Gentoo Weekly Newsletter - Volume 2, Issue 50

---------------------------------------------------------------------------
Gentoo Weekly Newsletter
http://www.gentoo.org/news/en/gwn/current.xml
This is the Gentoo Weekly Newsletter for the week of December 15th, 2003.
---------------------------------------------------------------------------
 
==============
1. Gentoo News
==============
  
Summary
-------
  
 * Gentoo Managers' Meeting Summary: 1 Dec. 2003 
     
The summary[1] and log[2] for the Gentoo Managers' Meeting held on 
December 1 have been posted to the Gentoo Managers' Meetings[3] page. At 
this meeting, a new release naming scheme for Gentoo, a status update on 
GLEP 14, and automatic acceptance of licenses was discussed. 

 1. 
http://www.gentoo.org/proj/en/devrel/manager-meetings/summaries/2003/200312
01.xml
 2. 
http://www.gentoo.org/proj/en/devrel/manager-meetings/logs/2003/20031201.tx
t
 3. http://www.gentoo.org/proj/en/devrel/manager-meetings/index.xml
 
Under the new release naming scheme, outlined on the Release 
Engineering[4] page and accepted unanimously by the managers, the naming 
scheme will be "2004.1" for the first release of next year. 

 4. http://www.gentoo.org/proj/en/releng/
 
GLEP 14[5] is designed to "check a Gentoo system for identified security 
holes or auto-apply security fixes." Developer Marius Mauch[6] outlined 
the progress of its implementation: the DTD needs to be finalized, a 
website with GLSAs using an XSL stylesheet is complete but lacks an index 
and is not online, and a QT tool to aide the writing of GLSAs is being 
written. (Update: the DTD has been rewritten completely, which will delay 
everything by a few weeks.) Also, inclusion in Portage will have to wait 
until the ability to sign files is implemented. 

 5. http://www.gentoo.org/proj/en/glep/glep-0014.html
 6. [email protected]
 
Lastly, in response to the many threads in gentoo-dev requesting the 
ability to arbitrarily accept certain licenses, a make.conf variable 
called ACCEPT_LICENSES similar to ACCEPT_KEYWORDS is being planned. Since 
this will require a change to Portage, a GLEP will be written to outline 
the design philosophy and implementation details. 
    
=================================
2. Featured Developer of the Week
=================================
  
Robin Hugh Johnson
 
Figure 2.1: Robin Hugh Johnson
http://www.gentoo.org/images/gwn/20031215_robbat2.jpg
 
This week's featured developer is Robin Hugh Johnson[7] (robbat2), the 
primary maintainer for Gentoo's PHP[8] and QMail[9] packages (among 
others), as well as one of the CVS administrators and a lead for 
developing a Web Application installer, as specified in GLEP 11[10]. He 
has been a Linux user since 1997, cycling through Redhat and other distros 
before settling in with Slackware in 1999. He tried Gentoo in late 2002 
and very soon thereafter converted all of his boxen over to the new 
distro. 

 7. [email protected]
 8. http://www.php.net/
 9. http://www.qmail.org/
 10. http://www.gentoo.org/proj/en/glep/glep-0011.html
 
Robin became a developer by way of his annoyance with USE flags and their 
tracking. He put together some scripts for managing them more efficiently 
and posted them to bugzilla[11]. The end result were some proposed changes 
to ufed and an invitation to Robin to become a developer to implement 
them. His responsibilities have steadily increased since then. Robin is no 
newcomer to open source development - he was a core contributor to the 
phpMyAdmin[12] project, where he wrote the entire parser and query 
coloring/syntax highlighting system. 

 11. http://bugs.gentoo.org
 12. http://www.phpmyadmin.net/home_page/
 
Robin is a former native of Durban, South Africa who is currently living 
and working just outside Vancouver, Canada. A former professional Systems 
Administrator, he is now employed as a part-time Zope[13] and Linux 
consultant while he attends school at the former Technical University of 
British Columbia (now Simon Fraser University - Surrey). He currently 
shares his home with his parents and an even dozen computers. He 
frequently finds himself working from Windows, with several PuTTY[14] 
windows and Cygwin/X[15] running. The first application he launches in 
Linux is GKrellM[16]. In Windows, it is WinAmp[17]. He is also fond of 
Vim[18], CVS[19] and IntelliJ IDEA[20]. He uses FluxBox[21] for a WM and 
mutt[22] for mail. 

 13. http://www.zope.org/
 14. http://pu.tty.se/
 15. http://www.cygwin.com/xfree/
 16. http://web.wt.net/~billw/gkrellm/gkrellm.html
 17. http://www.winamp.com/
 18. http://www.vim.org/
 19. http://www.cvshome.org/
 20. http://www.intellij.com/idea/
 21. http://fluxbox.sourceforge.net/
 22. http://www.mutt.org/
 
When Robin isn't at a computer, he is usually reading, cycling or spending 
time with his fiance - he directs us to the gentoo-dev fortunes for more 
information on the latter. He offered a statement by the venerable Don 
Knuth as a favorite quote: "Beware of bugs in the above code; I have only 
proved it correct, not tried it." Robin also told us that Gentoo is "not 
for those that can't read documentation!", and encourages people to check 
the docs twice before asking a dev - Gentoo's documentation is one of its 
strengths. 
   
==================
3. Gentoo Security
==================
  
Summary
-------
  
 * GLSA: cvs 
 * GLSA: gnupg 
   
GLSA: cvs
---------
  
Quote from http://ccvs.cvshome.org/servlets/NewsItemView?newsID=84:
 
Stable CVS 1.11.10 has been released. Stable releases contain only bug 
fixes from previous versions of CVS. This release fixes a security issue 
with no known exploits that could cause previous versions of CVS to 
attempt to create files and directories in the filesystem root. This 
release also fixes several issues relevant to case insensitive filesystems 
and some other bugs. We recommend this upgrade for all CVS clients and 
servers!"
 
 * Severity: Minimal 
 * Packages Affected: <=1.11.9 
 * Rectification: emerge sync; emerge -pv '>=dev-util/cvs-1.11.10'; emerge 
'>=dev-util/cvs-1.11.10'; emerge clean 
 * GLSA Announcement[23] 
 23. http://article.gmane.org/gmane.linux.gentoo.announce/274
    
GLSA: gnupg
-----------
  
Two flaws have been found in GnuPG 1.2.3.
 
First, ElGamal signing keys can be compromised. These keys are not 
commonly used. Quote from 
http://lists.gnupg.org/pipermail/gnupg-announce/2003q4/000276.html:
 
"Phong Nguyen identified a severe bug in the way GnuPG creates and uses 
ElGamal keys for signing. This is a significant security failure which can 
lead to a compromise of almost all ElGamal keys used for signing. Note 
that this is a real world vulnerability which will reveal your private key 
within a few seconds."
 
Second, there is a format string flaw in the 'gpgkeys_hkp' utility which 
"would allow a malicious keyserver in the worst case to execute an 
arbitrary code on the user's machine." See the advisory[24] for details.

 24. http://www.s-quadra.com/advisories/Adv-20031203.txt
 
 * Severity: Minimal 
 * Packages Affected: <1.2.3-r4 
 * Rectification: emerge sync; emerge -pv '>=app-crypt/gnupg-1.2.3-r5'; 
emerge '>=app-crypt/gnupg-1.2.3-r5'; emerge clean;  
 * GLSA Announcement[25] 
 25. http://article.gmane.org/gmane.linux.gentoo.announce/275
    
New Security Bug Reports
------------------------
  
The following new security bugs were posted this week: 
 
 * Trusted Platform Modules[26] 
 * sec-policy/selinux-base-policy[27] 
 26. http://bugs.gentoo.org/show_bug.cgi?id=35574
 27. http://bugs.gentoo.org/show_bug.cgi?id=35654
    
=========================
4. Heard in the Community
=========================
   
ALSA and the 2.6 Kernels
 
One of those threads that have been lingering for months, went stale at 
times, only to be revived by latecomers with similar problems, slowly 
growing more and more interesting, and finally becoming an almost 
encompassing solution provider for anything that might go wrong with sound 
in 2.6.0-beta kernels:
 
 * ALSA & 2.6 kernel mini HOW-TO?[28] 
 28. http://forums.gentoo.org/viewtopic.php?t=97157

 
USB Automounter
 
Genotix[29] was tired of manually mounting the filesystems on removable 
media. So he went and wrote his own script to automatically access a USB 
flash memory stick, and donated it to the Gentoo Forums:

 29. http://forums.gentoo.org/profile.php?mode=viewprofile&u=37761
 
 * USB Stick Automounter>[30] 
 30. http://forums.gentoo.org/viewtopic.php?t=113911
    
gentoo-user
-----------
  
Gentoo Kernel Issues 
 
This week a few users reported USB problems with the 2.4.20-gentoo-r9 
kernel. A bug was filed in Bugzilla[31], and you might want to read[32] 
the thread if you've experienced problems. 

 31. http://bugs.gentoo.org/show_bug.cgi?id=35342
 32. http://thread.gmane.org/gmane.linux.gentoo.user/57631
 
Sound File Compression 
 
One of the more interesting posts this week involved testing the 
compression levels of some different audio compression codecs, like ogg, 
mp3, and interestingly, bz2. Some good reading, as well as insight on how 
sound compression works. Check it out[33]. 

 33. http://thread.gmane.org/gmane.linux.gentoo.user/57546
 
Planning on Failure 
 
When you have a Dad, a Gentoo Linux PC, and 350 miles between you and 
them, how do you ensure reliability? Mark Knecht presented this intriguing 
question and got plenty of useful  suggestions[34] that could be helpful 
in administrating any remote Gentoo system. 

 34. http://thread.gmane.org/gmane.linux.gentoo.user/57963
    
gentoo-dev
----------
  
Free Source, Open Source and FLOSS.
 
Always thought that these two things meant the same thing? Well think 
again. Here's[35] a thread dealing with some of the issues around open 
source and free software, including some interesting differences. It was 
all started off by a proposal around enhancing the security of open source 
projects.

 35. http://article.gmane.org/gmane.linux.gentoo.devel/14499
 
Moving of CFLAGS.
 
Where CFLAGS have traditionally been found in make.conf, this post 
proposes moving them to individual ebuilds. Sounds like a lot of effort? 
Well maybe it is, but have a look at the rationale[36] before you decide.

 36. http://article.gmane.org/gmane.linux.gentoo.devel/14458
    
=======================
5. Gentoo International
=======================
  
Hungary: New Gentoo User Group Effort
 
MaGenTa (Magyar Gentoo Tal?lkahelyan), a clever acronym for "Hungarian 
Gentoo Meeting Point", is the name of an endeavour to set up an active 
Hungarian Gentoo user portal[37] with facts, FAQs and forae. Initiated by 
Thomas Ferencz[38] (who is doubling as the lead translator for the new 
Hungarian documentation section[39] at the main Gentoo website), the 
MaGenTa group has been set up last summer, and slowly built up to 
currently 60 registered users, and growing... If you're Hungarian is up to 
the task, go and join the Magyars at the website, or at their IRC channel 
#gentoo-hu on freenode.net.. 

 37. http://magenta.linuxonline.hu
 38. [email protected]
 39. http://www.gentoo.org/doc/hu
   
===========
6. Bugzilla
===========
  
Summary
-------
  
 * Statistics 
 * Closed Bug Ranking 
 * New Bug Rankings 
    
Statistics
----------
  
The Gentoo community uses Bugzilla (bugs.gentoo.org[40]) to record and 
track bugs, notifications, suggestions and other interactions with the 
development team. Between 05 December 2003 and 11 December 2003, activity 
on the site has resulted in: 

 40. http://bugs.gentoo.org
 
 * 458 new bugs during this period 
 * 306 bugs closed or resolved during this period 
 * 9 previously closed bugs were reopened this period 
 
Of the 4283 currently open bugs: 91 are labeled 'blocker', 178 are labeled 
'critical', and 308 are labeled 'major'. 
    
Closed Bug Rankings
-------------------
  
The developers and teams who have closed the most bugs during this period 
are: 
 
 * Gentoo KDE team[41], with 15 closed bugs[42]  
 * Gentoo Linux Gnome Desktop Team[43], with 14 closed bugs[44]  
 * Mirror Admins[45], with 10 closed bugs[46]  
 * Sven Vermeulen[47], with 9 closed bugs[48]  
 * Gentoo Games[49], with 9 closed bugs[50]  
 41. [email protected]
 42. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2003-12-05&chfieldto=2003-12-11&resolution=FIX
ED&[email protected]
 43. [email protected]
 44. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2003-12-05&chfieldto=2003-12-11&resolution=FIX
ED&[email protected]
 45. [email protected]
 46. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2003-12-05&chfieldto=2003-12-11&resolution=FIX
ED&[email protected]
 47. [email protected]
 48. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2003-12-05&chfieldto=2003-12-11&resolution=FIX
ED&[email protected]
 49. [email protected]
 50. 
http://bugs.gentoo.org/buglist.cgi?bug_status=RESOLVED&bug_status=CLOSED&ch
field=bug_status&chfieldfrom=2003-12-05&chfieldto=2003-12-11&resolution=FIX
ED&[email protected]
    
New Bug Rankings
----------------
  
The developers and teams who have been assigned the most new bugs during 
this period are: 
 
 * Core System Packages Team[51], with 13 new bugs[52]  
 * x86-Kernel Team[53], with 11 new bugs[54]  
 * Gentoo KDE team[55], with 11 new bugs[56]  
 * media-gfx Herd[57], with 11 new bugs[58]  
 * Portage Team[59], with 11 new bugs[60]  
 51. [email protected]
 52. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2003-12-05&chfieldto=2003-12
-11&[email protected]
 53. [email protected]
 54. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2003-12-05&chfieldto=2003-12
-11&[email protected]
 55. [email protected]
 56. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2003-12-05&chfieldto=2003-12
-11&[email protected]
 57. [email protected]
 58. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2003-12-05&chfieldto=2003-12
-11&[email protected]
 59. [email protected]
 60. 
http://bugs.gentoo.org/buglist.cgi?bug_status=NEW&bug_status=ASSIGNED&bug_s
tatus=REOPENED&chfield=assigned_to&chfieldfrom=2003-12-05&chfieldto=2003-12
-11&[email protected]
    
==================
7. Tips and Tricks
==================
  
Tips for 'ls'
 
This week's tip demonstrates some useful variations of one of the most 
common commands in a linux system: ls. 
 
Use '-s' to print the file size and '-S' to sort by file size.
 
---------------------------------------------------------------------------
| Code Listing 7.1:                                                       |
| Listing file by size                                                    |
---------------------------------------------------------------------------
|                                                                         |
|add -r to print in reverse                                               |
|# ls -sSh                                                                |
|                                                                         |
---------------------------------------------------------------------------
 
Use '-t' and '--time-style=long-iso' to print files sorted by modification 
time in a standard output format.
 
---------------------------------------------------------------------------
| Code Listing 7.2:                                                       |
| Listing files by date                                                   |
---------------------------------------------------------------------------
|                                                                         |
|# ls -lgot --time-style=long-iso                                         |
|                                                                         |
---------------------------------------------------------------------------
 
Use '--sort=extension' to sort files by their extension (to see perl 
scripts, shell scripts, etc. listed in a group).
 
---------------------------------------------------------------------------
| Code Listing 7.3:                                                       |
| Sorting files by extension/version                                      |
---------------------------------------------------------------------------
|                                                                         |
|# ls -lgo --sort=extension                                               |
|                                                                         |
|or sort by version                                                       |
|# ls -lgo --sort=version                                                 |
|                                                                         |
---------------------------------------------------------------------------
 
Note:  The '-g' and '-o' options remove the owner and group columns from 
the output.
 
There are many more options, but these are just a few that may prove to be 
useful.
   
===========================
8. Moves, Adds, and Changes
===========================
  
Moves
-----
  
The following developers recently left the Gentoo team: 
 * none this week 
    
Adds
----
  
The following developers recently joined the Gentoo Linux team:
 
 * none this week 
    
Changes
-------
  
The following developers recently changed roles within the Gentoo Linux 
project:
 
 * none this week 
    
====================
9. Contribute to GWN
====================
  
Interested in contributing to the Gentoo Weekly Newsletter? Send us an 
email[61].

 61. [email protected]
   
================
10. GWN Feedback
================
  
Please send us your feedback[62] and help make the GWN better.

 62. [email protected]
   
================================
11. GWN Subscription Information
================================
  
To subscribe to the Gentoo Weekly Newsletter, send a blank email to 
[email protected].
 
To unsubscribe to the Gentoo Weekly Newsletter, send a blank email to 
[email protected] from the email address you are 
subscribed under.
   
===================
12. Other Languages
===================
  
The Gentoo Weekly Newsletter is also available in the following languages:
 
 * Dutch[63] 
 * English[64] 
 * German[65] 
 * French[66] 
 * Japanese[67] 
 * Italian[68] 
 * Polish[69] 
 * Portuguese (Brazil)[70] 
 * Portuguese (Portugal)[71] 
 * Russian[72] 
 * Spanish[73] 
 * Turkish[74] 
 63. http://www.gentoo.org/news/be/gwn/gwn.xml
 64. http://www.gentoo.org/news/en/gwn/gwn.xml
 65. http://www.gentoo.org/news/de/gwn/gwn.xml
 66. http://www.gentoo.org/news/fr/gwn/gwn.xml
 67. http://www.gentoo.org/news/ja/gwn/gwn.xml
 68. http://www.gentoo.org/news/it/gwn/gwn.xml
 69. http://www.gentoo.org/news/pl/gwn/gwn.xml
 70. http://www.gentoo.org/news/br/gwn/gwn.xml
 71. http://www.gentoo.org/news/pt/gwn/gwn.xml
 72. http://www.gentoo.org/news/ru/gwn/gwn.xml
 73. http://www.gentoo.org/news/es/gwn/gwn.xml
 74. http://www.gentoo.org/news/tr/gwn/gwn.xml
  
Yuji Carlos Kosugi <[email protected]> - Editor
AJ Armstrong <[email protected]> - Contributor
Brian Downey <[email protected]> - Contributor
Luke Giuliani <[email protected]> - Contributor
Shawn Jonnet <[email protected]> - Contributor
Michael Kohl <[email protected]> - Contributor
Kurt Lieber <[email protected]> - Contributor
Rafael Cordones Marcos <[email protected]> - Contributor
David Narayan <[email protected]> - Contributor
Gerald J Normandin Jr. <[email protected]> - Contributor
Ulrich Plate <[email protected]> - Contributor
Hendrik Eeckhaut <[email protected]> - Dutch Translation
Jorn Eilander <[email protected]> - Dutch Translation
Bernard Kerckenaere <[email protected]> - Dutch Translation
Peter ter Borg <[email protected]> - Dutch Translation
Jochen Maes <[email protected]> - Dutch Translation
Roderick Goessen <[email protected]> - Dutch Translation
Gerard van den Berg <[email protected]> - Dutch Translation
Matthieu Montaudouin <[email protected]> - French Translation
Xavier Neys <[email protected]> - French Translation
Martin Prieto <[email protected]> - French Translation
Antoine Raillon <[email protected]> - French Translation
Sebastien Cevey <[email protected]> - French Translation
Jean-Christophe Choisy <[email protected]> - French Translation
Thomas Raschbacher <[email protected]> - German Translation
Steffen Lassahn <[email protected]> - German Translation
Matthias F. Brandstetter <[email protected]> - German Translation
Lukas Domagala <[email protected]> - German Translation
Tobias Scherbaum <[email protected]> - German Translation
Daniel Gerholdt <[email protected]> - German Translation
Marc Herren <[email protected]> - German Translation
Tobias Matzat <[email protected]> - German Translation
Marco Mascherpa <[email protected]> - Italian Translation
Claudio Merloni <[email protected]> - Italian Translation
Christian Apolloni <[email protected]> - Italian Translation
Stefano Lucidi <[email protected]> - Italian Translation
Yoshiaki Hagihara <[email protected]> - Japanese Translation
Katsuyuki Konno <[email protected]> - Japanese Translation
Yuji Carlos Kosugi <[email protected]> - Japanese Translation
Yasunori Fukudome <[email protected]> - Japanese Translation
Takashi Ota <[email protected]> - Japanese Translation
Radoslaw Janeczko <[email protected]> - Polish Translation
Lukasz Strzygowski <[email protected]> - Polish Translation
Michal Drobek <[email protected]> - Polish Translation
Adam Lyjak <[email protected]> - Polish Translation
Krzysztof Klimonda <[email protected]> - Polish Translation
Atila "Jedi" Bohlke Vasconcelos <[email protected]> - Portuguese 
(Brazil) Translation
Eduardo Belloti <[email protected]> - Portuguese (Brazil) Translation
Jo達o Rafael Moraes Nicola <[email protected]> - Portuguese (Brazil) 
Translation
Marcelo Gon巽alves de Azambuja <[email protected]> - Portuguese 
(Brazil) Translation
Otavio Rodolfo Piske <[email protected]> - Portuguese (Brazil) 
Translation
Pablo N. Hess -- NatuNobilis <[email protected]> - Portuguese 
(Brazil) Translation
Pedro de Medeiros <[email protected]> - Portuguese (Brazil) Translation
Ventura Barbeiro <[email protected]> - Portuguese (Brazil) 
Translation
Bruno Ferreira <[email protected]> - Portuguese (Portugal) 
Translation
Gustavo Felisberto <[email protected]> - Portuguese (Portugal) 
Translation
Jos辿 Costa <[email protected]> - Portuguese (Portugal) Translation
Luis Medina <[email protected]> - Portuguese (Portugal) Translation
Ricardo Loureiro <[email protected]> - Portuguese (Portugal) Translation
Aleksandr Martyncev <[email protected]> - Russian Translator
Sergey Galkin <[email protected]> - Russian Translator
Sergey Kuleshov <[email protected]> - Russian Translator
Alex Spirin <[email protected]> - Russian Translator
Dmitry Suzdalev <[email protected]> - Russian Translator
Denis Zaletov <[email protected]> - Russian Translator
Lanark <[email protected]> - Spanish Translation
Fernando J. Pereda <[email protected]> - Spanish Translation
Lluis Peinado Cifuentes <[email protected]> - Spanish Translation
Zephryn Xirdal T <[email protected]> - Spanish Translation
Guillermo Juarez <[email protected]> - Spanish Translation
Jes炭s Garc鱈a Crespo <[email protected]> - Spanish Translation
Carlos Castillo <[email protected]> - Spanish Translation
Julio Castillo <[email protected]> - Spanish Translation
Sergio G坦mez <[email protected]> - Spanish Translation
Aycan Irican <[email protected]> - Turkish Translation
Bugra Cakir <[email protected]> - Turkish Translation
Cagil Seker <[email protected]> - Turkish Translation
Emre Kazdagli <[email protected]> - Turkish Translation
Evrim Ulu <[email protected]> - Turkish Translation
Gursel Kaynak <[email protected]> - Turkish Translation

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/3dNn9QP4LZPv56cRAhxxAKCYgk6zkKsBPt40IUvdb5McIkezcgCdHLGi
7BEk4TgbInx+N1AvI+Qk/wQ=
=pRgJ
-----END PGP SIGNATURE-----