Postings by Kevin Kofler

Orphaning qt5-qtwebengine


I have to bring some bad news to you: I unfortunately have to orphan the
qt5-qtwebengine package.

As you can see from the changelog, I have not been able to dedicate any time
to this package since March. (My last change was on 2018-03-18.) Yet, this
package needs a lot of care, because of the complex packaging and the
frequent security updates by upstream. (QtWebEngine had lately taken more of
my time than all my other packages combined!) Therefore, the only logical
consequence is that I have to resign from being the primary point of

Unacceptable size increase to ALL live images in F28 (caused by Annobin?)


on #fedora-kde, we discussed a huge increase to the size of the KDE live
F27 KDE GA: 1656752111 bytes
F27 KDE Respin: 1744830464 bytes
F28 KDE Beta: 2069889024 bytes

It turns out the LXQt live image is also hit:
F27 LXQt GA: < 1 GiB
F28 LXQt Beta: 1.4 GiB
and I am pretty sure that this is a global issue affecting ALL the live

While there is certainly more than one cause (e.g., the difference between
F27 KDE GA and the F27 KDE Respin must be caused by package updates and/or
added dependencies), it is striking that between a recent F27 KDE Respin
(which has several of

Missing /boot/grub2/grubenv symlink target in remix composes


I am having a strange issue with my latest Kannolo (Fedora Remix) composes.
(In case it matters: I use livecd-creator, not livemedia-creator.)

For some reason, the symlink /boot/grub2/grubenv is now dangling, the target
/boot/efi/EFI/fedora/grubenv is missing. This makes grub2-install and thus
the installation process fail.

Status of SWDB (Unified database for DNF)


does anybody know what the current status of:
<a href="" title=""></a>
is? It obviously did not make Fedora 27, so:
* is this still being worked on?
* when can we expect it in production in Fedora?

It is quite sad that PackageKit operations still don't show up in the
history in DNF and in DNF frontends such as dnfdragora.

Kevin Kofler

Unresponsive maintainer: rnovacek


has Radek Nováček left Red Hat? The contact information he has everywhere:
<a href="" title=""></a>
points to <a href="mailto: ... at redhat dot com"> ... at redhat dot com</a>, but attempts to write there bounce, with:
554 5.7.1 < ... at redhat dot com>: Recipient address rejected: Access denied

Does anybody know how to contact Radek? Is he still interested in
maintaining his packages or should they be orphaned?

Kevin Kofler

Announcement: DNF port of livecd-creator


remix authors rejoice: I have ported the old livecd-creator from yum to dnf
(in one night):
<a href="" title=""></a>
(The other tools in the package were also ported away from yum and its
rpmUtils to dnf, but livecd-creator was the main user of yum stuff.)

So, if you are unhappy with livemedia-creator for whatever reason, e.g.:
* because of its heavy weight, requiring the whole Anaconda,
* because of its lack of persistent caching (which was the dealbreaker for
* because of more stringent requirements on the kickstart (in particular,
livemedia-creator requiring

Orphaning avogadro


I am hereby orphaning the avogadro package (and am going to hit the
corresponding button in pkgdb after sending this message).

Avogadro is an advanced molecular editor for chemistry. It can be used both as a
standalone application and as a library. The latter is notably used by Kalzium,
the KDE periodic table (which is part of kdeedu), for its molecule viewer.

I originally picked up this package because it is a dependency of Kalzium, which
I was comaintaining at the time.

Rawhide and F25 issues affecting QtWebEngine/QupZilla and Chromium


there are at least 3 issues in Rawhide (some or all of which also affect the
Fedora 25 branch!) making both QupZilla (the main user of QtWebEngine) and
Chromium fail to start up. One of them has no known workaround. And from my
investigation, none of them appears to actually be IN QtWebEngine or
Chromium code:

1. <a href="" title=""></a>
[abrt] qupzilla: base::debug::BreakDebugger(): qupzilla killed by SIGABRT
Apparent cause: selinux-policy
Reason: because "setenforce 0" works around it
F25 affected?: unknown
Workaround: sudo setenforce 0


Orphaning git-cola


I am hereby orphaning the git-cola package. (I will be pushing the buttons
in pkgdb right after sending this message.) I simply do not have the time to
keep up with the upstream releases of this package anymore. (It is already 3
releases behind.)

Both the EPEL maintainers have already requested ACLs for the Fedora package
for a while. If they want the package, it is now up for them to grab. (If
not, hopefully somebody else will pick up primary ownership.) I am approving
the ACLs in any case.

Kevin Kofler

CVE-2015-7547 fix for Fedora 21


I have built an updated glibc package for Fedora 21, with (alleged) fixes
for the following security issues:
* CVE-2015-7547 (CRITICAL)
* CVE-2015-1781
* CVE-2015-8777
* glibc PR17269
* glibc PR18032
backported from Fedora 22 or forward-ported from CentOS 7.

How to fix a package name with wrong capitalization?


in the following review:
<a href="" title=""></a>
a package was reviewed and approved under the name "kpmcore", which matches
how upstream calls its tarballs. However, the subject line incorrectly
spelled the name as "KPMcore" in camel-case, which was not caught during
review, and so when the package was created in pkgdb, the submitter
accidentally requested the module as "KPMcore".

Orphaning flasm


I am hereby orphaning the flasm (Flash bytecode assembler disassembler)
package. (I am about to click the buttons in pkgdb.) I was asked to pick
this up back when I picked up gnash. I have since long given up
maintainership of gnash. I have never had any use for this package (not even
when I was still maintaining gnash), and I have not touched it for ages. I
also wonder whether anybody uses it at all. Either way, I am not the right
person to maintain this package.

The owner of the gnash package may want to take it up (as it is a tool that
can be used to debug gnash).

kcm_systemd license change: GPLv3+ → GPLv2+


sorry for this completely useless junk mail, it is required by policy:
<a href="" title=""></a>

kcm_systemd up to and including version 1.1.0 (i.e., the packages currently
in Fedora) is licensed under the GPLv3+. (Fedora 21 has kcm_systemd 0.7.0,
Fedora 22, 23 and Rawhide currently have kcm_systemd 1.1.0.)

Starting from version 1.2.0, the license has changed to the MORE PERMISSIVE

Copr routinely swamped by nightly builds


I have repeatedly run into insane delays (hours) for my builds to happen
(read: to even start, i.e., to get out of the "pending" phase), because
lately, some automated nightly builds have been monopolizing the builders
every night.

"Workstation" Product defaults to wide-open firewall


I just happened to look at the firewalld default settings, and I was not
amused when I noticed this:
<a href="" title=""></a>
There had been a prior discussion on this list where they wanted to disable
the firewall entirely. We told them that that's a horrible idea (which it
is, of course!).

QUrl from a string (porting KUrl constructor or KCmdLineArgs::url)


even after reading the porting guide and listening to David Faure's Akademy
talk, I am still unsure about what the best way is to get a URL from a
string, supporting:
* absolute URL (with explicit scheme:// only)
* absolute local file path
* relative path: everything neither an absolute URL nor an absolute local
file path is assumed to be a relative path (relative to the local CWD)
as both KUrl::KUrl(QString) and KCmdLineArgs::url did (in slightly
different, but similar ways).

This is needed, e.g., when processing command-line arguments.

I see the following APIs available:
* QUrl::

Porting KUrl::prettyUrl: please do not reintroduce CVE-2013-2074!


just a small public service announcement: The correct replacement for:
in Qt 5 is NOT:
url.toString() // BAD!

The old KUrl::prettyUrl() always removed passwords. You DON'T want to show
passwords in user output:
<a href="" title=""></a>

(I found this reviewing the initial port of Kompare.)

Thanks for reading,
Kevin Kofler

An update on System Tray, Plasma Next ("KDE 5") and GTK+


Quoting from Marco Martin's blog post:
<a href="" title=""></a>
(Annotations from me are enclosed in parentheses.)

(KDE Plasma Next is the next major version of the KDE workspace(s), to
replace the current KDE Plasma 4 workspace(s).

KF5: Parsing times with timezone abbreviations


what is the recommended way to parse times with short timezone
abbreviations, such as "16:00 CET", in Qt 5 / KF5 land? (I am asking because
this is the format the BBC is using for weather observation times in their
RSS files.)

In kdelibs 4, this should do what we want:
dateTime = KDateTime::fromString(timeString, "%H:%M %Z").toLocalZone().dateTime();
but KDateTime is deprecated in KF5.

I looked at:
* QDateTime, but neither of the 2 QDateTime::fromString overloads in Qt 5.2
support the needed format, at least according to the documentation.

Yet another bug caused by SELinux


GHC (Haskell) was broken for (at least) over a year because of a bug in the
workaround for stupid SELinux restrictions:
<a href="" title=""></a>
<a href="" title=""></a>

How much breakage will we have to suffer until people finally realize that
SELinux is a horribly flawed idea?

Kevin Kofler

PS: Et ceterum censeo SELinux esse delendum.

Rebuilding 9 Qt 4 packages in Rawhide for -debuginfo issue


as per:
<a href="" title=""></a>
due to a bug in qt-devel, several packages using qmake-qt4 to build
accidentally had their debugging information stripped before the -debuginfo
extraction, resulting in empty -debuginfo packages.

I went through all the Qt-4-using packages built in Rawhide during the
period the faulty qt was in the buildroot, identified the ones using qmake
to build, and identified the following 9 affected packages:
(all only in Rawhide).

I am now making use of my

Read this if your package includes a status notifier / system tray icon


Please read this e-mail carefully and thouroughly, as interoperability of
your package (including and especially non-KDE packages!) with upcoming KDE
Plasma Workspaces releases depends on it!

The next major release of the KDE Plasma Workspaces (i.e.

Drawing lessons from fatal SELinux bug #1054350


it is time to analyze the fallout from the following catastrophic Fedora 20
<a href="" title=""></a>
"rpm scriptlets are exiting with status 127"

The impact:
* EVERYONE with Fedora 20 installed with SELinux enabled and in enforcing
mode, and who updated to the current stable updates, was hit by this bug.
* The bug completely breaks upgrading any package through both GUI and CLI
tools. Even the fix itself cannot be installed correctly.
* The only possible workaround requires use of the command line.

Update notes referring to files within the package


lately, I have seen an increasing number of update notes like this:
While done with noble intentions, unfortunately, this is not of much use,
because update notes are read BEFORE updating the package, whereas the file
being referred to is only available (in the correct version) AFTER
installing or updating the package.

So please, instead of writing this, either:
(a) link to a copy of the file in cgit/gitweb/ViewVC/Trac/…, if available or
(b) link to a web page with the news instead, if available or
(c) paste the contents of the f

Re: Re: Plasma Workspaces 4.11: the last feature release in the 4.xseries for kde-workspace

---- "Martin Gräßlin" < ... at kde dot org> schrieb:
OK, so let's put aside *my* project and look at a more important one which got
sabotaged even more by the kdelibs freeze: KSecrets! At least my project works
(as a distro patch), KSecrets never got finished after the kdelibs patch was
rejected. Really sad for a cross-desktop interoperability project all distros had
been waiting for for ages!

FYI: Bug 923547 - Packages listed as 'optional' or 'conditional' in comps being pulled into F19 live composes


In case you're wondering why the Alpha TCs are all vastly oversized, here's
<a href="" title=""></a>

Kevin Kofler



due to the Enrico Scholz saga, I realized that we have 4 packages in Rawhide
which BuildRequire dietlibc:


There are 2 things that strike me as broken there:

1. As far as I can tell, those packages are STATICALLY linked against
dietlibc. Yet there is no dietlibc-static subpackage, and apparently the
static library is in the main package (not even -devel!).

Orphaning agg


I am hereby orphaning agg in all Fedora branches. (In EPEL, it is owned by
orion.) I had picked up agg long ago as a dependency of Gnash, but I handed
over Gnash to hicham months ago and so I don't have any personal interest in
agg anymore.

Review Request 108727: ktimezoned: Watch /etc/localtime if it doesn't exist yet.

Review request for KDE Runtime and David Jarvie.

/etc/localtime legitimately might not exist. The default is then UTC.

Review Request 108711: kcmdatetimehelper: Hardcode PATH because $PATH is empty here.

Review request for kde-workspace, Christoph Feck and Oswald Buddenhagen.


kcontrol/dateandtime/helper.cpp 5a946d8

Diff: <a href="" title=""></a>



Kevin Kofler