lwn.net
Introducing Jpegli: A New JPEG Coding Library (Google Open Source Blog)
Jpegli can be encoded with 10+ bits per component. Traditional JPEG coding solutions offer only 8 bit per component dynamics causing visible banding artifacts in slow gradients. Jpegli's 10+ bits coding happens in the original 8-bit formalism and the resulting images are fully interoperable with 8-bit viewers. 10+ bit dynamics are available as an API extension and application code changes are needed to benefit from it.
The library is BSD-licensed.
[$] The PostgreSQL community debates ALTER SYSTEM
GNU Stow 2.4.0 released
Version 2.4.0 of the GNU Stow symbolic-link manager has been released. This marks the first release for GNU Stow since 2019. Maintainer Adam Spires wrote:
I would like to sincerely apologise to all Stow users for this incredibly overdue release, the cadence of which is perhaps vaguely reminiscent of releases by the great Donald Knuth, except with none of the grace and deliberate planning.Spires notes that this release "makes considerable efforts to make the internals more understandable and easy to maintain", and has put out a call for a co-maintainer.
Security updates for Monday
Kernel prepatch 6.9-rc3
Ok, so this rc3 looks a bit different than the usual ones, because there's a large series to bcachefs to do filesystem repair after corruption. Not normally something we'd see in an rc kernel, but hey, if you had a corrupted bcachefs filesystem you'd probably want this, and if you thought bcachefs was stable already, I have a bridge to sell you. Special deal only for you, real cheap.
Tridge returns to rsync
Wayne Davison has announced the release of rsync version 3.3.0, which contains a number of bug fixes and minor enhancements. Davison has also announced a change in maintainers and a move to a new GitHub project:
The github repos have moved to a new RsyncProject organization. Because various life events have been monopolizing my time, I reached out to Tridge [Andrew Tridgell] (the original author) and he has graciously agreed to get back into rsync work, along with Paul Mackerras, who was also an early contributor to rsync. This new team will be working mainly on maintenance tasks, and not so much on new features. If you want to get involved, feel free to reach out on the new discord RsyncProject channels.The new GitHub organization is here.
[$] A look at the 2024 Debian Project Leader election
The nominations have closed and campaigning is underway to see who will be the next Debian Project Leader (DPL). This year, two candidates are campaigning for the position Jonathan Carter has held for four eventful years: Sruthi Chandran and Andreas Tille. Topics that have emerged so far include how the prospective DPLs would spend project money, their opinions on handling controversial topics, and project diversity.
OpenBSD 7.5 released
Eclipse Foundation announces collaboration for CRA compliance
The Eclipse Foundation, the organization behind the Eclipse IDE and many other software projects, announced a collaboration between several different open-source-software foundations to create a specification describing secure software development best practices. This work is motivated by the European Union's Cyber Resilience Act (CRA).
The leading open source communities and foundations have for years developed and practised secure software development processes. These are processes that have often defined or set industry best practices around things such as coordinated disclosure, peer review, and release processes. These processes have been documented by each of these communities, albeit sometimes using different terminology and approaches. We hypothesise that the cybersecurity process technical documentation that already exists amongst the open source communities can provide a useful starting point for developing the cybersecurity processes required for regulatory compliance.(Thanks to Martin Michlmayr.)
FFmpeg 7.0 released
Security updates for Friday
Stable kernels 6.8.4 and 6.6.25
V8 incorporates new sandbox
V8, the JavaScript engine used in Chrome, announced that its memory sandbox is no longer experimental.
Chrome 123 could therefore be considered to be a sort of "beta" release for the sandbox. This blog post uses this opportunity to discuss the motivation behind the sandbox, show how it prevents memory corruption in V8 from spreading within the host process, and ultimately explain why it is a necessary step towards memory safety.[$] A focus on FOSS funding
Among the numerous approaches to funding the development and advancement of open-source software, corporate sponsorship in the form of donations to umbrella organizations is perhaps the most visible. At SCALE21x in Pasadena, California, Duane O'Brien presented a slice of his recent research into the landscape of such sponsorship arrangements, with an overview of the identifiable trends of the past ten years and some initial insights he hopes are valuable for sponsors and community members alike.
Incus 6.0 LTS released
Security updates for Thursday
[$] LWN.net Weekly Edition for April 4, 2024
AlmaLinux OS - CVE-2024-1086 and XZ (AlmaLinux blog)
AlmaLinux has announced updated kernels for AlmaLinux 8 and 9 to address CVE-2024-1086, a use-after-free vulnerability in the kernel that could be exploited to gain local privilege escalation. This is notable because the fix marks a divergence between AlmaLinux and Red Hat Enterprise Linux (RHEL):
In January of this year, a kernel flaw was disclosed and named CVE-2024-1086. This flaw is trivially exploitable on most RHEL-equivalent systems. There are many proof-of-concept posts available now, including one from our Infrastructure team lead, Jonathan Wright (Dealing with CVE-2024-1086). In multi-user scenarios, this flaw is especially problematic.
Though this was flagged as something to be fixed in Red Hat Enterprise Linux, Red Hat has only rated this as a moderate impact.
The AlmaLinux project would also like to note that it is not impacted by the XZ backdoor. "Because enterprise Linux takes a bit longer to adopt those updates (sometimes to the chagrin of our users), the version of XZ that had the back door inserted hadn't made it further than Fedora in our ecosystem."
Malcolm: Improvements to static analysis in the GCC 14 compiler
Solving the halting problem?
Obviously I'm kidding with the title here, but for GCC 14 I've implemented a new warning: -Wanalyzer-infinite-loop that's able to detect some simple cases of infinite loops.
See also: this report from the 2023 GNU Tools Cauldron.