Recently MicroOS gained some new options in relation with security. The distribution has now integrated Keylime, an open source project for doing remote attestation with TPMs.

If you follow the news about Windows 11, you are aware of what is a TPM. The Trusted Platform Module (TPM) is a cryptoprocessor, described by the Trusted Computing Group (TCG) in a specification that has been standardized in a ISO/IEC document. You can find the TPM already soldered in the mainboard of your computer, but they can also be found as a service in the firmware, or inside your CPU.

This co-processor can be used for many tasks related with security. For example, we can use it to generate symmetric and asymmetric keys, encrypt some memory blocks (not too big, as they are a bit slow), or to as storage for keys that can be used only for us (or applications that have permissions).

Because the TPM from the factory has a unique key (known and Endorsement Key or EK), it can also be useful to generate other keys that can later be used to check if some information comes from this specific machine or not. That is something very handy when we want to validate the source of some communication (like for example, when login into a VPN)

Another main use of TPM is for health attestation: we want to know if the system is in a good state, i.e, there is no change in the software that it is running since we turn it on.

That means that we need to measure all the software that has been running in the system since the very initial stages in the firmware, until the load of the Linux kernel and the initrd. Later we compare those measurements with the values that we known that are the good ones, and if they match we will know that no change has been made in our system.

We can do that using the TPM. Each stage in the boot chain will need to load the next stage before delegating the execution to it. Before doing so we need to calculate a hash function (like SHA256, for example) of it, and report it back to the TPM to track the measurements.

After the boot has concluded, we can ask the TPM about those hashes, and compare them to the expected values. If they match our expectations, it is safe to assume that no change has been made in the software used since the initial boot stages, and the system is in good shape.

For security reasons, we want to do the comparison between the expected measures and the current one in a remote machine. This machine can ask about the current measurements, and request that this report has to be signed by the TPM. We can later validate the signature and do the comparison of the hashes with the expected values.

Keylime is the tool that can do this for us in a more rich and secure way. We can install an agent service in all the machines of our network, which will collect all the measurements and signatures and report it to the verifier service that will do the attestation.

MicroOS now has two new system roles that will install Keylime agents our systems, and we can select one node to install the verifier role.

If you like the idea, you can find more information in the MicroOS blog and in the MicroOS portal. In there you will find technical details about how the TPM is really working and how to use Keylime with measured boot and IMA, all of which are using the TPM as a root of trust.

A blathering about my opinion on how and when to update openSUSE Tumbleweed.

I love photography. I started taking photos four decades ago using a camera called Lubitel, a cheap Russian knock off of Rolleiflex. I switched from film to digital photography back in 2000, which was quite a bit earlier than most. I always treated mobile photography with strong skepticism (small sensor, too much processing, etc.) and have a dedicated camera with me everywhere.

Well, the problem is with the words “always” and “everywhere”. There can be many reasons why I do not have my camera with me:

• doing grocery shopping
• doing some sports
• extreme weather
• visiting a neighborhood where I’m afraid to take a camera and lenses worth thousands of dollars

However, I do not leave my eyes at home together with my camera. I never know when I’ll see some beautiful scenes while walking to the shop. Earlier I just took a deep breath that it’s a helpless situation and I went on, as I did not have a dedicated camera with me. Nowadays my view changed. Even if I do not have a real camera with me, I always have my mobile with me. As usual, there are exceptions here too: when I accidentally leave it in the charger :-)

Some of my favorite photos during the past few weeks were taken by my mobile phone. Yes, these photos are far from perfect from the technical point of view. But still, they captured the mood of the moment perfectly. And without my mobile I would have missed some nice moments of Autumn. So, using my mobile phone to take photos is still better than nothing.

You can find some of my photos on Gurushots

Some here might not know it, but some teams from the 'SUSE Quality Engineering Linux Systems Group' use the Redmine installation here at https://progress.opensuse.org/ to track the results of the test automation for openSUSE products. Especially openQA feature requests are tracked and coordinated here.

As the plain Redmine installation does not provide all wanted features, we included the "Redmine Agile plugin" from RedmineUP since a while now. Luckily the free version of the plugin already provided nearly 90% of the requested additional features. So everybody was happy and we could run this service without problems. But today, we got some money to buy the PRO version of the plugin - which we happily did :-)

There is another plugin, named Checklist, for which we also got the GO to order the PRO version. Both plugins are now up and running on our instance here - and all projects can make use of the additional features.

We like to thank SUSE QE for their sponsoring. And we also like to thank RedmineUP for providing these (and more) plugins to the community as free and PRO versions. We are happy to be able to donate something back for your work on these plugins. Keep up with the good work!

We go further with the SCM/CI workflow integration in OBS. You, beta testers, had difficulties in understanding why your integration failed when something did not go as planned. This is solved with the new workflow runs UI feature, with detailed information about every workflow that ran once you triggered a workflow token. Keep reading for more details. Do not forget this feature is under the the beta program. Join! We started off the continuous integration...

I've created a couple of minisites for key OS components, built using no frameworks, but plain CSS. Just having CSS grid and variables made it viable for me to avoid using frameworks recently. Having includes/imports one wouldn't even need Jekyll.

The founding stone on all of these is the pixel art, which is now becoming my favorite art form.

If you maintain an upstream OS component and are looking to replace a wiki or a markdown readme with a simple site, I've created a template to get you started quickly.

I’ve created a couple of minisites for key OS components, built using no frameworks, but plain CSS. Just having CSS grid and variables made it viable for me to avoid using frameworks recently. Having includes/imports one wouldn’t even need Jekyll.

The founding stone on all of these is the pixel art, which is now becoming my favorite art form.

If you maintain an upstream OS component and are looking to replace a wiki or a markdown readme with a simple site, I’ve created a template to get you started quickly.

Dear Tumbleweed users and hackers,

This week, we had a little bit of a fight with our snapshots in openQA: not because of openQA, but actually because some issues could not have been in staging but became visible in the full product tests (e.g. ncurses memory leak, which manifested while installing a full Tumbleweed fro the net installer). So, out of the 7 snapshots produced and tested, we only managed to publish 3 (1111, 1116, and 1117).

the main changes included in those snapshots were:

• Coreutils 9.0
• X.Org 21.1.1: NVidia users please read https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/R7D252KCMUQBZSW46K7URSVP7F57GBXF/
• KDE Frameworks 5.88.0
• KDE Plasma 5.23.3
• Libreoffice 7.2.3.1
• SELinux 3.3
• PostgreSQL 14.1
• Samba 4.15.2
• Xen 4.16.0

The currently being tested snapshot and staging projects promise these changes in the future:

• Linux kernel 5.15.2: kernel modules compressed using zstd
• ICU 70.1
• Mesa 21.3.0
• cmake 3.22.0
• pipewire 0.3.40, with a move to from pipewire-media-session to wireplumber; currently failing openQA
• Rust 1.56
• Bash: moving away from update-alternatives to handle /bin/sh; To allow busybox to step in as ‘sh’ provider. We are switching to a package replacement model (e.g. bash-sh, busybox-sh). Those packages will install the relevant /bin/sh symlinks
• tbb 2021.4
• openSSL 3.0: No visible progress in the staging. Main blockers so far seems to be python 3.6 and python-cryptography

Today I’d like to point out an amazing new tool: The Container Layer Analyzer, written by Dan Čermák. Dan also wrote a comprehensive blog post about it, which explains it much better than what I do here.

There were a total of four openSUSE Tumbleweed snapshots released this week.

Snapshot 20211117 gave KDE users the Plasma 5.23.3 update. The bug-fix release had changes for the systemsettings5 package, which had a fix for a touchscreen click. The plasma-desktop had a fix involving drag and drop that reset a position and overlap; the package also had a fix showing an inactive kwin console. The kwin package also made some fixes that prevented crashing of screencasting and provided a couple fixes for Wayland. The update of kplotting was the single KDE Frameworks 5.88.0 package updated in the snapshot; the rest came in the previous day’s snapshot. Xfce users also had an update in the snapshot with xfce4-whiskermenu-plugin 2.6.2, which provided a fix for the menu not toggling after pressing escape. The package also fixed shifting the background when showing the menu. Other packages to update in the snapshot were fribidi 1.0.11 and restorecond 3.3, which is a daemon that watches for file creation.

Many of the KDE Frameworks 5.88.0 packages arrived in snapshot 20211116. Updates to improve the Open/Save Advanced Dialog were made to KTextEditor, and plugin KParts deprecated unused and internal methods. Small improvements were in the Application Programming Interfaces documentation for Kirigami; the User Interface framework package also fixed issues with setting components on a tablet. The plasma-framework package added additional keyboard navigation, increased tab margins for visual styles and gave breeze buttons a more realistic shadow. KDE users weren’t the only ones to gain fixes and features from the very large snapshot. An updated of btrfsprogs 5.15 made new defaults for mkfs and fixed warnings regarding a v1 space cache when only v2 (free space tree) is enabled. GTK4 disabled SassC build requirement when building from git and dropped a configuration that is related 32-bit and likely not being consumed, according to the changelog. Both ruby 2.7.4 and 3.0.2 were updated in the snapshot to address a few Common Vulnerabilities and Exposures. The update of mariadb 10.6.5 dropped some patches and had no effect from CVE-2021-35604, which affected other database management systems. Two CVEs were fixed in the postgresql14 14.1 update; one of those made the server reject extraneous data after an SSL or GSS encryption handshake. The update of libreoffice 7.2.3.1 dropped two patches. Vim 8.2.3587, xen 4.16.0 and yast2-network 4.4.31 were among many packages and libraries to update. There were more than 30 additional packages to update in the snapshot.

Just two package came in snapshot 20211111. The major version of coreutils 9.0 arrived in the snapshot. The chmod -v no longer misreports modes of dangling symlinks, which was a bug introduced in coreutils-5.3.0. Several more bug were fixed and there were new features added like cksum now supports the -a (--algorithm) option to select any of the existing sum, md5sum, b2sum, sha*sum implementations etc. cksum now subsumes all of these programs, and coreutils will introduce no future standalone checksum utility. There were a large amount of bug fixes and new features in the update of xorg-x11-server to version 21.1.1. X server now correctly reports display DPI in more cases, which may affect rendering of client applications that have their own workarounds for hi-DPI screens.

The snapshot to start the week off was 20211110. This snapshot updated Mozilla Firefox to version 94.0.1, which gives power users an about:unloads to release system resources by manually unloading tabs without closing them. Vim also had an update in this snapshot to version 8.2.3582; the text editor had some reading of uninitialized memory when giving spelling suggestions. Other packages to update in the snapshot were xwayland 21.1.3, ceph 16.2.6.462, and several pypi packages.

The Tumbleweed-Review sent to the Factory mailing list reveals that Linux Kernel 5.15.2 (with kernel modules compression using zstd), ICU 70.1, Mesa 21.3.0 and cmake 3.22.0 are being tested and are in the staging projects for future release.