)
  end

  defp verify_access!(conn, opts) do
    # This is a path like "/admin/path1"
    authorized_path = conn.request_path

    # We fetch the authorization rights from claims
    rights =
      if Map.has_key?(conn.private, :guardian_default_claims) do
        conn.private.guardian_default_claims["rights"]
      else
        []
      end

    # A simple way of checking a path against a particular right,
    # could be a more sophisticated check
    required_rights = required_action_rights[authorized_path]

    if required_rights do
      case has_rights(rights, required_rights) do
        false ->
          conn
          |> auth_error()
          |> halt()

        true ->
          conn
      end
    else
      conn
      |> auth_error()
      |> halt()
    end
  end

  defp has_rights([], _required), do: false

  defp has_rights(rights, required) do
    MapSet.subset?(MapSet.new(rights), MapSet.new(required))
  end

  defp auth_error(conn) do
    body = Poison.encode!(%{message: "Unauthorized"})
    send_resp(conn, 401, body)
  end

  def required_action_rights do
    %{
      "/admin/path1" => ["right1"],
      "/admin/path2" => ["right2"]
    }
  end
end

There you have it, a simple way to authorize access. Great for pages that are protected entirely.

To make a route use your plug, plug it in a pipeline:

# router.ex
  ..
  pipeline :authorized_admin do
    plug Guardian.Plug.Pipeline,
      module: MyAppWeb.Public.Guardian,
      error_handler: MyAppWeb.Public.ErrorHandler

    # Check admin's access rights
    plug MyApp.VerifyAdminPlug
  end
  ..

Because I wanted to use claims from a token issued by Guardian, I put it after the Guardian’s plug.

Podman Machine

Posted by Daniel Lara on July 20, 2021 11:42 PM

 Podman Machine é um recurso que ajuda a criar uma máquina virtual (VM) com Fedora CoreOS básico para usar com contêineres e cargas de trabalho em contêiner.


Para iniciar uma vm com podman use o comando

podman machine init <nome da vm > se não use ele vai usar um nome default


$ podman machine init


$ podman machine init fcoreos

use o comando podman machine start <nome da vm >para iniciar a vm se não colocar o nome ele inicia a vm default

$ podman machine start fcoreos

Pode listar as vm que tu tens e se estão rodando ou não com o comando podman machine list

$ podman machine list


e para acessar a VM use o comando

podman machine ssh <nome da vm>onde irar acessar via ssh a VM se não colocar o nome ele ira acessar a mv default caso esteja rodando se não ele não vai conectar via ssh e tem que por o nome da vm para acessar


$ podman machine ssh fcoreos



E para parar a VM digite o comando

podman machine stop <nome da vm> caso esteja usando a vm default não precisa por o nome , mas caso contrário

tem que por o nome da vm que esta rodando

Tem o comando podman machine --help onde ajudar

$ podman machine --help


Espero que ajude

Guia de Referencia :

https://opensource.com/article/21/7/linux-podman

http://docs.podman.io/en/latest/markdown/podman-machine.1.html


Time to make new release schedules

Posted by Fedora Community Blog on July 20, 2021 08:00 AM

We’re only a few weeks away from when F35 branches from Rawhide. That’s the start of Fedora Linux 36 development. Several years ago, I created schedules through F36, which means we’re about to run out of schedule! Before I start the process of creating schedules for F37 through F42, I want to review the existing schedules. This is your chance to let me know what tasks need to be added, removed, or edited for your team. Or if your team doesn’t have a schedule and needs one!

The way I make future schedules is by copying the previous schedule and updating the dates and version numbers. This means I have to edit any change I make after the initial schedule creation into each release’s schedule. This is not entirely fun and leaves us open to my famous copy/paste errors. On the other hand, it’s helpful to our downstreams to have schedules far in advance so they can plan work that will go into Fedora Linux. So it’s a balancing act.

If your team has an existing schedule, I’ve already created an issue in the schedule repo to review it. You may be hearing from a member of the Program Management Team, but feel free to jump in with your thoughts. If your team doesn’t have a tab on the release schedule but you would like one, open an issue in the schedule repo. I’d like to have updates in by mid-August so that I can start preparing the next few years worth of schedules.

The post Time to make new release schedules appeared first on Fedora Community Blog.