Feeds

The diffoscope maintainers are pleased to announce the release of diffoscope version 274. This version includes the following changes:

[ Chris Lamb ] * Add support for IO::Compress::Zip >= 2.212. (Closes: #1078050) * Don't include debug output when calling dumppdf(1). * Append output from dumppdf(1) in more cases. (Closes: reproducible-builds/diffoscope#387) * Update copyright years. [ Mattia Rizzolo ] * Update the available architectures for test dependencies.

You find out more by visiting the project homepage.

Friday, 9 August 2024

KDE today announces the release of KDE Frameworks 6.5.0.

KDE Frameworks are 72 addon libraries to Qt which provide a wide variety of commonly needed functionality in mature, peer reviewed and well tested libraries with friendly licensing terms. For an introduction see the KDE Frameworks release announcement.

This release is part of a series of planned monthly releases making improvements available to developers in a quick and predictable manner.

New in this version Attica

• Support new version field on DownloadDescription. Commit.

Bluez Qt

• Manager: Fix connections for the connectedDevices list property. Commit.

Breeze Icons

• Add 22px color (and monochrome, using *-symbolic) category icons. Commit. Fixes bug #489347
• Make 16px list-remove-symbolic be a link to the base icon. Commit.
• Add symlinks for Crow Translate icons. Commit. Fixes bug #489984
• Add flatpak symlink for Git Cola. Commit.
• Add icon to indicate adding to a playlist immediately after the current track. Commit. See bug #429942

Extra CMake Modules

• Prefix.sh.cmake add MANPATH. Commit.
• FindWaylandScanner: Add flag to use private-code. Commit.

Framework Integration

• Plasma_workspace.notifyrc: relabel to match button. Commit.

KArchive

• Allow passing QIODevice::Truncate in open mode. Commit.

KAuth

• Allow the dbus backend to pass file descriptors as arguments. Commit.
• Ensure that qt dbus macros are available with KAUTH_BUILD_CODEGENERATOR_ONLY=ON. Commit.

KCMUtils

• AbstractKCM: Document what extraFooterTopPadding is for. Commit.
• AbstractKCM: remove false deprecation notice. Commit.

KCodecs

• Add static build support. Commit.

KColorScheme

• Bundle essential breeze color schemes as resource. Commit.

KConfig

• Ksharedconfig: move statercs to state dir. Commit.
• Explain what "desktop entry spec separator semantics" means. Commit.
• Reapply "don't create root-only readable files in /etc/xdg". Commit.
• Make Qt6Quick dependency for QML plugin private. Commit.
• Expose KWindowStateSaver in the QML interface. Commit.
• Sync config group on KWindowStateSaver::timerEvent. Commit.
• Don't do tests in ~/.kde-unit-test. Commit.

KCoreAddons

• Enable cppcheck. Commit.
• Add missing license header. Commit.
• Add QML Format example. Commit.
• [qml/formats] Drop no longer needed function. Commit.
• Remove obsolete doc comment. Commit.
• Replace deprecated globalMatch with globalMatchView. Commit.

KCrash

• Metadata: Include frameworks version number. Commit.
• Metadata: pass along qt version. Commit.
• Don't capture unused variable. Commit.
• Add CMakelint formatting commit to .git-blame-ignore-revs. Commit.
• ./CMakeLists.txt:26: Extra spaces between 'if' and its () [whitespace/extra]. Commit.

KDeclarative

• KeySequenceItem: be Accessible.Button, not Checkbox. Commit.
• KeySequenceItem: Use KMessageDialog for displaying conflict messages. Commit.
• Kquickcontrols: Drop validation code from KeySequenceHelper. Commit.
• Kquickcontrols: Use KeySequenceValidator in KeySequenceItem. Commit. Fixes bug #483199
• Kquickcontrols: Introduce private KeySequenceValidator type. Commit. See bug #483199

KFileMetaData

• [Extractors] Clarify Qt::Gui dependencies. Commit.

KGuiAddons

• Add missing license text. Commit.

KHolidays

• Kazakhstan: Add National Book Day. Commit.

KI18n

• Use more specific names for the functions. Commit.
• Add comment for translators in example code. Commit.
• Code cleanup. Commit.
• Minor Doxygen change. Commit.
• Build with older clang versions too. Commit.
• Test also retranslateFormatString. Commit.
• Make retranslateFormatString() call function from correct namespace and adjust code documentation. Commit.
• Add helper method for setting a plural-aware spin box prefix/suffix. Commit.

KIconThemes

• Fix icon recoloring for portable installers. Commit.
• Overhaul KIconEngine docs. Commit.
• Deprecate KIconLoader::drawOverlays. Commit.
• Deprecate movie loading API. Commit.
• Add back effect into cache key. Commit. Fixes bug #490795
• Deprecate KIconEffect::apply API. Commit.
• Refactor icon effect application. Commit.
• [kiconeffect] Add static API for active effect. Commit.
• [kiconeffect] Add static API for disabled effect. Commit.
• [kiconeffects] Drop color and color2 members. Commit.
• [kiconeffects] Don't read effect settings from kconfig. Commit.
• [kiconeffect] Replace raw numbers with relevant enum. Commit.
• Add note to prefer QIcon::fromTheme over KIconLoader. Commit.
• Remove edit-specific directives. Commit.

KImageformats

• JXL: added ImageTransformation option. Commit.
• Xcf: Fix crash on malformed files. Commit.
• Pcx: Fix crash in broken files. Commit.
• Xcf: Fix crash on broken files. Commit.
• Pcx: fix crash on invalid files. Commit.
• Pcx: fix crash on invalid files. Commit.
• Exr: added some usefull attributes. Commit.
• Pcx: Read 16 color images that are 4bpp and 1 plane. Commit.
• Full range HDR support. Commit.
• Prepare gitlab for files that are coming int the next commit. Commit.
• Avif: check return values. Commit.
• Raw: Fix compiler warning with macro redefinition in Windows. Commit.

KIO

• KFileWidget: reset preview to selected file on hover leave. Commit. See bug #418655
• Drop unused methods from ConnectionServer. Commit.
• Un-PIMPL ConnectionServer. Commit.
• Properly log errors in ConnectionServer::listenForRemote(). Commit.
• Beef up connection error logging. Commit.
• [kprocessrunner] Also request an XDG activation token with StartupNotify=false. Commit.
• Port from KIconLoader::drawOverlays to KIconUtils::addOverlays. Commit.
• Kdirmodel: fix case when first deleted item was hidden. Commit.
• Kfileitem: show relative path for rel symlink. Commit. Fixes bug #456198
• File_unix: extract readLinkToBuffer to fn. Commit.
• Kshellcompletion: remove unused variable. Commit.
• KFilePlacesView: Show free space info in the tooltip. Commit.
• KFilePlacesView: Show label in tooltip if it is elided. Commit. Fixes bug #454436
• KFilePlacesItem: Add tooltip. Commit.
• Ksamba: correct isAclValid regex. Commit.
• DeleteOrTrashJob: emitResult with ERR_USER_CANCELED when cancelling prompt. Commit.
• Alter permissions of the right file. Commit.
• Try to fix test if umask is not as expected. Commit.
• Enable one more test that works for me. Commit.
• Ensure the wanted one second diff. Commit.
• Make test more deterministic. Commit.
• Less pollution of the home with test tmp files. Commit.
• Port away from deprecated KIconEffect API. Commit.
• Kprocessrunner: small code improvements. Commit.
• Lookup QWidget parent at runtime. Commit.
• Remove unused includes. Commit.
• Drop SessionData. Commit.
• Move useragent handling code into HTTP worker. Commit.
• Remove unused member. Commit.
• Drop dead metadata. Commit.
• Cache KFileItem::isHidden result. Commit.
• Avoid reparsing mount points for each directory on destruction. Commit.
• Remove parent for DropMenu. Commit. Fixes bug #490183
• Systemdprocessrunner: escape $ in arguments. Commit.
• API dox: help doxygen to not auto-detect first sentence end after "i.e.". Commit.
• API dox: document CamelCase include for KFileFilter. Commit.

Kirigami

• Relicense MenuDialog and PromptDialog to LGPL. Commit.
• GlobalDrawerActionItem: Fix tooltip. Commit.
• ContextualHelpButton: make text always accessible. Commit.
• Convert license headers to SPDX. Commit.
• Port dialogs to pragma ComponentBehavior: Bound. Commit.
• Dialog: Support variable base padding. Commit.
• Dialog: Add some null safety. Commit.
• Dialog: Fix ScrollView::contentItem management. Commit.
• We can Use directly nullptr. Commit.
• Fix: install KirigamiPrivate soversion. Commit.
• NavigationTabButton: Drop bold font workaround. Commit.

KItemModels

• Fix incorrect QML element name in documentation. Commit.

KNewStuff

• Support new version field on DownloadLinkInformation. Commit.
• QML: Use some better property types. Commit.
• EntryDetails.qml: Qualify newStuffModel, use downloadItemId. Commit. Fixes bug #483659
• Use KPackageJob::update instead of ::install. Commit.

KNotifications

• Allow to build on oses without dbus and any other backend. Commit.

KParts

• Use the correct check to determine whether initial preference should be read from KParts or KPlugin. Commit.

KPeople

• Make locks actually lock. Commit.

KService

• Store canonicalFilePath instead of looking it up twice. Commit.
• Use canonicalFilePath instead of absoluteFilePath. Commit.
• Use absolute path to mimeapps.list. Commit.

KStatusNotifieritem

• Add API to control quit behavior. Commit.

KSVG

• FindInCache: Compare last modified to boot time if timestamp is 0. Commit. Fixes bug #453876
• Drop dead code. Commit.

KTextEditor

• Fix drag pixmap with wrapped lines. Commit. Fixes bug #476979
• Add actions to convert spaces to tabs and vice versa. Commit. Fixes bug #456736
• Use ktexteditor-script-tester6 for javascript tests. Commit.
• Fix -Woverflow warning with gcc. Commit.
• Templates: Remove one level of nesting. Commit.
• Ignore buffer signals in completion on undo/redo. Commit.
• CursorToOffset: remove unnecessary line variable. Commit.
• Fix formatting. Commit.
• Src/view/kateview.cpp (KTextEditor::ViewPrivate::setupActions) : Fix typo in m_toggleShowSpace and m_toggleDynWrap whatsThis text. Commit.
• Treat 0x0000 to 0x001F as non-printable. Commit.
• Add action to quick toggle space visibility. Commit.

KWidgetsAddons

• Fix that last line in fonts list is only half visible. Commit. Fixes bug #488079
• Avoid the creation of toplevel widget. Commit. Fixes bug #490712
• Remove unused license text. Commit.
• Partially revert cccaa8f89897146043a535d45a276e3a57412815. Commit.
• Deprecate KJobWidgets::setWindowHandle,windowHandle. Commit.
• Fix tab not highlighted in some cases. Commit.
• Fix multiple overlays being installed over tab. Commit. Fixes bug #490213

KXMLGUI

• Remove QTreeWidgetHack, the methods are public now. Commit.
• Fix compile error of krichtexteditor on Craft on Windows. Commit.

Network Manager Qt

• ConnectionSettings: Support MeCard SAE security type. Commit.

QQC2 Desktop Style

• ScrollBar: Fix custom scrolling behavior. Commit. Fixes bug #488092

Solid

• Udev/cpuinfo_arm: add M2 Pro/Max core variants. Commit.

Sonnet

• Downgrade qCWarning to qCDebug. Commit.
• Avoid initializing full HSpellDict when getting languages. Commit. Fixes bug #421451
• Fix SONNET_USE_QML=OFF by moving ECMQmlModule behind the conditional. Commit.

Syntax Highlighting

• Earthfile.xml: modernize highlighter to support Earthly 0.8 features. Commit.
• C++: add floating-point literal suffixes of C++23. Commit.
• Python: add some special variables and fix '' line continuation after a string. Commit.
• Add .clang-format and .clang-tidy files with YAML. Commit.
• Zig: fix range operator preceded by a number: [0..]. Commit.
• Odin: add raw string color. Commit.
• Update syntax highlighting for kdesrc-buildrc. Commit.
• Cmake.xml: update syntax for CMake 3.30. Commit.
• Inc version after done type adding. Commit.
• Hare: add done keyword. Commit.

Threadweaver

• Ensure windows tests work. Commit.
• Only enter loop if signal didn't arrive before that. Commit.
• Try to fix windows hang in tests. Commit.

Much like my last update things are going well. I am able to spend 2 full days every week on contribution and my commit activity has increased quite a lot. Many thanks to my sponsors: Palantir.net, OPTASY, and new ones who joined in the past few weeks: Vardot, OpenSense Labs, and Liip.ch.

Now some numbers, since the last update I committed 82 issues (worth 820 weighted issue credits), that’s about 33 issues per month (or 330 issue credits). That’s a few more issues per week than before. There is still room to increase the commit activity with more sponsors so don’t hesitate to check out how to sponsor my contribution in core.

1. Navigation LayoutBuilder UI has dead click zone
2. Update the Drupal logo in Drupal core with the 2024 brand evolution I like the new brand very much, it’s good to update the default icon
3. Update documentation for table.html.twig around table cells
4. Regression: The drawer in Safari is missing the drop shadow
5. Update the Drupal logo on the project page
6. Meeting notes: May 20th 2024 - Isomorphic rendering Meetings take time, I can now spend it more easily to keep updated and make sure everyone is aligned
7. Remove JavaScript from Views configuration form now that it is only CSS Removing JS code because CSS is so good now is always nice
8. Navigation overlay z-index is not defined
9. Update stylelint rule unit-allowed-list to include container query units
10. Navigation: Avoid layout builder form submit
11. Tab highlights for current/hover/click are too high up when other tabs have 2 lines of text
12. Mobile version of Navigation menu doesn’t properly reset Drupal.displace() on closing
13. core.libraries.yml mis-implements moved_files syntax
14. When configuring a field on a content type’s “manage display” tab the spinner shifts the label and format column
15. #states not working correctly when built from a logical combination of multliple fields
16. Responsive image width/height values are not used from fallback image style
17. Custom Navigation logo is disconnected from new Layout template
18. CKEditor 5 Styles dropdown broken when in off-canvas sidebar
19. [drupalMedia] Ability to mark image media as “decorative”
20. Refactor (if feasible) use of jquery parseHTML function to use vanillaJS removing jQuery one method at a time
21. drupalInstallModule nightwatch function does not work with Experimental modules
22. Prefer to use Array.prototype.includes() for some of Array.prototype.indexOf()
23. Claro: Autocomplete dropdown bleeds through sticky table header
24. Refactor Claro’s table–file-multiple-widget stylesheet
25. “Single-Directory Components” needs to be hyphenated because of English grammar and content style rules
26. Trigger a JavaScript deprecation error for dialogClass in forked dialog.js
27. Update to jquery UI 1.14.0 beta 2 Bleeding edge of web development :)
28. Implement Nightwatch tests for Navigation module
29. Visually-hidden refresh button in Field UI fails WCAG Focus Visible.
30. Olivero: Incorrect positioning of close button on mobile device when navigation module is enabled.
31. The core/drupal.message library requires a status_messages render element
32. The [0] hatch in misc/vertical-tabs.js causes issues if there are multiple forms with vertical tabs. One thing jQuery does well is handle uncertainty much better than vanilla JS, and removing jQuery exposes us to that kind of things
33. Drupal core committers team meeting - Dev Days Burgas 2024
34. Reorder checkboxes on “Development settings” page
35. Secondary tabs design is distorted on block view page
36. Drupal core committers meeting 2024-06-11
37. Remove decoupled menus and media initiatives from MAINTAINERS
38. Update Drupal’s default throbber icons Using svg instead of gifs, overdue
39. Update loading icon and use SVG
40. Layout shift on displays in views page
41. Remove documentation for readmore, logged_in and is_admin from node.html.twig
42. Remove legacy ‘metadata’ variable from node.html.twig
43. Prevent simultaneous open/close on simultaneous click/hover Navigation still needs polish, this one helped quite a bit with regular use
44. Long string breaks the layout of Claro (reapply fix)
45. Spacing issue in Home > Search page on Advanced search section
46. Autocomplete input text can visibly overflow under magnifier icon
47. Refactor Claro’s tabledrag stylesheet
48. Have a dedicated category for blocks provided by the Navigation module
49. ToolbarStoredStateTest needs wait after resizing window
50. The link on the Image tag is redirecting to an undefined page from the node preview screen
51. clarify db settings for run-tests.sh example command
52. Parameters doc for views “row” should be at the top level of the array
53. Consolidate Umami performance tests
54. Optimize TelephoneFieldTest
55. hook_local_tasks_alter() and hook_menu_local_tasks_alter() need mutual @see links
56. Update to ckeditor 42.0.2
57. Consolidate methods on FormElementsLabelsTest
58. Merge the build and lint stages in core MR pipelines Tests go faster
59. Fix Field UI tests that rely on UID1’s super user behavior
60. Single directory component CSS asset library not picked up in admin theme immediately after module install without cache clear
61. Replace t() calls inside of Controllers that do not use StringTranslationTrait
62. Render API overview should include a link to the list of elements
63. Resync .gitlab-ci.yml and .gitignore following Yarn 4 in 11.x
64. Merge test methods in FieldUIRouteTest for better performance
65. Fix File tests that rely on UID1’s super user behavior
66. Stop using a data provider in UserPasswordResetTest
67. More efficient route lookup caching
68. Update deprecation notices in ajax.js
69. Consolidate ckeditor5’s FunctionalJavascript tests More test speed
70. Drupal Displace outputs invalid value for --drupal-displace-offset-right when opening top dialog
71. Subpixel rounding issue causes dialog to resize unnecessarily That one had a funky side effect when resizing the browser window. It’s gone now :)
72. Document that Uuid::isValid() only considers lowercase UUIDs as valid
73. Menu system docs section gives wrong alter hook
74. standardize docs on how to use the 4 types of test base
75. Update to jQuery UI 1.14.0
76. Add example and sections to Block API documentation
77. FileSystemInterface::copy documentation is inaccurate
78. Use artifacts to share the eslint and styleint caches from core to MRs
79. New throbber SVG images lack xmlns attribute
80. Drupal core committers meeting 2024-08-05
81. Drupal core committers meeting 2024-07-01
82. Document the recommended ways to obtain the database connection object

There were too many to comment each one individually. Many issues on stabilizing the new navigation module, making core tests faster, and documentation.

If you’re interested in supporting my work on Drupal core and keep the frontend fixes coming, consider sponsoring me.

Only Seven Days to Submit Your Session! Published Date Thursday, August 8th, 2024 - 04:47 pm bcross Thu, 08/08/2024 - 16:47 Do It This Week! 

Twin Cities Drupal Camp 2024 kicks off on September 12th-13th, on the University of Minnesota Twin Cities campus. The deadline for Session Submission is only a week away on August 15th. You still have time to send in your session proposals to help create this event. 

We have received many great new sessions for Twin Cities Drupal Camp 2024. Read our the Blog post “Send Us Your Session” to find a sampler of accepted sessions and ideas from last year's camp.

Submitting Your Session is Easy 

Simply fill out the submission form with your session title, description, and any additional details you’d like to provide. 

Our session review team will go through all submissions in order to select a diverse and engaging lineup of sessions for Twin Cities Drupal Camp 2024. Sessions will be accepted on a rolling basis. This means you are more likely to get your session accepted if you send it in today! 

Submit a Session

Posted In Drupal Planet

It’s August! For many of us, that means it’s time for hot weather and perhaps even a vacation.

But if you’re a Python/Pandas nerd like me, it’s is the perfect time to level up your programming skills. And in the coming weeks, I’ll be offering 13 (!) live, online courses on a wide variety of Python and Pandas topics, including some I’ve never before taught online.

Here’s what you can expect in all of these courses:

• In-depth explanations that go beyond the syntax
• Examples, including practical connections to real-world problems
• Exercises that help you to solidify the ideas I’ve taught
• Live coding into Jupyter, rather than teaching with slides
• Plenty of time for you to ask questions
• Lots of dad jokes

All of the classes will be recorded, so if you cannot make them at the official time, you can always watch later. I’ll also provide the Jupyter notebook and any other files I used, so that you can replay the lesson at home.

Here’s what I’ve scheduled so far; I expect to release more dates and topics in the coming weeks:

• Wednesday, August 14th: Data cleaning in Pandas
• Wednesday, August 14th: Complex Pandas queries with method chaining
• Thursday, August 15th: Design patterns in Python
• Sunday, August 18th: Python decorators
• Monday, August 19th: Textual data in Pandas
• Monday, August 19th: CSV files in Pandas
• Tuesday, August 20th: Command-line tools in Python
• Wednesday, August 21st: Grouping and pivot tables in Pandas
• Sunday, August 25th: Polars
• Monday, August 26th: Scraping with BeautifulSoup and Scrapy
• Tuesday, August 27th: Intro to FastAPI
• Sunday, September 1st: Intro to machine learning with sklearn
• Tuesday, September 3rd: asyncio

You can, of course, buy these courses individually. But they’re included in my membership programs, via LernerPython.com. The Python and Web courses are available to all members, while the Pandas and machine-learning courses are available to people who join my Python+Data membership level.

Which means: If you join me at LernerPython.com, then you get access to these courses, plus my entire catalog, plus a forum for discussion and questions, plus office hours where you can ask any questions you have. If you get a Python+Data membership, then you’ll get Bamboo Weekly, as well, with weekly Pandas challenges based on current events.

Note that my normal discounts for students, retirees/pensioners, and people in non-rich countries all apply; e-mail me at reuven@lerner.co.il if you qualify for any of these.

I’m super excited to be offering these courses, and will be back in a few weeks with even more offerings.

Meanwhile, I’m always happy to hear your questions and thoughts at reuven@lerner.co.il. All messages go straight to my personal inbox!

The post Level up your Python skills this August appeared first on Reuven Lerner.

A few weeks ago, we introduced the concept of "tracks" as the next step in progressing the Drupal Starshot project. Tracks are smaller, focused parts of the project that allow for targeted development and contributions.

At the same time, we put out a call for Starshot track leads, and were overwhelmed by the response. We received nearly 65 submissions, showcasing a wide range of expertise and ambitious vision that made for a difficult review process.

Announcing new track leads

We are proud to announce the newest track leads, who bring to the Starshot team an impressive depth of experience both in Drupal and in their respective track space:

• Laurens Van Damme from Dropsolid will be leading the Blog recipe track
• Jürgen Haas from LakeDrops will lead the Privacy track
• Christian López Espínola and Matthew Tift from Lullabot will lead the Dashboard track
• Jim Birch from Kanopi and John Doyle from Digital Polygon will lead the Sitewide SEO recipe track
• Jamie Abrahams from FreelyGive will lead the AI track
• Tony Barker from Annertech will lead the Media management track
• Baddy Sonja and the team at 1xinternet will lead the Advanced search track
• Gareth Alexander from Zoocha will lead the Accessibility tools track
• Dharizza Espinach and the team at Evolving Web will lead the Analytics track
• Pavlos Daniel from Acquia will lead the Multilingual content track

Although we announced the concurrent editing track, this is an aspirational feature that we would love to see but have postponed because it will depend heavily on Experience Builder.

Further opportunities with tracks

If you've read the Starshot strategy that Dries shared, you may have noticed that there are capabilities listed that do not yet have a track. We will be creating more tracks ongoing, to align with this strategy as the need arises (and as our capacity allows!).

There are also three existing tracks that we have not yet assigned a lead:

• Starshot documentation
• Contact form
• Content publishing workflows

If you are interested in leading one of these, make sure to review the issues for information about what we are aiming for, as well as the track lead role description. Your vision for the track, which need only be a short summary of how you plan to approach it, should take these into account when you submit an application. 

Next steps for tracks

For most tracks, the initial work will be to put together a proposal, which may require research to define the key requirements for our target persona and determine what feature parity with market leaders looks like. The proposals will be shared with the community for consultation.

We also expect track leads to provide regular progress updates, with the format and frequency still to be determined.

If you want to contribute to one of the tracks, or just follow along, keep an eye on the meta issues in the Starshot queue or post a comment to put your hand up.

Are you ready for 11?

Even though you may have just upgraded your current site to Drupal 10, there’s a new version that’s already here! Do you need to upgrade? If so, when?

Let's take a quick look at what 11.0 has to offer.

I started writing blog 20 years ago, not on this domain, but this blog still has all the old posts starting from 8th August 2004. Though I used to write mostly one line blog posts, which is equivalent of Mastodon posts these days.

I started writing another blog, but in Swedish. So that I can feel less scared with the language.

Tools used

• Started on blogspot in 2004
• Moved to Wordpress in 2007
• Moved to Nikola, first time for me in static blogging system in 2012.
• Moved to Shonku my Golang based static blogging tool in 2013.
• Moved to khata moved to my Rust based blogging tool in 2019.

Hopefully I will write more in the coming months. But, who knows :)

Here's what I've been working on for my LocalGov Drupal contributions this week. Thanks to Big Blue Door for sponsoring the time to work on these.

Welcome to the July 2024 report from the Reproducible Builds project!

In our reports, we outline what we’ve been up to over the past month and highlight news items in software supply-chain security more broadly. As always, if you are interested in contributing to the project, please visit our Contribute page on our website.

Table of contents:

1. Reproducible Builds Summit 2024
2. Pulling Linux up by its bootstraps
3. Towards Idempotent Rebuilds?
4. AROMA: Automatic Reproduction of Maven Artifacts
5. Community updates
6. Android Reproducible Builds at IzzyOnDroid with rbtlog
7. Extending the Scalability, Flexibility and Responsiveness of Secure Software Update Systems
8. Development news
9. Website updates
10. Upstream patches
11. Reproducibility testing framework

Reproducible Builds Summit 2024

Last month, we were very pleased to announce the upcoming Reproducible Builds Summit, set to take place from September 17th — 19th 2024 in Hamburg, Germany. We are thrilled to host the seventh edition of this exciting event, following the success of previous summits in various iconic locations around the world, including Venice, Marrakesh, Paris, Berlin and Athens. Our summits are a unique gathering that brings together attendees from diverse projects, united by a shared vision of advancing the Reproducible Builds effort. During this enriching event, participants will have the opportunity to engage in discussions, establish connections and exchange ideas to drive progress in this vital field. Our aim is to create an inclusive space that fosters collaboration, innovation and problem-solving.

If you’re interesting in joining us this year, please make sure to read the event page, which has more details about the event and location. We are very much looking forward to seeing many readers of these reports there.

”Pulling Linux up by its bootstraps” (LWN)

In a recent edition of Linux Weekly News, Daroc Alden has written an article on “bootstrappable” builds. Starting with a brief introduction that…

… a bootstrappable build is one that builds existing software from scratch — for example, building GCC without relying on an existing copy of GCC. In 2023, the Guix project announced that the project had reduced the size of the binary bootstrap seed needed to build its operating system to just 357-bytes — not counting the Linux kernel required to run the build process.

The article goes onto to describe that “now, the live-bootstrap project has gone a step further and removed the need for an existing kernel at all.” and concludes:

The real benefit of bootstrappable builds comes from a few things. Like reproducible builds, they can make users more confident that the binary packages downloaded from a package mirror really do correspond to the open-source project whose source code they can inspect. Bootstrappable builds have also had positive effects on the complexity of building a Linux distribution from scratch […]. But most of all, bootstrappable builds are a boon to the longevity of our software ecosystem. It’s easy for old software to become unbuildable. By having a well-known, self-contained chain of software that can build itself from a small seed, in a variety of environments, bootstrappable builds can help ensure that today’s software is not lost, no matter where the open-source community goes from here

Towards Idempotent Rebuilds?

Trisquel developer Simon Josefsson wrote an interesting blog post comparing the output of the .deb files from our tests.reproducible-builds.org testing framework and the ones in the official Debian archive. Following up from a previous post on the reproducibility of Trisquel, Simon notes that “typically [the] rebuilds do not match the official packages, even when they say the package is reproducible”, Simon correctly identifies that “the purpose of [these] rebuilds are not to say anything about the official binary build, instead the purpose is to offer a QA service to maintainers by performing two builds of a package and declaring success if both builds match.”

However, Simon’s post swiftly moves on to announce a new tool called debdistrebuild that performs rebuilds of the difference between two distributions in a GitLab pipeline and displays diffoscope output for further analysis.

AROMA: Automatic Reproduction of Maven Artifacts

Mehdi Keshani, Tudor-Gabriel Velican, Gideon Bot and Sebastian Proksch of the Delft University of Technology, Netherlands, have published a new paper in the ACM Software Engineering on a new tool to automatically reproduce Apache Maven artifacts:

Reproducible Central is an initiative that curates a list of reproducible Maven libraries, but the list is limited and challenging to maintain due to manual efforts. [We] investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of Maven packages. Overall, our approach achieves an accuracy of up to 99.5% when compared field-by-field to the existing manual approach [and] we reveal that automatic reproducibility is feasible for 23.4% of the Maven packages using AROMA, and 8% of these packages are fully reproducible.

Community updates

On our mailing list this month:

• Nichita Morcotilo reached out to the community, first to share their efforts “to build reproducible packages cross-platform with a new build tool called rattler-build, noting that “as you can imagine, building packages reproducibly on Windows is the hardest challenge (so far!)”. Nichita goes onto mention that the Apple ecosystem appears to be using ZERO_AR_DATE over SOURCE_DATE_EPOCH. […]

• Roland Clobus announced that the Debian bookworm 12.6 live images are “nearly reproducible”, with more detail in the post itself and input in the thread from other contributors.

• As reported in last month’s report, Pol Dellaiera completed his master thesis on Reproducibility in Software Engineering at the University of Mons, Belgium. This month, Pol announced this on the list with more background info. Since the master thesis sources have been available, it has received some feedback and contributions. As a result, an updated version of the thesis has been published containing those community fixes.

• Daniel Gröber asked for help in getting the Yosys documentation to build reproducibly, citing issues in inter alia the PDF generation causing differing CreationDate metadata values.

• James Addison continued his long journey towards getting the Sphinx documentation generator to build reproducible documentation. In this thread, James concerns himself with the problem that even “when SOURCE_DATE_EPOCH is configured, Sphinx projects that have configured their copyright notices using dynamic elements can produce nonsensical output under some circumstances.” James’ query ended up generating a number of replies.

• Allen ‘gunner’ Gunner posted a brief update on the progress the core team is making towards introducing a Code of Conduct (CoC) such that it is “in place in time for the RB Summit in Hamburg in September”. In particular, gunner asks “if you are interested in helping with CoC design and development in the weeks ahead, simply email rb-core@lists.reproducible-builds.org and let us know”. […]

Android Reproducible Builds at IzzyOnDroid with rbtlog

On our mailing list, Fay Stegerman announced a new Reproducible Builds collaboration in the Android ecosystem:

We are pleased to announce “Reproducible Builds, special client support and more in our repo”: a collaboration between various independent interoperable projects: the IzzyOnDroid team, 3rd-party clients Droid-ify & Neo Store, and rbtlog (part of my collection of tools for Android Reproducible Builds) to bring Reproducible Builds to IzzyOnDroid and the wider Android ecosystem.

Extending the Scalability, Flexibility and Responsiveness of Secure Software Update Systems

Congratulations to Marina Moore of the New York Tandon School of Engineering who has submitted her PhD thesis on Extending the Scalability, Flexibility and Responsiveness of Secure Software Update Systems. The introduction outlines its contributions to the field:

[S]oftware repositories are a vital component of software development and release, with packages downloaded both for direct use and to use as dependencies for other software. Further, when software is updated due to patched vulnerabilities or new features, it is vital that users are able to see and install this patched version of the software. However, this process of updating software can also be the source of attack. To address these attacks, secure software update systems have been proposed. However, these secure software update systems have seen barriers to widespread adoption. The Update Framework (TUF) was introduced in 2010 to address several attacks on software update systems including repository compromise, rollback attacks, and arbitrary software installation. Despite this, compromises continue to occur, with millions of users impacted by such compromises. My work has addressed substantial challenges to adoption of secure software update systems grounded in an understanding of practical concerns. Work with industry and academic communities provided opportunities to discover challenges, expand adoption, and raise awareness about secure software updates. […]

Development news

In Debian this month, 12 reviews of Debian packages were added, 13 were updated and 6 were removed this month adding to our knowledge about identified issues. A new toolchain issue type was identified as well, specifically ordering_differences_in_pkg_info.

Colin Percival filed a bug against the LLVM compiler noting that building i386 binaries on the i386 architecture is different when building i386 binaries under amd64. The fix was narrowed down to “x87 excess precision, which can result in slightly different register choices when the compiler is hosted on x86_64 or i386” and a fix committed. […]

Fay Stegerman performed some in-depth research surrounding her apksigcopier tool, after some Android .apk files signed with the latest apksigner could no longer be verified as reproducible. Fay identified the issue as follows:

Since build-tools >= 35.0.0-rc1, backwards-incompatible changes to apksigner break apksigcopier as it now by default forcibly replaces existing alignment padding and changed the default page alignment from 4k to 16k (same as Android Gradle Plugin >= 8.3, so the latter is only an issue when using older AGP). […]

She documented multiple available workarounds and filed a bug in Google’s issue tracker.

Lastly, diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb uploaded version 272 and Mattia Rizzolo uploaded version 273 to Debian, and the following changes were made as well:

• Chris Lamb:

  • Ensure that the convert utility is from ImageMagick version 6.x. The command-line interface has seemingly changed with the 7.x series of ImageMagick. […]
  • Factor out version detection in test_jpeg_image. […]
  • Correct the import of the identify_version method after a refactoring change in a previous commit. […]
  • Move away from using DSA OpenSSH keys in tests as support has been deprecated and removed in OpenSSH version 9.8p1. […]
  • Move to assert_diff in the test_openssh_pub_key package. […]
  • Update copyright years. […]

• Mattia Rizzolo:

  • Add support for ffmpeg version 7.x which adds some extra context to the diff. […]
  • Rework the handling of OpenSSH testing of DSA keys if OpenSSH is strictly 9.7, and add an OpenSSH key test with a ed25519-format key […][…][…]
  • Temporarily disable a few packages that are not available in Debian testing. […][…]
  • Stop ignoring the results of Debian testing in the continuous integration system. […]
  • Adjust options in debian/source to make sure not to pack the Python sdist directory into the binary Debian package. […]
  • Adjust Lintian overrides. […]

Website updates

There were a number of improvements made to our website this month, including:

• Bernhard M. Wiedemann updated the SOURCE_DATE_EPOCH page to include instructions on how to create reproducible .zip files from within Python using the zipfile module. […]

• Chris Lamb fixed a potential duplicate heading on the Projects page. […]

• Fay Stegerman added rbtlog to the Tools page […] and IzzyOnDroid to the Projects page […], also ensuring that the latter page was always sorted regardless of the ordering within the input data files. […]

• Holger Levsen added Linus Nordberg to our global list of contributors […] as well as made a number of changes to the page for the upcoming Reproducible Builds summit later this year […][…][…][…].

• Mattia Rizzolo updated the Civil Infrastructure Platform logo […] and also updated the 2024 summit page […][…].

• Nichita Morcotilo added rattler-build to the Projects page. […][…][…]

• Pol Dellaiera updated the Academic Publications page, adding two publications. […][…]

Upstream patches

The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:

• Bernhard M. Wiedemann:

  • armagetron (date)
  • blaspp (hostname)
  • cligen (GnuTLSs date)
  • cloudflared (date)
  • dpdk (Sphinx doctrees)
  • fonttosfnt/xorg-x11-fonts (toolchain, date)
  • gegl (build machine details)
  • gettext-runtime (jar mtime)
  • kf6-kirigami+kf6-qqc2-desktop-style (race-condition)
  • kubernetes1.26 (backport upstream fix for random path)
  • lapackpp (hostname)
  • latex2html (nochecks)
  • libdb-4_8 (.jar modification time)
  • librcc (already merged upstream)
  • libreoffice (strip .jar mtimes + clucene-core toolchain)
  • maliit-keyboard (nocheck)
  • nautilus (date)
  • openblas (CPU type, fixed)
  • openssl-3 (random-related issue)
  • python-ruff (ASLR)
  • python3 (date, parallelism/race)
  • reproducible-faketools (0.5.2)
  • sphinx (GZip modification time)
  • sphinxcontrib (gzip mtime)

• Chris Lamb:

  • #1076368 filed against nautilus.
  • #1076507 filed against mccode.
  • #1076806 filed against meson-python.
  • #1077479 filed against debcraft.
  • #1077485 filed against pytest.
  • #1077601 filed against setuptools.

• Fridrich Strba:

  • javapackages-tools
  • ant
  • java-21-openjdk

• Evangelos Ribeiro Tzaras:

  • buffybox

Reproducibility testing framework

The Reproducible Builds project operates a comprehensive testing framework running primarily at tests.reproducible-builds.org in order to check packages and other artifacts for reproducibility. In July, a number of changes were made by Holger Levsen, including:

• Grant bremner access to the ionos7 node. […][…]
• Perform a dummy change to force update of all jobs. […][…]

In addition, Vagrant Cascadian performed some necessary node maintenance of the underlying build hosts. […]

If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:

• IRC: #reproducible-builds on irc.oftc.net.

• Mastodon: @reproducible_builds@fosstodon.org

• Mailing list: rb-general@lists.reproducible-builds.org

• Twitter: @ReproBuilds

There's no doubt that the ECA module is changing the way Drupal sites are built  - at least for those of us that use it regularly. I recently used it to pre-populate a form field on a node add page and it turned out to be easier than I figured it would be.

The task was to pass the value I wanted to pre-populate into the form via a query string variable. Something like:

https://mysite.ddev.site/node/add/article?myvalue=1

On the node add page, there exists an entity reference field whose value I'd like to pre populate with a value of 1 (myvalue). 

Modules required

Modules used in the following solution are:

• Token
• BPMN.iO for ECA
• ECA BPMN (part of ECA module)
• ECA Form (part of ECA module)
• ECA UI (part of ECA module)
• ECA Core (part of ECA module)

The Token module is required because the ECA model will access the myvalue query string value via a token. 

ECA components

The ECA Form module (a sub-module of ECA) provides the necessary components to achieve the goal. 

The Build Form event and the Form Field: Set Default Value task components are all that are needed. Configuration as follows:

Build Form event

• Restrict by form id: node-article-form
• Restrict by entity type ID: node
• Restrict by entity bundle: article

Form Field: Set Default Value task 

• Field name: field_linked_content
• Value: [current-page:query:myvalue]
   

Once the model is created and saved, enjoy the fruits of your labor!

Other potential solutions

Was ECA the only way to complete this task? Certainly not. A small custom module could be written to achieve the same goal. In addition, there's the Pre-populate and Entity prepopulate modules.

Why use an ECA-based solution then? If you're already using ECA on the project for something else, then I'd recommend this type of ECA solution in order to avoid adding an additional contrib module just for your pre-populating needs.
 

As we wrap up PyCon US 2024, we can’t express enough gratitude to everyone who joined us, whether in-person or online, and made our first time together in Pittsburgh, PA a special and unforgettable experience. Not to mention, a record-breaking year - for the first time since before 2020, PyCon US sold out in-person tickets with over 2,700 tickets sold!

We had an amazing and diverse group of community members join us for PyCon US 2024, attending from 95 different countries! By the numbers, we saw a total attendance of 2,991 – with 2,551 attendees joining us in person and 440 joining us online. We couldn’t be more grateful for all who supported the Python ecosystem and helped make PyCon US 2024 a huge success.

Check out a full comprehensive recap of this year’s PyCon US conference here:

Find more photos from PyCon US 2024, captured by PSF Board Member, Kushal Das, here. 

We are also excited to announce that all PyCon US 2024 recordings are now available on the PyCon US YouTube channel! Be sure to subscribe to our channel for notifications of any new content.

We send the biggest thank you to all the presenters and speakers for their time, energy, and efforts in providing the wonderful content presented at PyCon US 2024, as well as to our incredible AV team, Altitude C, for their hard work and attention to capture recordings and provide AV this year.

The attendees, volunteers, speakers, staff, and sponsors truly make PyCon US what it is! The work of the Python Software Foundation is only possible with you all. A huge heartfelt thank you to the whole community!

We can’t wait to see you all back in Pittsburgh, PA for PyCon US 2025! If you’d like to be notified when the CFP opens and when tickets go on sale, you can watch this blog or subscribe to PyCon US News. Until then, if you have any questions or feedback, please reach out to pycon-reg@python.org.

I’m finishing typing up this blog entry hours before my last 13 hour leg back home, after I spent 2 weeks in Busan, South Korea for DebCamp24 and DebCamp24. I had a rough year and decided to take it easy this DebConf. So this is the first DebConf in a long time where I didn’t give any talks. I mostly caught up on a bit of packaging, worked on DebConf video stuff, attended a few BoFs and talked to people. Overall it was a very good DebConf, which also turned out to be more productive than I expeced it would.

In the welcome session on the first day of DebConf, Nicolas Dandrimont mentioned that a benefit of DebConf is that it provides a sort of caffeine for your Debian motivation. I could certainly feel that affect swell as the days went past, and it’s nice to be excited about some ideas again that would otherwise be fading.

Recovering DPL

It’s a bit of a gear shift being DPL for 4 years, and DebConf Committee for nearly 5 years before that, and then being at DebConf while some issue arise (as it always does during a conference). At first I jump into high alert mode, but then I have to remind myself “it’s not your problem anymore” and let others deal with it.

It was nice spending a little in-person time with Andreas Tille, our new DPL, we did some more handover and discussed some current issues. I still have a few dozen emails in my DPL inbox that I need to collate and forward to Andreas, I hope to finish all that up by the end of August.

During the Bits from the DPL talk, the usual question came up whether Andreas will consider running for DPL again, to which he just responded in a slide “Maybe”. I think it’s a good idea for a DPL to do at least two terms if it all works out for everyone, since it takes a while to get up to speed on everything.

Also, having been DPL for four years, I have a lot to say about it, and I think there’s a lot we can fix in the role, or at least discuss it. If I had the bandwidth for it I would have scheduled a BoF for it, but I’ll very likely do that for the next DebConf instead!

Video team

I set up the standby loop for the video streaming setup. We call it loopy, it’s a bunch of OBS scenes that provide announcements, shows sponsors, the schedule and some social content. I wrote about it back in 2020, but it’s evolved quite a bit since then, so I’m probably due to write another blog post with a bunch of updates on it. I hope to organise a video team sprint in Cape Town in the first half of next year, so I’ll summarize everything before then.

It would’ve been great if we could have some displays in social areas that could show talks, the loop and other content, but we were just too pressed for time for that. This year’s DebConf had a very compressed timeline, and there was just too much that had to be done and that had to be figured out on the last minute. This put quite a lot of strain on the organisers, but I was glad to see how, for the most part, most attendees were very sympathetic to some rough edges (but I digress…).

I added more of the OBS machine setup to the videoteam’s ansible repository, so as of now it just needs an ansible setup and the OBS data and it’s good to go. The loopy data is already in the videoteam git repository, so I could probably just add a git pull and create some symlinks in ansible and then that machine can be installed from 0% to 100% by just installing via debian-installer with our ansible hooks.

This DebConf I volunteered quite a bit for actual video roles during the conference, something I didn’t have much time for in recent DebConfs, and it’s been fun, especially in a session or two where nearly none of the other volunteers showed up. Sometimes chaos is just fun :-)

Baekyongee is the university mascot, who’s visible throughout the university. So of course we included this four legged whale creature on the loop too!

Packaging

I was hoping to do more packaging during DebCamp, but at least it was a non-zero amount:

• Uploaded gdisk 1.0.10-2 to unstable (previously tested effects of adding dh-sequence-movetousr) (Closes: #1073679).
• Worked a bit on bcachefs-tools (updating git to 1.9.4), but has a build failure that I need to look into (we might need a newer bindgen) – update: I’m probably going to ROM this package soon, it doesn’t seem suitable for packaging in Debian.
• Calamares: Tested a fix for encrypted installs, and uploaded it.
• Calamares: Uploaded (3.3.8-1) to backports (at the time of writing it’s still in backports-NEW).
• Backport obs-gradient-source for bookworm.
• Did some initial packaging on Cambalache, I’ll upload to unstable once gtk-4-dev (4.14.0) is in unstable (currently in experimental).
• Pixelorama 1.0 – I did some initial packaging for Pixelorama back when we did the MiniDebConf Gaming Edition, but it had a few stoppers back then. Version 1.0 seems to fix all of that, but it depends on Godot 4.2 and we’re still on the 3 series in Debian, so I’ll upload this once Godot 4.2 hits at least experimental. Godot software/games is otherwise quite easy to run, it’s basically just source code / data that is installed and then run via godot-runner (godot3-runner package in Debian).

BoFs

Python Team BoF

Link to the etherpad / pad archive link and video can be found on the talk page: https://debconf24.debconf.org/talks/31-python-bof/

The session ended up being extended to a second part, since all the issues didn’t fit into the first session.

I was distracted by too many thing during the Python 3.12 transition (to the point where I thought that 3.11 was still new in Debian), so it was very useful listening to the retrospective of that transition.

There was a discussion whether Python 3.13 could still make it to testing in time for freeze, and it seems that there is consensus that it can, although, likely with new experimental features like disabling the global interpreter lock and the just in time compiler disabled.

I learned for the first time about the “dead batteries” project, PEP-0594, which removes ancient modules that have mostly been superseded, from the Python standard library.

There was some talk about the process for changing team policy, and a policy discussion on whether we should require autopkgtests as a SHOULD or a MUST for migration to testing. As with many things, the devil is in the details and in my opinion you could go either way and achieve a similar result (the original MUST proposal allowed exceptions which imho made it the same as the SHOULD proposal).

There’s an idea to do some ongoing remote sprints, like having co-ordinated days for bug squashing / working on stuff together. This is a nice idea and probably a good way to energise the team and also to gain some interest from potential newcomers.

Louis-Philipe Véronneau was added as a new team admin and there was some discussion on various Sphinx issues and which Lintian tags might be needed for Python 3.13. If you want to know more, you probably have to watch the videos / read the notes :)

Debian.net BoF

Link to the etherpad / pad archive link can be found on the talk page: https://debconf24.debconf.org/talks/37-debiannet-team-bof

Debian Developers can set up services on subdomains on debian.net, but a big problem we’ve had before was that developers were on their own for hosting those services. This meant that they either hosted it on their DSL/fiber connection at home, paid for the hosting themselves, or hosted it at different services which became an accounting nightmare to claim back the used funds. So, a few of us started the debian.net hosting project (sometimes we just call it debian.net, this is probably a bit of a bug) so that Debian has accounts with cloud providers, and as admins we can create instances there that gets billed directly to Debian.

We had an initial rush of services, but requests have slowed down since (not really a bad thing, we don’t want lots of spurious requests). Last year we did a census, to check which of the instances were still used, whether they received system updates and to ask whether they are performing backups. It went well and some issues were found along the way, so we’ll be doing that again.

We also gained two potential volunteers to help run things, which is great.

Debian Social BoF

Link to the etherpad / pad archive link can be found on the talk page: https://debconf24.debconf.org/talks/34-debiansocial-bof

We discussed the services we run, you can view the current state of things at: https://wiki.debian.org/Teams/DebianSocial

Pleroma has shown some cracks over the last year or so, and there are some forks that seem promising. At the same time, it might be worth while considering Mastodon too. So we’ll do some comparison of features and maintenance and find a way forward. At the time when Pleroma was installed, it was way ahead in terms of moderation features.

Pixelfed is doing well and chugging along nicely, we should probably promote it more.

Peertube is working well, although we learned that we still don’t have all the recent DebConf videos on there. A bunch of other issues should be fixed once we move it to a new machine that we plan to set up.

We’re removing writefreely and plume. Nice concepts, but it didn’t get much traction yet, and no one who signed up for these actually used it, which is fine, some experimentation with services is good and sometimes they prove to be very popular and other times not.

The WordPress multisite instance has some mild use, otherwise haven’t had any issues.

Matrix ended up to be much, much bigger than we thought, both in usage and in its requirements. It’s very stateful and remembers discussions for as long as you let it, so it’s Postgres database is continuously expanding, this will also be a lot easier to manage once we have this on the new host.

Jitsi is also quite popular, but it could probably be on jitsi.debian.net instead (we created this on debian.social during the initial height of COVID-19 where we didn’t have the debian.net hosting yet), although in practice it doesn’t really matter where it lives.

Most of our current challenges will be solved by moving everything to a new big machine that has a few public IPs available for some VMs, so we’ll be doing that shortly.

Debian Foundation Discussion BoF

This was some brainstorming about the future structure of Debian, and what steps might be needed to get there. It’s way too big a problem to take on in a BoF, but we made some progress in figuring out some smaller pieces of the larger puzzle. The DPL is going to get in touch with some legal advisors and our trusted organisations so that we can aim to formalise our relationships a bit more by the time it’s DebConf again.

I also introduced my intention to join the Debian Partners delegation. When I was DPL, I enjoyed talking with external organisations who wanted to help Debian, but helping external organisations help Debian turned out to be too much additional load on the usual DPL roles, so I’m pursuing this with the Debian Partners team, more on that some other time.

This session wasn’t recorded, but if you feel like you missed something, don’t worry, all intentions will be communicated and discussed with project members before anything moves forward. There was a strong agreement in the room though that we should push forward on this, and not reach another DebConf where we didn’t make progress on formalising Debian’s structure more.

Social

Conference Dinner

Conference Dinner Photo from Santiago

The conference dinner took place in the university gymnasium. I hope not many people do sports there in the summer, because it got HOT. There was also some interesting observations on the thermodynamics of the attempted cooling solutions, which was amusing. On the plus side, the food was great, the company was good, and the speeches were kept to a minimum, so it was a great conference dinner, even though it was probably cut a bit short due to the heat.

Cheese and Wine

Cheese and Wine happened on 1 August, which happens to be the date I became a DD at DebConf17 in Montréal seven years before, so this was a nice accidental celebration of my Debiversary :)

Since I’m running out of time, I’ll add some more photos to this post some time after publishing it :P

Group Photo

As per DebConf tradition, Aigars took the group photo. You can find the high resolution version on Debian’s GitLab instance.

Debian annual conference Debconf 24, Busan, South Korea
Photography: Aigars Mahinovs aigarius@debian.org
License: CC-BYv3+ or GPLv2+

Talking

Ah yes, talking to people is a big part of DebConf, but I didn’t keep track of it very well.

• I mostly listened to Alper a bit about his ideas for his talk about debian installer.
• I talked to Rhonda a bit about ActivityPub and MQTT and whether they could be useful for publicising Debian activity.
• Listened to Gunnar and Julian have a discussion about GPG and APT which was interesting.
• I learned that you can learn Hangul, the Korean alphabet, in about an hour or so (I wish I knew that in all my years of playing StarCraft II).
• We had the usual continuous keysigning party. Besides it’s intended function, this is always a good ice breaker and a way to for shy people to meet other shy people.
• … and many other fly-by discussions.

Stuff that didn’t happen this DebConf

• loo.py – A simple Python script that could eventually replace the obs-advanced-scene-switcher sequencer in OBS. It would also be extremely useful if we’d ever replace OBS for loopy. I was hoping to have some time to hack on this, and try to recreate the current loopy in loo.py, but didn’t have the time.
• toetally – This year videoteam had to scramble to get a bunch of resistors to assemble some tally light. Even when assembled, they were a bit troublesome. It would’ve been nice to hack on toetally and get something ready for testing, but it mostly relies on having something like a rasbperry pi zero with an attached screen in order to work on further. I’ll try to have something ready for the next mini conf though.
• extrepo on debian live – I think we should have extrepo installed by default on desktop systems, I meant to start a discussion on this, but perhaps it’s just time I go ahead and do it and announce it.
• Live stream to peertube server – It would’ve been nice to live stream DebConf to PeerTube, but the dependency tree to get this going got a bit too huge. Following our plans discussed in the Debian Social BoF, we should have this safely ready before the next MiniDebConf and should be able to test it there.
• Desktop Egg – there was this idea to get a stand-in theme for Debian testing/unstable until the artwork for the next release is finalized (Debian bug: #1038660), I have an idea that I meant to implement months ago, but too many things got in the way. It’s based on Juliette Taka’s Homeworld theme, and basically transforms the homeworld into an egg. Get it? Something that hasn’t hatched yet? I also only recently noticed that we never used the actual homeworld graphics (featuring the world image) in the final bullseye release. lol.

So, another DebConf and another new plush animal. Last but not least, thanks to PKNU for being such a generous and fantastic host to us! See you again at DebConf25 in Brest, France next year!

The Drupal website experienced a brief outage, but the issue has been resolved by the team. Fran Garcia Linares provided updates during the downtime, assuring users that the team was working on restoring services.

Presenting "Self-hosted DDEV on GitHub Actions" by Jon Pugh at DrupalGovCon 2024 Jon Pugh Thu, 08/08/2024 - 07:18

Next week I'm headed to DrupalGovCon 2024 to present on a brand new technique I created for hosting fast and reliable preview/test environments using DDEV and GitHub Actions.

DDEV supports what they call "Casual Hosting". With the right config tweaks, you can run multiple DDEV sites on a server for hosting sites on the internet.

JAKALA, the leading data and AI-driven portfolio company of Ardian Buyout has acquired FFW, a key player in digital experience solutions. This acquisition, the largest non-publicly traded digital agency deal in Europe for 2023, expands JAKALA's global footprint and service offerings, pushing its workforce to over 3,000 professionals and turnover beyond €500 million. The merger aims to enhance client experiences through combined expertise in data, technology, and AI.

Akademy needs you! Volunteering is a great way to make new friends and Akademy wouldn't be possible without us all pitching in to make it happen. Find a task or two that sounds fun and sign yourself up! All you need to do is add yourself to a timeslot on the wiki page

Drupal and AEM are two popular content management systems used by many companies. They offer advanced features for creating, editing, and publishing content but differ in many ways. In this article, we will compare Drupal to AEM to help you find the right CMS for your needs.

DebConf24 is now over! I'm very happy I was able to attend this year. If you haven't had time to look at the schedule yet, here is a selection of talks I liked.

What happens if I delete setup.py?: a live demo of upgrading to PEP-518 Python packaging

A great talk by Weezel showcasing how easy it is to migrate to PEP-518 for existing Python projects.

This is the kind of thing I've been doing a lot when packaging upstream projects that still use setup.py. I encourage you to send this kind of patch upstream, as it makes everyone's life much easier.

Debian on Chromebooks: What's New and What's Next?

A talk by Alper Nebi Yasak, who has done great work on running Debian and the Debian Installer on Chromebooks.

With Chromebooks being very popular machines in schools, it's nice to see people working on a path to liberate them.

Sequoia PGP, sq, gpg-from-sq, v6 OpenPGP, and Debian

I had the chance to see Justus' talk on Sequoia — an OpenPGP implementation in Rust — at DebConf22 in Kosovo. Back then, the conclusion was that sq wasn't ready for production yet.

Well it seems it now is! This in-depth talk goes through the history of the project and its goals. There is also a very good section on the current OpenPGP/LibrePGP schism.

Chameleon - the easy way to try out Sequoia - OpenPGP written in Rust

A very short talk by Holger on Chameleon, a tool to make migration to Sequoia easier.

TL;DW: apt install gpg-from-sq

Protecting OpenPGP keyservers from certificate flooding

Although I used to enjoy signing people's OpenPGP keys, I completely gave up on this practice around 2019 when dkg's key was flooded with bogus certifications and have been refusing to do so since.

In this talk, Gunnar talks about his PhD work on fixing this issue and making sure we can eventually restore this important function on keyservers.

Bits from the DPL

Bits from the DPL! A DebConf classic.

Linux live patching in Debian

Having to reboot servers after kernel upgrades is a hassle, especially with machines that have encrypted disk drives.

Although kernel live patching in Debian is still a work in progress, it is encouraging to see people trying to fix this issue.

"I use Debian BTW": fzf, tmux, zoxide and friends

A fun talk by Samuel Henrique on little changes and tricks one can make to their setup to make life easier.

Ideas to Move Debian Installer Forward

Another in-depth talk by Alper, this time on the Debian Installer and his ideas to try to make it better. I learned a lot about the d-i internals!

Lightning Talks

Lighting talks are always fun to watch! This year, the following talks happened:

1. Customizing your Linux icons
2. A Free Speech tracker by SFLC.IN
3. Desktop computing is irrelevant
4. An introduction to wcurl
5. Aliasing in dpkg
6. A DebConf art space
7. Tiny Tapeout, Fomu, PiCI
8. Data processing and visualisation in the shell

Is there a role for Debian in the post-open source era?

As an economist, I've been interested in Copyright and business models in the Free Software ecosystem for a while. In this talk, Hatta-san and Bruce Perens discuss the idea of alternative licences that are not DFSG-free, like Post-Open.

I attended my first DebConf this year! It was held in Busan, South Korea, and the whole experience was a blast. It was really fun meeting new people, and I’m looking forward to DebConf 25 in Brest!

Here is a list of some of the things I did (and that I can remember) during DebCamp/DebConf:

• Reviewed pending merge requests for GCES students.
  • capistrano
  • aionotify
  • gtts-token
  • subliminal
• Helped with the ruby 3.3 transition.
  • ruby-rantly
  • ruby-liquid-c
• Started packaging build-deps for brutespray.
  • golang-github-atomicgo-cursor
  • golang-github-atomicgo-keyboard
  • golang-github-atomicgo-schedule
  • golang-github-pterm-pterm
  • golang-github-wenerme-astgo
• Prepared the Debian Brasilia section for the Bits from Brazil talk.
• Attended the Debian Curl Maintainers BoF.
• Tried to get curl pytest tests running when building the Curl package.
• Submitted my first patch to the Linux kernel (thanks, Helen!).
• Volunteered in the Video Team (I got a T-Shirt!).
• Participated in the (joke-ish) bid for DebConf Brasília.