Tumbleweed es una distribución de GNU/Linux «Rolling Release» o de actualización contínua. Aquí puedes estar al tanto de las últimas novedades.

openSUSE Tumbleweed es la versión «rolling release» o de actualización continua de la distribución de GNU/Linux openSUSE.

Hagamos un repaso a las novedades que han llegado hasta los repositorios esta semana.

Y recuerda que puedes estar al tanto de las nuevas publicaciones de snapshots en esta web:

• https://victorhck.gitlab.io/tumbleweed_snapshots/

El anuncio original lo puedes leer en el blog de Dominique Leuenberger, publicado bajo licencia CC-by-sa, en este este enlace:

• https://dominique.leuenberger.net/blog/2026/11/tumbleweed-review-of-the-week-2026-46/

Esta semana se ha publicado un total de 7 snapshots (1105, 1106, 1107, 1108, 1109, 1110, y 1111).

Estas son las actualizaciones más importantes de esta semana:

• AppStream 1.2.2
• ddcutil 3.0.2
• dracut 112+suse.63.g62ea8ea
• Firewalld 2.5.2
• GStreamer 1.28.9
• KDE Gear 26.08.3
• Libvirt 12.9.0
• Linux Kernel 7.3.3
• LVM2 2.03.44
• Mesa 26.2.6
• Mozilla NSS 3.132
• OpenSSH 10.6p2
• QEMU 11.1.3
• Rsync 3.5.2
• Shotwell 33.2

Y para próximas snapshots, ya se están preparando las siguientes actualizaciones:

• KDE Plasma 6.8.3
• Telegram Desktop 7.4.3
• systemd 262.2
• Apache 2.4.71
• Go 1.27.4
• Ruby 4.1
• Box2D 3.1.1
• ICU 79.1
• fmt 12.2.0

Si quieres estar a la última con software actualizado y probado utiliza openSUSE Tumbleweed la opción rolling release de la distribución de GNU/Linux openSUSE.

Mantente actualizado y ya sabes: Have a lot of fun!!

Enlaces de interés

• ¿Por qué deberías utilizar openSUSE Tumbleweed?
• zypper dup en Tumbleweed hace todo el trabajo al actualizar
• ¿Cual es el mejor comando para actualizar Tumbleweed?
• ¿Qué es el test openQA?
• http://download.opensuse.org/tumbleweed/iso/
• https://es.opensuse.org/Portal:Tumbleweed

——————————–

Dear Tumbleweed users and hackers,

This week saw the release of 7 snapshots (1105, 1106, 1107, 1108, 1109, 1110, and 1111).

It has been another brisk week of deliveries, clearing out several major items from our previous outlook. The spotlight belongs to KDE applications, with KDE Gear 26.08.3 landing in snapshot 1106 and providing welcome polish across apps like Dolphin, Gwenview, Kate, and Kontact. The graphics stack also took a significant step forward as Mesa 26.2.6 completed its journey through staging into snapshot 1111, alongside a quick fix in xorg-x11-server to restore driver ABI compatibility.

Security and core infrastructure also received their share of attention. OpenSSH 10.6p2 arrived in snapshot 1108, Linux Kernel stepped up to 7.3.3 in snapshot 1109, and GStreamer synchronized its multimedia framework with the 1.28.9 bugfix release. Additionally, orchestration tooling stayed current as Docker Compose 5.7.0 and Ansible 14.6.0 joined the product tree.

These 7 snapshots delivered the following updates:

• AppStream 1.2.2
• c-ares 1.34.9
• ddcutil 3.0.2
• dracut 112+suse.63.g62ea8ea
• exfatprogs 1.4.4
• Firewalld 2.5.2
• GDB 17.2
• GStreamer 1.28.9
• HarfBuzz 15.1.0
• KDE Gear 26.08.3
• Libvirt 12.9.0
• Linux Kernel 7.3.3
• LVM2 2.03.44
• Mesa 26.2.6
• Mozilla NSS 3.132
• OpenSSH 10.6p2
• Poppler 26.11.0
• python-cffi 2.1.1
• python-tornado6 6.6
• QEMU 11.1.3
• Rsync 3.5.2
• SDL3 3.4.20
• Shotwell 33.2
• TPM2 Tools 5.8

Peeking at what lies ahead, here is a look at what is currently working its way through the staging pipeline:

• KDE Plasma 6.8.3
• Telegram Desktop 7.4.3
• systemd 262.2
• Apache 2.4.71
• Go 1.27.4
• Ruby 4.1: Early tests to make this the default Ruby interpreter.
• Box2D 3.1.1
• ICU 79.1: Still breaking nodejs24 (nodejs/node#66987).
• fmt 12.2.0: Still blocked by dnf5 plugin rebuild issues (boo#1285868).

This was a busy weekend in Brno! It started on Friday with Open Open and continued on Saturday with openALT 2026. Two events, new partnership opportunities for openSUSE and SUSE, and this time my kids came along too.

Open Open 2026, Brno

Friday started at 9am with Open Open, an event organized by Otevřená města (Open Cities), where Dan Čermák from SUSE delivered one of the keynotes.

The organizers chose a very interesting spot in the heart of Brno, and the event was really well managed. It was also a nice opportunity to meet some friends from the past.

Open Open was almost flawless. There were many open source vendors, lawyers and people from the corporate open source world. Unfortunately, none of the city or town representatives showed up. That made the track aimed at municipalities a bit awkward, as the intended audience was missing. This definitely needs to be addressed for future events. Maybe each of the participants could help by reaching out to the town hall? This could be a nice ask for help from the organizers towards attendees.

The topics were interesting for us too, though. Generally, plenty of lawyers and open source companies, but missing cities!

Conversations and potential partnerships

It was nice to meet up again with Lucie Smolka and discuss potential legal cooperation on the openSUSE side, in case the separate legal entity recently suggested by our Data Protection team finally becomes a reality.

Having access to additional legal expertise would be very welcome, so we would not have to rely solely on the already super busy SUSE Legal team.

I also really enjoyed meeting G. Gabby Demirkiran, who seemed quite excited about the upcoming SUSE Hack Week 26. Hopefully she will join me and the rest of the SUSE folks in our Brno office from Nov. 30 to Dec. 5.

Another nice encounter was with Gina Plat from OpenProject. We talked about European alternatives to Jira and the ongoing conversations between OpenProject and SUSE. It was a really interesting conversation, especially given the growing interest in European open source solutions.

I was also happy to see Jaroslav Řezník from Red Hat and Roman Blanco advertising the upcoming openALT 2026, which was starting the very next day in Brno.

At the end of their talk, I simply had to stand up and endorse their focus on kids, especially the decision to bring Robotárna as a side track for the entire weekend. More on that later!

I also quite enjoyed the panel discussion at the end with Gina from OpenProject, Nicholas Gates from Open Forum Europe, Jennifer Tridgell from University of Cambridge and Jan Volmut from Open Cities.

There was also a quite nice afterparty. I was not among the first to leave, but still left early enough to catch a bus home and see my kids. I think I was home around 8pm.

openALT 2026, Brno

Saturday morning started with packing the car, including a rather large Geeko plushie and my kids.

I really enjoy taking my kids with me to conferences, much like I enjoyed business trips with my father when I was little. So naturally I wanted to bring them along, especially when I knew there would be a dedicated program where they could learn something new.

Marcela, who was helping with the openSUSE booth, had the same idea and brought her kids and husband too. So we ended up with quite a family crew at openALT this year.

Getting the next generation involved

As mentioned earlier, this year’s openALT teamed up with Robotárna to provide activities for kids. In previous years, the kids’ activities were handled by Miroslav Suchý, so it was nice to see the effort continuing and growing.

Many conferences offer retro gaming or Linux gaming, and while there is nothing wrong with that, I have to say it was really nice to see kids doing something productive and interesting.

We had a similar experience at LinuxDays a year ago, where the kids could try soldering. It is amazing how much they can learn when somebody gives them the right tools and a bit of guidance.

I asked the Robotárna folks whether they could bring their activities to next year’s openSUSE Conference 2027 in Prague.

They explained that they normally organize events only in the South Moravian region, but they are available to be hired for events elsewhere. So perhaps we can make something happen!

On the same topic, I had a discussion with Pavel Šimerda and his daughter about organizing some programming classes for youngsters.

Pavel Tišnovský also tentatively agreed to prepare something coding related, preferably for kids aged 15 and above.

Awesome! It seems like we will have some fun after all!

This topic has become increasingly important to me, especially after seeing the attendance at openSUSE Conference 2026.

Looking around the usual conference hall, there seems to be more and more gray hair, myself included, but not nearly enough new faces.

We need to make open source attractive to the younger generation. And I think giving kids an opportunity to create something, learn programming or simply play with technology is a great way to start.

I am really looking forward to seeing what we can prepare for the junior track at openSUSE Conference 2027.

The openSUSE booth at openALT 2026

The event itself was really nice. I did not attend many talks, as we were mostly busy at the booth.

For me, the main reason to attend conferences is networking. Meeting people, finding new contributors and trying to build new partnerships.

At our booth, we were mostly luring people to the upcoming openSUSE Leap 16.1 Release Party in Prague and educating them about openSUSE through our openSUSE Quiz.

We had also added a dedicated quiz for the Leap 16.1 release, so visitors could test their knowledge of the latest release.

New minigames in the openSUSE Quiz

We were also showcasing our new minigames in the quiz.

These were inspired by lessons learned at the recent openSUSE.Asia Summit in Indonesia, where many of the quizzes included an agility aspect.

Instead of answering only technical questions, participants had to tap on a moving green chameleon, swipe in the direction a chameleon was rotating, solve puzzles and perform similar little challenges.

As it turns out, the most knowledgeable open source folks are not necessarily equally good at agility games. Myself included! :-)))

I think this makes the quiz more balanced and entertaining, especially for visitors who might not yet know that much about openSUSE.

It was great to see people having fun with the quiz, and even better to see some of them learning something new along the way.

Supporting openALT and the Czech open source community

I also had a brief conversation with Roman Blanco from the openALT organizing team.

It was really heartwarming to hear him asking what openALT could do better for SUSE next year.

I really like the idea of being seen as a trusted partner who helps keep the local Czech open source engine running, while also putting some spotlight on both openSUSE and SUSE, which actually pays the bills.

Hopefully, we can do something similar at local conferences in other countries too.

I think we will certainly be looking into increasing our sponsorship of openALT next year, especially since Red Hat was no longer among the sponsors this year, and there was no Red Hat or Fedora booth either. That is a serious budget cut for an event like openALT.

Sometimes all it takes is to stand up and be willing to help. I do this because I enjoy it and because I believe local communities like this one matter. If you would like to see openSUSE at an event near you, consider this your invitation to do the same!

The organizers are also trying to expand the openALT brand beyond Brno, including other Czech cities such as České Budějovice.

It would be great to see these community events grow, and I would love for SUSE and openSUSE to remain part of that story.

Turning openSUSE users into contributors

One of the nicest highlights of our openALT presence was meeting our existing users and hopefully turning some of them into future contributors.

Let me explain. :-)

Even if visitors did not make it into the top scores of our quiz, we wanted to recognize people who were already using openSUSE.

If somebody could show us they were an openSUSE user, they left with one of our beautiful holographic stickers and a small Geeko plushie.

It was a small gesture, but a really nice way to thank people for using openSUSE and to start conversations about how they could get more involved.

Which reminds me that we will have to restock both our large and small Geeko plushies soon. We will probably be ordering more swag for openSUSE Conference 2027 in the upcoming months anyway.

Another highlight was meeting a talented artist named Michaela, who won the best contribution award during openALT and went home with one of our large Geeko plushies!

We figured out that she lives near our Prague office, which naturally turned into an invitation to the Leap 16.1 Release Party.

And she actually came, together with her friends! How cool is that? :-)

I think this was the first openALT where we did not have a talk, but we certainly made up for it with plenty of interactions with the public.

And that is exactly what makes these events worthwhile for me.

Looking ahead to openSUSE Conference 2027

Perhaps the biggest takeaway from the weekend is that community events are not just about talks and presentations.

They are about meeting people, building relationships and finding opportunities to work together.

We came home with new contacts, potential partnerships, ideas for the junior track at openSUSE Conference 2027 and, most importantly, kids who had a great time and want to come back.

Here is my little list of partnership leads I want to follow up on:

• Legal expertise with Lucie Smolka, should openSUSE get its own legal entity.
• Robotárna for a junior track at openSUSE Conference 2027 in Prague.
• Pavel Šimerda and Pavel Tišnovský for programming classes for kids and teenagers.
• openALT and a bigger SUSE sponsorship next year, including openALT events outside of Brno.

Marcela’s kids also agreed to help with the junior track at next year’s conference. What a nice way to make new partnerships! :-D

The openSUSE Conference 2027 will take place in Prague from June 11 to 13, with a pre-party on Friday at Vila Štvanice and the main conference over the weekend.

We are planning a dedicated junior track and would love to get more young people involved in open source.

If you have ideas for workshops, programming sessions, electronics, robotics or anything else that could be interesting for kids and teenagers, please reach out!

Thank you

Many thanks to the organizers of Open Open and openALT 2026 for putting together two great events in Brno.

Special thanks to Roman Blanco and the whole openALT team for their continued work on the Czech open source community, and to Robotárna for making the weekend interesting for our youngest visitors.

Many thanks also to Marcela and her family for helping with the booth, to everybody who stopped by for a chat, and to all our quiz participants.

And of course, thanks to my kids for joining me on yet another open source adventure.

I hope to see many of you again at the openSUSE Conference 2027 in Prague!

This is a roundup of articles from the openSUSE community listed on planet.opensuse.org. This community blog feed aggregator lists the featured highlights below from Nov. 6 - 12.

This week highlights the 2026 Google Summer of Code Mentor Summit, a malware warning about a third-party Plasma wallpaper, the openSUSE News announcement that Agama is coming to Tumbleweed, the community stepping up to keep the Packman repository alive, and the six Tumbleweed snapshots for week 45 headlined by GNOME 51.1, KDE Plasma 6.8.2 and Linux Kernel 7.3.1. It also covers the latest syslog-ng Insider newsletter, the November Tumbleweed ARM update, a revived Plasma 6 uptime widget, Plasma 6.8 system monitoring and control features, KDE Gear 26.08.3 and the KDE Gear 26.12 release schedule, Nate Graham’s widget-focused This Week in Plasma, a tribute to Aaron Swartz, Linux Saloon 227 and a look at a 128 GB AI workstation.

Here is a summary and links for each post:

Google Summer of Code Mentor Summit 2026

openSUSE News reports on the 2026 Google Summer of Code Mentor Summit, held in Munich from Oct. 30 to Nov. 1, where openSUSE was represented alongside the Uyuni project. The post shares takeaways on navigating cultural differences in mentoring, the debate over AI-generated contributions and proposals such as AI acceptable-use policies, plus advice on working with GSoC contributors through daily updates and open communication.

Neonova Wallpaper, a Third-Party KDE Plasma Extension That Includes Malware

Victorhck’s blog warns that malware was found in Neonova Wallpaper, a third-party Plasma extension hosted on GitHub, citing David Edmundson’s report and the KDE security team’s review. It explains how a hidden base64 script downloads a shared library into .config/Plasma6Library.so and loads it through LD_PRELOAD, and advises affected users to delete the file and the package while trusting only official repositories or reputable sources.

The syslog-ng Insider 2026-11: Tor; Java; Elasticsearch

The blog of Peter “CzP” Czanik shares the 143rd issue of the syslog-ng Insider newsletter, covering how Tor can harden a central syslog-ng server, the project’s scaling back of Java support and a guide to using syslog-ng with Elasticsearch 9.5 and Kibana. It also points readers to upcoming webinars and invites feedback and news tips for the next issue.

Tumbleweed ARM Monthly Update – November 2026

openSUSE News rounds up a month of openSUSE Tumbleweed ARM development, with snapshots on Oct. 18 and 20 and Nov. 5 and 8 bringing GRUB2 2.16, the first Linux kernel 7.3-series release at 7.3.1, u-boot 2026.10 for 64-bit Raspberry Pi boards and QEMU 11.1.3. The update covers ARM fixes for the Raspberry Pi camera and graphics stack, a broad Wi-Fi, Bluetooth and Tegra firmware refresh, the move to NVIDIA’s open 620.70.06 driver and gdb 17.2. It also notes the arrival of Plasma 6.8.2 and the GNOME 51 stack, plus security fixes in the kernel, curl, dnsmasq, expat and Firefox.

The Community Will Keep Maintaining the Packman Repository

Victorhck’s blog reports that the Packman repository will not be discontinued on Jan. 1, 2027, as previously announced, because long-time contributors have stepped forward to take it over. The service will continue as before while infrastructure, builds and repository transfer details are worked out in the background. The post thanks both the outgoing maintainers and the people who picked up the project after 25 years of service.

Thanks to Sam Altman… ;-)

The blog of Peter Czanik explains how a statement about RAM from Sam Altman motivated him to return to Linux and AI experiments on his 128 GB AI workstation. He describes updating Fedora from 44 to 45, applying gigabytes of openSUSE Tumbleweed updates, reinstalling ROCm after dependency problems and testing ollama with Open WebUI. The post includes sample output from llama3.2, gemma3:27b and granite4, and promises more useful experiments later.

Show Your System Uptime with This Plasma 6 Widget for KDE

Victorhck’s blog introduces a Plasma 6 port of Martin Kotelnik’s classic uptime widget, which displays system uptime with colorful circles. Victorhck kept the original GPL 2.0 license, published the updated code on Codeberg and added configuration options for visible elements, colors and transparency. The post includes download and installation instructions for the .plasmoid file and notes that an LLM helped with the code changes.

Agama Is Coming to Tumbleweed

openSUSE News announces that openSUSE Tumbleweed will switch to the Agama installer before the end of the year, with Agama-based images expected to replace the legacy YaST installer on get.opensuse.org in the coming weeks. Two test images are available, including a new offline installer with a pre-filled package cache and a network-based installer. The project is asking users to test RAID, LVM, multi-disk, serial-console and offline setups, and notes that the new installer offers curated patterns instead of individual package selection.

Widgets Widgets Widgets – This Week in Plasma

The KDE Blog translates Nate Graham’s latest “This Week in Plasma,” a widget-focused edition covering Plasma 6.9, Plasma 6.8.3 and Frameworks 6.32. Highlights include a new “picture of the day” wallpaper plugin featuring David Revoy’s artwork, configurable OSD popup positions, Glide browser integration, better keyboard interaction with the calculator widget, natural sorting in launcher menus and numerous widget styling and bug-fix improvements. The post also covers performance work such as faster Spectacle startup and a faster accessibility settings page.

More Aaron Swartz and Less Elon, Altman, Zuckerberg

Victorhck’s blog marks what would have been Aaron Swartz’s 40th birthday on Nov. 8, 2026, by reflecting on his legacy as a programmer and information activist. The post contrasts Swartz’s work to free knowledge for the common good with the practices of modern technology billionaires such as Elon Musk, Sam Altman and Mark Zuckerberg. It closes with a recommendation for “The Internet’s Own Boy,” the documentary about Swartz’s life and legal battle.

KDE Gear 26.12 Release Calendar

The KDE Blog shares the release schedule for KDE Gear 26.12, the next collection of KDE applications. The first beta is planned for Nov. 13, followed by the release candidate on Nov. 27, tagging on Dec. 3 and the final release on Dec. 10. The post explains why a published schedule matters for coordinating development and highlights KDE’s four-month release cadence with monthly bug-fix updates.

Linux Saloon 227 | Devario OS

Nathan Wolf’s blog recaps Linux Saloon 227, which features PapalPenguin’s return after several years and his new Skytech gaming PC running CachyOS and Mass Effect. The episode also covers Devario OS, Linux power management, system tools and community projects, and it shares resources mentioned by the participants. Next week’s show is Open Mic Night, with suggestions welcome by email, Telegram or Discord.

System Monitoring and Control News in Plasma 6.8

The KDE Blog presents the system monitoring and control improvements in Plasma 6.8, including the ability to assign CPU-intensive tasks to specific CPUs directly from System Monitor. The release also makes VRAM load easier to read by displaying it as a percentage. Baltasar Ortega frames the changes as part of Plasma 6.8’s 30th-anniversary release and its focus on giving users more control over system performance.

Tumbleweed – Review of the Week 2026/45

Dominique Leuenberger and Victorhck go over the six snapshots released this week (1030, 1031, 1101, 1102, 1103 and 1104), led by the full arrival of GNOME 51.1 with Mutter, GNOME Shell, Control Center, GDM, GTK 4.24 and updated applications. KDE users received Plasma 6.8.2 in the same snapshot, while the long-running SWIG 4.5.1 effort finally landed in snapshot 1031 after libstorage-ng resolved its Ruby garbage-collection interaction. Other arrivals include Linux Kernel 7.3.1, Screen 5.0.2, PipeWire 1.6.11, WirePlumber 0.5.19, Valkey 9.1.3, Wayland-Protocols 1.50 and Hyprland 0.57.1, with KDE Gear 26.08.3, systemd 262.2, OpenSSH 10.6p2, Mesa 26.2.6 and Box2D 3.1.1 among the updates being prepared in staging.

Third KDE Gear 26.08 Update

The KDE Blog announces the third update to KDE Gear 26.08, bringing another round of bug fixes, translation improvements and small enhancements to KDE applications. Examples include a fix for an akonadi crash involving an unknown tracker, a correction for audiocd-kio reporting unsaved changes after reset or apply, and a fix for krfb starting its VNC listener for desktop sharing. The post explains KDE’s approach of major releases every four months followed by monthly maintenance updates.

View more blogs or learn to publish your own on planet.opensuse.org.

On November 3rd, the OBS reference server (build.opensuse.org) experienced a service degradation following a deployment. Certain users encountered 500 errors while interacting with the platform for approximately one hour. We want to share what happened, how we mitigated the failure, and the steps we are taking to avoid similar disruptions in future releases. Detection Shortly after running the deployment, some of us faced 500 errors on every page they visited on build.opensuse.org and our error-tracking...

Every year, the Google Summer of Code (GSoC) Mentor Summit brings together open source maintainers, community leads, and mentors from across the globe.

It is an energizing unconference where the diversity of open source can be touched. This is a unique occasion to share what works (and what doesn’t) across diverse communities for mentoring new contributors, but not only.

The 2026 edition took place in Munich from October 30 evening to November 1st in the afternoon.

Even if this was the tenth mentor summit I attended (I had to count the T-Shirts), it is always amazing to feel the positive vibe there.

I attended the 2026 edition together with Michele and Eugen from the Uyuni project, representing openSUSE.

Here are a few notes of what we are taking back.

Handling intercultural differences

One standout session focused on navigating cultural differences.

A key recommendation was Erin Meyer’s book The Culture Map, which explores how different cultures decode feedback, hierarchy, and disagreement.

In practice for us:

• Explicit on boarding on feedback: instead of assuming contributors know how to receive technical critiques, projects benefit from holding a dedicated session at the start of GSoC on “How we ask for, interpret, and act on feedback.”

• Align mentors culture: a lot of the GSoC contributors are from India, and most of our mentors are from Western countries.

  Involving an Indian mentor to mentor with a western mentor usually makes a difference to bridge between the cultures.

• Draft Pull Requests: new contributors may be more at ease to work on pull requests which are flagged as draft.

  This usually helps with the feedback loop on the code.

• Show that mentors need help too: showing the new contributors that even mentors need to handle comments in pull requests and ask questions helps them feel more at ease.

AI-related sessions

Many of the sessions where about AI and the impact it has on Google Summer of Code and open source in general.

There were mixed feelings about AI in the attendance: from anti-AI to found of AI with sceptics in the middle.

Here are some points, that we took away:

Software Freedom Conservancy still warns against the possible copyright issues on generated code.

Karen Sandler recommended to take a look at their LLM-backed generative AI recommendations.

The sustainability of the use of generative AI has also been a concern in several discussions.

I came back with a nice introspection question: “To what extent could you now stop using AI?”…

I will let you think about it for yourself.

I liked the idea that some other organizations have: “we’ll put as much effort in reviewing than you put in creating the PR”.

So basically, why would we want to spend time on reviewing an AI-generated change that the author did not review himself?

Some organizations have automation to detect fully AI-generated contributions and automatically prepend a robot icon (🤖) to the PR title.

I any case, defining an AI acceptable use policy will be needed for open source projects.

There may even be a link to such a document to set in next Google Summer of Code organization applications, so that this would be clear to applying contributors. Of course, this means that maintainers should not feel bad in ignoring code submission which are not matching these defined rules.

Working with GSoC contributors

Here are some notes in random order about how to improve how we work with contributors during GSoC.

• One of the interesting points for the GSoC admin team, is that it is acceptable to fail a contributor producing good code, but not involved in the community. GSoC is more about on boarding new contributors than code production.

• Communicating once a week with the contributor is not enough. Many organizations ask to provide at least a short status update every day. This would also help to know if they are sick or blocked on something. Some organizations even use this to produce a bi-weekly blog post on the overall GSoC progress.

• We need to ask contributors to first use the product to get familiar with it. This is specifically true for Uyuni as this is a complex beast. They could also be involved in the user channel to try to help users.

• In the past we invited GSoC students to become mentor next year. We probably didn’t do it enough, specially on Uyuni, and should try it more.

• Only using open channels for the communication with the GSoC contributors helps other mentors to chime in if needed. Using private discussions doesn’t help taking part in the community.

• Some organizations require the GSoC contributors to publish a weekly blog post with their progress, learning and blockers. This could be a good idea, but adds quite some work load.

Unclassifiable

We had a nice session and hallway discussions on mechanical keyboards. A question from people who don’t know about them: why did you really want to go down that rabbit hole!

We had a few emotional moments sharing our memories about Robert Kaye. He had a significant impact on Google Summer of Code and open source. Robert was really good at connecting people together and has been the one taking care of the chocolate room at the GSoC mentor summit for more than a decade.

It is also good to reconnect with mentors that I met at the past mentor summits and discover new people and projects.

The week-end also had plenty of occasions to celebrate, with a Halloween costume contest and a karaoke.

Thank you Stephanie, Mary, Lucy, Max and Erin for the organization of that amazing event!

Instalar software de terceros no verificado en nuestros sistemas GNU/Linux puede acarrear el añadir malware

Quiero compartir en el blog, una noticia leida en el blog de David Edmundson, un colaborador de KDE desde hace muchos años, en el que informa que se ha encontrado malware en una extensión para Plasma de KDE llamada Neonova Wallpaper.

Este es el enlace a la noticia original:

• https://blog.davidedmundson.co.uk/blog/malware-found-disguised-as-3rd-party-plasma-extension-neonova-wallpaper/

El equipo de seguridad de KDE ha comprobado un reporte creado por Serg Star que informaba de la presencia de malware en una aplicación de terceros para Plasma llamada Neonova Animated Wallpaper y cuyo código está en GitHub, de un usuario con un bonito avatar hecho con inteligencia sintética, y este aporte como única contribución en esta plataforma:

• https://github.com/abbygraceton1992/NeoNova-KDE-Wallpaper

El software no levanta sospechas de primeras, es un aporte como muchos otros que consiste en un fondo de pantalla animado ¡incluso más tarde se comprometieron a agregar opciones de configuración!

Sin embargo, desde el primer commit creado el código ha estado enviando malware oculto.

Un script (oculto en una cadena base64 en una cadena base64) realiza una solicitud web para descargar una «imagen», que es otro script en bash que a su vez descarga un archivo .so de biblioteca en «.config/Plasma6Library.so» y lo inicia a través de LD_PRELOAD=~/.config/Plasma6Library.so sleep 999999

Si has instalado este fondo de pantalla, una buena prueba sería buscar .config/Plasma6Library.so y borrarlo y eliminar todo el paquete descargado.

Por parte de la comunidad de KDE no se puede controlar y revisar todos los aportes de la comunidad realizados como complementos de terceros. No son oficiales de KDE, aunque sin embargo muchos son muy útiles y completamente seguros.

Siempre habrá quién esté tratando de engañar y comprometer un buen número de usuarios que con buena fe descargan y ejecutan ese complemento no oficial.

La ayuda de los grandes modelos de lenguaje, hace que cualquiera pueda explorar nuevas formas de crear malware, incluso en sistemas tan seguros como GNU/Linux, pero como en todo sistema, la parte más vulnerable se situa detrás del teclado.

Conviene sospechar de cuentas tan recientes como esta, de avatares realizados con inteligencias sintéticas, de cuentas que no tienen detrás una credibilidad y ningún aporte anterior.

Este caso me ha recordado un artículo que publiqué hace años en el que me preguntaba ¿Quién se lee el código fuente?

• https://victorhckinthefreeworld.com/2015/08/12/quien-se-lee-el-codigo-fuente/

Gracias a que el código es libre y alguien lo lee se pueden llegar a poner coto a estos ataques y cortarlos de raíz.

Solo software libre de repositorios oficiales. O de cuentas que ofrezcan confianza. Y como decían en la mítica y antigua serie Canción triste de Hill Street: Tengan mucho cuidado ahí fuera.

Dear syslog-ng users,

This is the 143rd issue of syslog-ng Insider, a monthly newsletter that brings you syslog-ng-related news.

NEWS

Syslog-ng hardening using Tor

For many years, I didn’t think that Tor could be useful for me. However, I’ve recently found a Gist on GitHub that describes how you can use it to harden your central syslog-ng server. And while I have yet to try it, at least now I have a reason to actually test Tor.

https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-hardening-using-tor

Syslog-ng end of August news, and about scaling back Java support

Most of August, I was on vacation, but now I’m back and I try catching up on the events of the past weeks, just like my colleagues do. Currently, we are fixing issues and reviewing contributions, but we also discussed scaling back our efforts on Java support.

https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-end-of-august-news-and-about-scaling-back-java-support

Using syslog-ng with Elasticsearch 9.5

Recently, I heard complaints within the syslog-ng community that using Elasticsearch is not that easy anymore. I installed Elasticsearch 9.5 with Kibana to verify these claims.

https://www.syslog-ng.com/community/b/blog/posts/using-syslog-ng-with-elasticsearch-9-5

WEBINARS

• You can learn about upcoming webinars and browse recordings of past webinars at https://www.syslog-ng.com/events/

Your feedback and news, or tips about the next issue are welcome. To read this newsletter online, visit: https://www.syslog-ng.com/syslog-ng-blog/

This past month has brought several software package updates for openSUSE Tumbleweed ARM with less than a handful of snapshots reaching the ARM port.

The second half of October brought a two-version jump of GRUB2 to 2.16 with serial console and NVMe boot features, a security-focused Linux kernel 7.2.11 and Plasma 6.8.0, while the first half of November opened the 7.3 kernel series, moved u-boot to 2026.10 for the Raspberry Pi, delivered QEMU 11.1.3 with emulated ARM hardware fixes, and refreshed Wi-Fi, Bluetooth and Tegra firmware across the SBC spectrum.

Raspberry Pi

The u-boot update to 2026.10 moves the bootloader behind the 64-bit Raspberry Pi images to the newest upstream release, picking up a quarter’s worth of fixes for boot, USB and PCIe device handling; the full changelog is available now that the package pulls its source from GitHub after the denx FTP server went down. Keeping U-Boot current matters on the Pi because it enumerates devices before the kernel loads, so quirks with USB storage or NVMe hats are often fixed in the bootloader rather than the kernel. As with any Pi bootloader update, it pays to keep a spare boot medium within reach the first time a new version reaches your board.

GRUB2 2.16 is the biggest bootloader change of the window, and several of its new features matter directly on ARM boards. Native NVMe disk support improves booting a Pi 5 with an NVMe drive on the PCIe slot, and AMBA PL011 UART support brings bootloader output to the serial console that the Pi and most other ARM SoCs expose, which makes a failed boot far easier to diagnose without a display attached. New btrfs-info, btrfs-list-subvols and btrfs-get-default-subvol commands let users inspect snapper-style btrfs layouts straight from the GRUB shell, and a one-shot efibootnext module simplifies booting a different entry the next time around. The release also adds DHCPv6 support with network configuration from the UEFI device path, plus ML-DSA post-quantum signature support for appended signatures.

The Linux kernel 7.2.11 update fixed two vc4 driver issues that touch the Raspberry Pi graphics stack: binner slot allocation no longer fails on an idle GPU, which could previously break rendering that resumed after a quiet period, and the V3D interrupt is now disabled across runtime suspend so the GPU does not keep waking the SoC. Both apply to the Pi boards served by the vc4 KMS driver and the V3D GPU, so display and 3D work becomes steadier after idle periods and suspend cycles.

libpisp 1.8.0 fixes a detail in the Pi 5 camera and video pipeline: the GStreamer backend now always applies smart resize and crop when configuring a stream, so hardware-accelerated scaling and format conversion through the PiSP backend honors the requested geometry consistently. Anyone capturing or converting video on a Pi 5 gets more predictable output dimensions and fewer surprise crops.

Rockchip & Other SBCs

The Nov 8 snapshot carried a broad kernel-firmware refresh that reached deep into the SBC world. Rockchip boards gained PCIe3 PHY firmware for the Synopsys snps-pcie3 controller, the fast lanes RK3588 boards like the Rock 5B and Orange Pi 5 use for NVMe drives and PCIe cards, plus the first panthor firmware for Mali GPUs of Architecture 14.8, the generation behind the RK3588’s Mali-G610. Qualcomm firmware refreshed ADSP, CDSP and LPAICP images for the shikra platform, the Rubik Pi 3 and qcs615 boards, added GPU firmware for the Nord chipset, and enabled CDSP support for the Snapdragon x1e80100 Lenovo Yoga Slim 7. Wireless silicon was refreshed across the spectrum: MediaTek MT7922 and MT7925, Realtek rtw89 8852c and 8922d, ath10k WCN3990, ath11k QCA2066, ath12k WCN7850, Microchip wilc1000/WILC3000 at v16.5.2, and a first drop for NXP’s IW610. The Bluetooth package added the AIC8800D80 combo chip and updated QCA2066, so boards carrying those chips get matched fixes on both radios.

Kernel 7.2.11 also cleared a batch of SBC-relevant security fixes. The Samsung Exynos power-management-unit code no longer triggers a use-after-free (CVE-2026-98415), which matters for Exynos-based boards like the ODROID family, and the TI K3 UDMA glue driver avoids a NULL dereference when receive-channel setup fails (CVE-2026-98416), protecting K3-family boards such as the BeaglePlay. Wi-Fi saw two corrections: the Marvell mwifiex driver stops leaking MSI-X interrupts during cleanup (CVE-2026-98426), and Redpine rsi SDIO hardware avoids a heap out-of-bounds write when a key is removed (CVE-2026-98407). The Dialog DA9063 watchdog now also handles suspend and resume correctly (CVE-2026-98410), a fix for the many boards built around that PMIC.

The first 7.3-series kernel, 7.3.1, arrived in the Nov 5 snapshot with a Bluetooth fix that refuses adding an L2CAP channel that already has a connection, preventing the confusion that could follow when the same channel was registered twice. Bluetooth audio and pairing on boards using the BlueZ stack becomes steadier as a result. SDL3 3.4.20 rounded out the gaming side with controller fixes: Nintendo Switch controllers that failed because of missing stick and IMU calibration now work, the 8BitDo Ultimate 2C Wireless is supported through HIDAPI, and the Flydigi Vader 5 Pro gained rumble and trigger-rumble support. These fixes land on ARM handhelds and SBC-based consoles where a single controller quirk can ruin a gaming session.

NVIDIA Jetson & Tegra

The nvidia portion of the Nov 8 firmware refresh updated and added missing firmware files for Tegra SoCs, closing gaps that could leave Jetson modules without blobs their drivers expect. Tegra boards rely on these files for peripheral blocks, so filling in the missing pieces improves out-of-the-box behavior on the Jetson family. The open NVIDIA GPU driver made a large branch jump from 595.112.07 to 620.70.06, built against kernel 7.3.1, and the update supersedes the compatibility patch that the older 615.71.09 series needed for kernel 7.3 (boo#1289478). The CUDA variant made the same jump, so aarch64 systems pairing NVIDIA discrete GPUs with the 7.3 kernel stay in step.

aarch64 Virtualization, UEFI & Toolchain

QEMU 11.1.3 is the virtualization highlight, backporting the upstream stable-queue fixes, and the full list is available for digging. Emulated ARM hardware got direct attention: the Samsung Exynos interrupt combiner now range-checks its group registers, the Raspberry Pi bcm2835 clock manager treats an invalid mux source as ground instead of producing garbage clocks, and GICv5 redistributor ID reads return their actual values. Guest memory translation now follows the 52-bit TTBR table layout when TCR.DS is set and clears the reserved low bits from a 52-bit base, matching ARM CPUs that address beyond 48 bits. A long list of USB fixes covers MTP heap out-of-bounds reads and use-after-frees, XHCI reentrancy, OHCI endpoint mismatches and usb-host cleanup, and the emulated NVMe controller stops leaking memory when SR-IOV-capable controllers are removed. QEMU also dropped libpmem support (bsc#1288103) and fixed a block-layer read-modify-write atomicity bug that could corrupt images.

The 7.3.1 kernel packaging adjusted the spec for the 32-bit ARM arch rename, specifying both the OBS and rpm architecture variants, so armv7 kernel packages keep building cleanly. gdb 17.2 follows the 16.3 series with the GDB 17 feature set, including Debug Adapter Protocol completions and attach requests that accept a core file parameter, plus openSUSE testsuite stabilization patches. xfsprogs 7.2.0 landed for XFS users with quota and mkfs configuration rework and fixes for an rtreflink validation off-by-one, a 32-bit pointer arithmetic bug and growfs reporting, with the 32-bit fix the one most relevant to ARM systems.

UEFI and boot tooling saw useful maintenance. efivar 39 fixes a stack overflow in device path node parsing that could crash UEFI variable tools on malformed paths (CVE-2026-6862), and ipxe gained TLS 1.3 support while fixing virtio-net PXE boot on legacy BIOS virtual machines (bsc#1271200), which matters for network-booted VMs on ARM hosts. iPXE also added AES acceleration using the Arm Cryptographic Extensions, so encrypted network boot costs less CPU on ARM hardware. dtc 1.8.1 ported its build system to Meson, added fdt_get_property_namelen_w and fdt_setprop_namelen APIs, improved decompiling with label and phandle restoration, and added overlay checks that warn about missing #address-cells for interrupt parents.

Desktop users saw two refreshes: Plasma 6.8.0 in the Oct 18 snapshot, tightened by 6.8.2 in Nov 5, and the GNOME 51 stack with GTK4 4.24.1, gnome-shell 51.1, libadwaita 1.10.0, harfbuzz 15.0.0 and gvfs 1.62.0. Mesa 26.2.5 was a steady bugfix release for the graphics stack that backs Panfrost, vc4 and the other ARM drivers.

Snapshots at a Glance

Snapshot	Kernel	Headline changes
2026-10-18	7.2.11	grub2 2.16 (PL011 UART, NVMe boot, btrfs commands), kernel vc4 and Exynos/K3/Wi-Fi CVE fixes, Plasma 6.8.0, curl 8.23.0 security batch, Mesa 26.2.5
2026-10-20	7.2.11	Firefox 158 MFSA security fixes, GraphicsMagick CVE fixes, mozilla-nss 3.130
2026-11-05	7.3.1	first 7.3-series kernel, u-boot-rpiarm64 2026.10, GNOME 51, dnsmasq/expat/brotli/efivar/unbound/cups CVE fixes, dtc 1.8.1, ipxe TLS 1.3, SDL3 3.4.20
2026-11-08	7.3.1	QEMU 11.1.3 ARM fixes, libpisp 1.8.0, Wi-Fi/Bluetooth/Tegra firmware refresh, nvidia-open-driver 620.70.06, gdb 17.2, KDE Gear 26.08.3

Conclusion

The second half of October and the first half of November kept the ARM port moving with the Linux kernel advancing from 7.2.11 into the 7.3 series at 7.3.1, GRUB2 2.16 adding AMBA PL011 serial output and native NVMe boot support, and u-boot 2026.10 landing for the 64-bit Raspberry Pi boards. QEMU 11.1.3 hardened emulated ARM hardware from the Exynos interrupt combiner and the Raspberry Pi clock manager to 52-bit address translation, while the Nov 8 firmware refresh reached MediaTek, Qualcomm, Realtek, NXP, AIC and Tegra silicon and delivered the first panthor firmware for RK3588-class Mali GPUs. gdb reached 17.2, GNOME 51 and Plasma 6.8.2 refreshed both desktops, and libpisp 1.8.0 polished the Pi 5 camera pipeline.

Security updates covered the Linux kernel, curl, dnsmasq, expat, brotli, unbound, cups, GraphicsMagick, libsndfile, freetype2 and Firefox, with curl 8.23.0 clearing 23 CVEs and dropping SMB support, dnsmasq fixing five flaws across its TFTP, TCP DNS, DHCPv6 and DNSSEC handling, and the kernel batch aligning ksmbd’s SMB2 session expiration with the specification (CVE-2026-98420). If any snapshot causes trouble on your board, snapper can roll the system back to the previous state from the boot menu, which keeps the jump to the 7.3 kernel low-risk.

ARM Resources

For ARM-specific discussions and support, subscribe to the openSUSE ARM mailing list and check the openSUSE ARM wiki for device support information, image downloads, and documentation. New and existing ARM users can also join the openSUSE ARM IRC channel for real-time help.

Your contributions and feedback make openSUSE Tumbleweed ARM better with every update. Whether reporting bugs, suggesting features, or participating in community discussions, your involvement is highly valued.

Aunque se había anunciado que el repositorio Packman quedaría abandonado el próximo 1 de enero de 2027, nuevas manos se han ofrecido para seguir manteniéndolo en línea

A inicios de septiembre de 2026 publicaba en el blog una noticia en la que se anunciaba que si no encontraban a nadie que tuviera conocimientos, tiempo y dinero para mantener el repositorio Packman, el próximo 1 de enero de 2027 todo sería ya historia después de 25 años de servicio.

• https://victorhckinthefreeworld.com/2026/09/08/el-proyecto-del-repositorio-packman-quedara-discontinuado-a-partir-del-1-de-enero-de-2027/

Las respuestas han sido muchas y entre ellas una sorpresa.

Al anuncio en la lista de correo respondieron muchos usuarios, llegaron un montón de agradecimientos por todos esos años de servicio, algunos de usuarios de larga historia dentro del mundo del software libre. También hubo tiempo para entrar en el debate de si la alternativa a los paquetes de software iba a ser Flatpack.

Pero de entre todas esas reacciones también llegaron mensajes de otros usuarios en los que se comprometían a seguir manteniendo este importante recurso.

Así que se comunicó en un correo en la lista lo que a falta de concretar más detalles es una gran noticia:

Algunos colaboradores desde hace mucho tiempo, han dado un paso al frente para hacerse cargo de Packman. El servicio continuará como hasta ahora y la interrupción prevista para el 31/12/2026 está descartada. Resolveremos los detalles de la transferencia (infraestructura, compilaciones, repositorios) en segundo plano y nos comunicaremos con usted aquí una vez que haya algo concreto que informar.

Bueno, pues la noticia es clara. Nuevas manos de la comunidad se harán cargo del repositorio Packman y este seguirá su vida más allá de la fecha ultimatúm que se había anunciado.

Quedan ahora temas técnicos a discutir y llevar a cabo, pero eso lo realizarán las personas implicadas y pronto tendremos noticias de cómo se ha llevado a cabo todo el proceso y si es necesario realizar alguna acción como usuario en nuestros equipos si utilizamos el repositorio Packman.

Muy buenas noticias para quienes necesitan este repositorio para instalar paquetes que no existen en otros repositorios. Gracias a quienes hasta ahora eran responsables y gracias a quienes han recogido el testigo y lo van a seguir manteniendo en el futuro.