Lees weergave

Part-DB 2.12.1

Important

This version contains critical security fixes, it is recommended to update to this version immediately.

Part-DB 2.12.1

Security fixes

  • CRITICAL: Fixed issue that users with editing rights could execute arbitary php code in the docker installations by uploading phar files
  • MEDIUM: Fixed XSS issue in unsanatized log entry extra. Due to the Content-Security-Policy this has limited impact, as no arbitrary javascript can be executed.
  • MEDIUM: The APP_SECRET env must be changed to prevent forgery of REMEMBERME tokens. To be doable an attacker requires to know the secret password hash of a user, which is not obtainable without another security issue. Administrators will see an warning banner on the homepage, asking to change the APP_SECRET.

Generate an new random 32 character string with openssl rand -hex 32 and put the value for APP_SECRET into your .env.local or the environment section of the docker-compose.yaml.

Other changes

  • Updated dependencies to fix known security issues in symfony and twig
  • Updated KiCad symbol and footprint lists

  •  

v2.0.0

Important

This release includes breaking changes. Review the migration guide before updating.

New features

Bug fixes

Dependencies

Other

Full Changelog: v1.20.0...v2.0.0

  •  

Rock For People 2026

We're excited to share that we'll be attending the Rock for People 2026 music festival in Hradec Králové, Czech Republic. We've been invited by PlayStation CZ to their gaming hangar at the event with our 4D Motion Simulator, where you'll be able to play our games!

From the 10th to 14th of June, we'll be part of the 31st edition of this iconic festival, taking place at Park 360 in Hradec Králové. You'll find us in the PlayStation Hangar, located near the main entrance, where visitors will have the opportunity to experience our games on our immersive 4D Motion Simulator and meet some of our colleagues.

Rock for People welcomed more than 50,000 visitors last year, and we're thrilled to be part of this incredible event. While you're enjoying the music and atmosphere, make sure to stop by, say hello to our colleagues, and enjoy a ride on our simulator!

You can find more information about the Rock For People festival here. We would also like to send a huge thank you to PlayStation CZ for inviting us to this fantastic event. We can't wait to see you there!

For more news from other events and our games, remember to give our X/Twitter, Instagram, Facebook, Bluesky, and TikTok or subscribe to our newsletter to stay informed! Until next time, keep on truckin'.

  •  

Dirk Eddelbuettel: RQuantLib 0.4.27 on CRAN: Small Extension

A new minor release 0.4.27 of RQuantLib, the first in over a year, arrived on CRAN a couple of minutes ago, has just now been uploaded to Debian, and is being built for r2u as well.

QuantLib is a rather comprehensice free/open-source library for quantitative finance. RQuantLib connects (some parts of) it to the R environment and language, and has been part of CRAN for nearly twenty-three years (!!) as it was one of the first packages I uploaded to CRAN.

This release of RQuantLib brings an update to the interface for all equity options, vanilla and exotics as well as implied volatilities. We now support the option maturity via either an actual maturity date, or the (fractional business-day years) numeric. This uses a clever little Rcpp trick I should discuss in a separate blog post. We also re-ran compileAttributes() to re-create the RcppExports.cpp file now using a slightly improved way of calling Rf_error for an ongoing Rcpp transition, and did some more standard maintenance. The details from the NEWS file follow as usual.

Changes in RQuantLib version 0.4.27 (2026-06-07)

  • All equity option functions can now take either a (fractional) time span to expiry or a given date, and accept a daycounter setter.

  • Two very old schedule helpers had a superfluous try/catch removed.

  • The continuous integration setup received a minor update.

  • The RcppExports.cpp file was updated to aid a Rcpp transition.

Courtesy of my CRANberries, there is also a diffstat report for the this release. As always, more detailed information is on the RQuantLib page. Questions, comments etc should go to the rquantlib-devel mailing list. Issue tickets can be filed at the GitHub repo.

This post by Dirk Eddelbuettel originated on his Thinking inside the box blog. If you like this or other open-source work I do, you can now sponsor me at GitHub.

  •  

Vasudev Kamath: debsecan-mcp v0.1.2 released to PyPI

I finally carved out some time today to prepare and release debsecan-mcp v0.1.2 to PyPI. During this release, I integrated PyPI's trusted publisher mechanism, which authenticates directly via GitHub Actions and eliminates the need for manual uploads or static API tokens.

What is New?

There are no feature updates in this release; the changes are strictly focused on PyPI publishing requirements. This was handled entirely within the Antigravity IDE.

The primary change replaces the python-apt dependency with python-debian for version comparison. PyPI rejects packages that reference external Git repositories, and python-apt lacks an official PyPI release. The original python-apt logic remains intact: if the system has python-apt installed, the server defaults to it. Otherwise, it falls back to the comparison logic implemented via the python-debian NativeVersion class.

What Next?

The next release will introduce a standalone CLI utility called debvulns. It mirrors debsecan functionality but surfaces the cleaner, richer vulnerability data already implemented in debsecan-mcp. The code is written, and I will release it once testing is complete.

I also owe a post explaining my rationale for designing a CLI utility alongside the MCP server, and my broader thoughts on CLI vs. MCP workflows. I aim to publish that next week.

  •  

v0.5.2 - “The funniest joke in the world”

0.5.2 (2026-06-07)

  • Improved: [#26322] [Plugin] Add footpath flags to FootpathSurfaceObject in the plugin API.
  • Improved: [#26566] Improve the performance of sorting sprites.
  • Fix: [#26350] [Plugin] ListViews altered by plugins post their creation are not invalidated.
  • Fix: [#26565] Game crashes when switching to another tab in the guest window.
  • Fix: [#26583] The default tab is not highlighted when opening a ride window.
  • Fix: [#26602] Crash when locating the nearest mechanic for a ride that has not previously been inspected.
  • Fix: [#26615] Missing junction path tile in Build your own Six Flags Over Texas.
  • Fix: [#26616] Fix gap in buyable land in Build your own Six Flags Magic Mountain.
  • Fix: [#26624] Tile elements selected by clicking on them with the tile inspector open do not always redraw correctly.
  • Fix: [#26634] Add missing park patch file for Build your own Six Flags Great Adventure.

Release created in https://github.com/OpenRCT2/OpenRCT2/actions/runs/27089751091

SHA256 checksums:

08869f7e5f34b44920a4209a0d81b2fb688b8fabb16fd23d7d486536e2f9e482  ./OpenRCT2-v0.5.2-linux-x86_64.AppImage
162c61e65f4327d3d5406dcfebc0b634ba6a0c8b1d8a71fb12f7a14cebd3a158  ./OpenRCT2-v0.5.2-Linux-trixie-x86_64.tar.gz
73f114744a5f44c63225db7a3897158addc83094797e52069d000b007d63a508  ./OpenRCT2-v0.5.2-windows-installer-win32.exe
f433cffae1cee88f71de0bb4a296d3c63b4802f907e08078c019d10a475bf050  ./OpenRCT2-v0.5.2-windows-installer-x64.exe
54715dacc97370a38f83572d609135a9ef395324ae38fd6ae3864aa6de958d0d  ./OpenRCT2-v0.5.2-Linux-resolute-x86_64.tar.gz
34477e8339107d94ff441c99d00f6e94a26e481ab97727c4b744ab01b38d842a  ./OpenRCT2-v0.5.2-windows-symbols-x64.zip
2d8e436217a2351eeb016715652f205d8c1f21f7467b25e0f9895b8175a1040a  ./OpenRCT2-v0.5.2-windows-symbols-win32.zip
17561e865947ac69394fc21a978102b36b6a3681fd2e22bda45162f223a7d5f4  ./OpenRCT2-v0.5.2-windows-symbols-arm64.zip
3c0ab35a415907c883628a7113a20607041c00c2ef60419da0f2ebffcf0e5c8a  ./OpenRCT2-v0.5.2-windows-installer-arm64.exe
247230c20657d5ae55494a6a5fb80f3050ef573c6be880a782283cf587813585  ./OpenRCT2-v0.5.2-windows-portable-win32.zip
6bc105b4fa9c751e17ffa13af68a6070f8a0956b713d2602fcbf67d3380c945f  ./OpenRCT2-v0.5.2-sha256sums.txt
1e5bea5f11dcd44e803ecf6b51242ac33ae1ce3a5186ed07362c05fba7604892  ./OpenRCT2-v0.5.2-windows-portable-arm64.zip
b80fd9b439fb42d1c4d58245fb9215bbea89813326e3616b72e95181a8d06787  ./OpenRCT2-v0.5.2-macos-universal.zip
e5aea2add0bc140dc1a0b2bde6b02cbf569656ba4e0e4bf1402c99be6540b7d9  ./OpenRCT2-v0.5.2-windows-portable-x64.zip
262f57a8b1859e58b5319e3aee12062d215170868b9ded5d963c67d53dce6b5d  ./OpenRCT2-v0.5.2-Linux-noble-x86_64.tar.gz
1cbe1db375094d64af72df042f291bbc92386fb63970c8260bc3cd1547cd842d  ./OpenRCT2-v0.5.2-android.apk
8f13a7d3a624f2ff56dd55545c6e38691801cb159065e5c56b12eebc818a5a95  ./OpenRCT2-v0.5.2-Linux-bookworm-x86_64.tar.gz

  •  

Steinar H. Gunderson: Hyperpersonal open source

A while back, I got my first subwoofer (a surprisingly nice addition to the movie experience, just like rear speakers were). But I live in an apartment, and I don't want to annoy my neighbors at night (the speaker cone points literally down into the floor, and I have no idea how much my neighbors get to share in my enjoyment). So, what to do?

It turns out my receiver supports a sort-of documented serial protocol; it doesn't have an actual serial port, but you can telnet into it (only one session at a time!) and get the same two-way stream. (It also has a HTTP version which I find less useful.) So this allows me to impose my own policy, and of course, doing it via an existing Home Assistant adapter or something was no fun and also thoroughly frustrating, so I saw it as an opportunity to keep maintaining my low-key Rust skills. (No, no LLM code generation. If I'm going to spend time on this, at least I can learn something myself. I think I asked one for code critique at some point, but I can't remember.)

The policy is roughly: If I'm watching TV after 22:00, then the subwoofer is either turned off (if possible) or turned down -12 dB (the maximum). But if I'm watching a Blu-ray or another input like that, that's presumably a conscious tradeoff I've made and things are left at normal. Everything gets a bit more complicated by the fact that the receiver tends to lose state when doing certain switches, and when it boots, it takes a minute or two before Telnet responds, and when it shuts down, it goes into this weird limbo state where it doesn't respond to anything but the TCP connection seems still up.

And then I figured out I also wanted to dim the display when watching movies (again, only certain inputs), but not for a couple of seconds after making any adjustments. And after doing that, I figured that my access point LED should also be turned off, which happens to be some SNMP writable stuff against the Cisco wireless controller it hangs on.

So, if you have a Denon or Marantz AVR, a Cisco access point on a controller, and my exact preferences about what to do about the subwoofer, then you are free to download and use my software to impose that policy. It is “is distributed in the hope that it will be useful”, as one says. If you have IPv6.

  •  

Thorsten Alteholz: My Debian Activities in May 2026

Debian LTS/ELTS

This was my hundred-forty-third month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

During my allocated time I uploaded or worked on:

  • [DLA 4580-1] exim4 security update to fix one CVE related to remote code execution.
  • [DLA 4591-1] rsync security update to fix five CVEs related to local root privilege escalation.
  • [#1134340] trixie-pu bug for libcoap3 to fix two CVEs in Trixie; the debdiff was confirmed and the upload was accepted to the proposed update queue.
  • [#1126167] bookworm-pu upload of zvbi has been flagged for acceptance
  • [#1126273] bookworm-pu upload of taglib has been flagged for acceptance
  • [#1126370] bookworm-pu upload of libuev has been flagged for acceptance
  • [hplip] upload to sid to fix two CVEs.

This was a rather strange month. The details about the embargoed exim4 issue arrived only after I already went to bed and the embargo lift was 18 hours later. Luckily Stretch was not really affected and the uploads for Bullseye and Buster went out on time.

Something similar happened with the embargoed issue of rsync. The info arrived at 8:00 in the morning and the embargo lift was on 2:00 next morning. From an Europeans point of view, the Australians do have strange time zones. But there is more to this than that. Upstream sent more than 50(!) patches for these five CVEs that needed a backport to Bullseye. As things turned out, there is a regression in the upload to Unstable and investigations are ongoing whether this regression is also available in the backported patches for Trixie, Bookworm and Bullseye. So rsync-updates for Buster and Stretch is in the works, but I am afraid they need some more time.

All good things come by threes. Two critical CVEs of hplip appeared and a new upstream version was released by HP. HP is no longer interested in working with distributions and over time more than 80 patches have been accumulated that need a rebase for a new upstream version. For that reason I avoid this package as much as I can, but two critical CVEs did apply some kind of pressure on the maintainer. So I finally managed to do this update and the latest version of hplip is now in Debian. Nevertheless, this feels good :-). Anyway, it is not over yet. HP does not have a public repository nor do they publish patches for these CVEs. So I am still searching for the correct fixes to backport them to Bullseye, Buster and Stretch. The other distributions have the same problem and a silver lining appears on the horizon.

I also prepared an update of gimp for Buster and Stretch, but due to an accident I only managed to release the corresponing ELA in June. The accident was also the reason for only half a week of FD. Thanks to Daniel who took over.

Debian Printing

This month I uploaded a new upstream versions:

This work is generously funded by Freexian!

Debian Lomiri

This month I continued to work on unifying packaging on Debian and Ubuntu. This makes it easier to work on those packages independent of the used platform.

This work is generously funded by Fre(i)e Software GmbH!

Debian Astro

This month I uploaded a new upstream version or a bugfix version of:

Debian IoT

This month I uploaded a new upstream version or a bugfix version of:

misc

This month I uploaded a new upstream version or a bugfix version of:

I also got rid of gypsy, which no longer makes sense to maintain in Debian, as gpsd is way better.

  •  

ElegantFin Theme v26.06.06 for Jellyfin

This is the 14th update to ElegantFin.

Key Changes

General UI & Layout Improvements

  • Increased card sizes slightly without reducing the number of visible items on phones.
  • Increased backdrop-card sizes on TV and desktop layouts.
  • Tweaked indicator and Continue Watching progress-bar positioning on phones for more consistent alignment and space efficiency.
  • Continue Watching cards can now optionally be displayed larger than standard cards through --resumeCardScale (#248).
  • Restored the three-dot menu button for accessibility (#279).
  • Added a customisation option that allows the three-dot menu button to be enabled or disabled via --menuButtonVisibility.
  • Tweaked the width of "My Media (Small)" buttons.
  • Increased the top margin inside the hamburger menu.
  • Reduced spacing between cast posters and cast names.
  • Added consistent spacing between icons and text inside buttons, e.g., Sort.
  • Prevented selector mismatches caused by buttons lacking a title attribute, resolving several icon alignment issues.
  • Standardized top-right indicator sizing within cards throughout the theme.
  • Added ellipsis to dropdown menus to prevent long text from overlapping the down-arrows.
  • Fixed an issue where hover overlays could look permanently stuck on newer Jellyfin versions (#290).
  • Fixed an issue that caused some multi-selection checkboxes to not cover the cards fully.
  • Fixed incorrect ordering of items container within Collection views.
  • Fixed multiple cases where library pages could become incorrectly centered or left-aligned.
  • Fixed missing side margins on "Nothing here" messages displayed in some library tabs.
  • Updated to the latest version of the Material Symbols icons.
  • Added a subtle text shadow to card titles.
  • Added icon fallbacks to prevent flashes of invisible text while icons load.
  • Possibly fixed an issue that caused the app-bar to be overlapped by the status bar on some Apple devices (#233).

Music Improvements

  • Replaced artist-name text with clear logos. (#273 - thanks @AhmedRadwan4)
  • Redesigned the artist pages on desktop with dimmer backdrops while prominently featuring clear logos.
  • Added artist page customization options via --artistTitleVisibility, --artistClearLogoVisibility and --artistPageBackground.

Playback Controls & Browser Compatibility

  • Updated "Skip Intro" button styling and position slightly.
  • Updated seek-bar thumb styling to feature a rounder seek handle.
  • Fixed seek-bar thumb styling in Firefox so that it looks as intended on Chromium-based browsers.

Media Bar Add-on Improvements

  • Fixed alignment of the top-right volume toggle inside the Media Bar add-on. (#260 - thanks @ACertainCoder)
  • Reordered the play button to the first position within the buttons container.
  • Prevented border styling from appearing before the slides finished loading to eliminate loading flashes upon page refreshes (#150).
  • Tweaked the layout slightly to increase backdrop visibility.

Custom Media Covers Add-on Improvements

  • Added support for "Anime" and "Sports" library covers. (#281 - thanks @buhbbl)
  • Improved media-cover matching logic by switching to a stronger matching pattern to resolve false matches reported in issue #280.

Performance Improvements

  • Eliminated several complex selectors and layout-specific workarounds.
  • Simplified card-hover overlay animations slightly.
  • Reworked how cards are sized with gap on phones to create a more predictable and maintainable layout system similar to desktops.
  • Added an optional compact version of the icon pack for faster loading in low-bandwidth scenarios. (#288 - thanks @tim-vu)
  • Updated development tools that minify the stable builds for a more optimised output.

Documentation & Maintenance

  • Updated documentation covering card-hover effects and add-on installation instructions.
  • Removed some hardcoded values to improve layout responsiveness.
  • Internal code reorganization.
  • Updated code comments and developer documentation.

You can read the full commit history here.

Additional Notes

  • All the customisation instructions can be found in the README.md
  • Jellyfin Desktop is the new desktop client that should be more compatible with the theme.
  • Jellyfin Media Player and some outdated TVs are not fully supported as they may lack support for newer CSS features.
  • I have switched to a recent Jellyfin Server so older server versions are no longer supported.
  • This is a hobby project. If it helped you, your support really means a lot.

Buy me a coffee

You may use the provided CSS file for self-hosting purposes. Alternatively, you may use the following code snippet to get the latest version via a free CDN.

@import url("https://cdn.jsdelivr.net/gh/lscambo13/ElegantFin@main/Theme/ElegantFin-jellyfin-theme-build-latest-minified.css");

For more detailed information, be sure to read the README.md file.

  •  

v0.16.8

[0.16.8] - 2026-06-06

If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.

Added

Changed

  • OAuth: Rework access tokens to an AES-256-GCM-SIV AEAD format that carries the account name for proxy routing.
  • Added more internal TLDs to the domain validation.

Fixed

  • MTA:
    • Sub-addressing with external directories returns 550 Mailbox not found.
    • Disabled aliases continue receiving messages.
  • JMAP for File Storage: FileNode/get returns a stale state string.
  • Make SieveSystemInterpreter.defaultReturnPath and MtaQueueQuota.match optional expressions.
  • Rate limiter panics when periods under 1 second are used.
  • CalDAV/CardDAV: Calendar events, contacts, calendars and address books deleted via JMAP do not write a vanished tombstone.
  • DNS updater: bump to dns-update-v0.5.1.

Check binary attestation here

  •  

10.11.11

🚀 Jellyfin Web 10.11.11

We are pleased to announce the latest stable release of Jellyfin, version 10.11.11! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!

You can find more details about and discuss this release on our forums.

Changelog (2)

📈 General Changes

  •  

10.11.11

🚀 Jellyfin Server 10.11.11

We are pleased to announce the latest stable release of Jellyfin, version 10.11.11! This minor release brings several bugfixes to improve your Jellyfin experience. As always, please ensure you take a full backup before upgrading!

You can find more details about and discuss this release on our forums.

Changelog (1)

📈 General Changes

  •  

Release 2026.06.06

Docker Images

Docker images have been built and pushed:

Docker Hub:

  • alexta69/metube:latest
  • alexta69/metube:2026.06.06

GitHub Container Registry:

  • ghcr.io/alexta69/metube:latest
  • ghcr.io/alexta69/metube:2026.06.06

Changes

  • add option for following nightly yt-dlp releases (closes #999) (ee20512)

  •  

v12.0.0-rc.2

⚠️ Potential Breaking Changes

Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160)

  • Health checks are cached by default and shared across multi-instance deployments

  • /server/health will return 404 for unauthenticated requests, use /server/ping for liveness checks

  • cache, rateLimiter and rateLimiterGlobal health checks have been replaced by a generic redis check using the redis: prefix

  • @directus/api

    • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)

✨ New Features & Improvements

  • @directus/api
    • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
  • @directus/types
    • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
  • @directus/env
    • Allow disabling the health check endpoint via HEALTHCHECK_ENABLED or selectively disabled checked services via HEALTHCHECK_SERVICES (#27160 by @ComfortablyCoding)
  • @directus/memory
  • @directus/system-data
    • Updated directus_oauth_* system collection visibility to match other system collections (#27682 by @hanneskuettner)

🐛 Bug Fixes & Optimizations

  • @directus/app
    • Fixed project setup silently ignoring invalid license keys (#27671 by @ComfortablyCoding)
    • Fixed tick rendering when count exceeds display limit in v-slider (#27644 by @HZooly)
    • Consolidated URLs and emails into shared constants (#27641 by @HZooly)
    • Capped datepicker year to prevent invalid date (#27659 by @HZooly)
    • Fixed EXTENSIONS_PATH and EXTENSIONS_LOCATION env vars not being respected by the Vite dev server (#27642 by @HZooly)
    • Added notice on license page with oig link (#27661 by @robluton)
    • Fixed bug on tooltip value when decimals is 0 in pie chart panel (#27356 by @Prateet-Github)
    • Added missing collection note translations for the directus_oauth_* system collections (#27682 by @hanneskuettner)
    • Fixed search input not trimming whitespace, causing queries with leading or trailing spaces to return no results (#27359 by @khanahmad4527)
    • Added minor copy change to license onboarding and license key interface (#27651 by @robluton)
    • Updated license request links. (#27652 by @HZooly)
    • Added support for translatable flow names via the existing $t: prefix and translation strings, matching the field/collection label pattern. The flow name input in the flow editor now exposes the translation picker. (#27472 by @khanahmad4527)
    • Removed unsupported json filter function from the studio (#27669 by @sourav-18)
  • @directus/api
  • @directus/sdk
    • Fixed health check results not being shared in multi-instance settings. Restricted /server/health to authenticated users (#27160 by @ComfortablyCoding)
    • Fixed SingletonCollections incorrectly including core schema collections (#27196 by @kheiner)
  • @directus/constants
    • Consolidated URLs and emails into shared constants (#27641 by @HZooly)

📦 Published Versions

  • @directus/app@16.0.0-rc.1
  • @directus/api@36.0.0-rc.1
  • @directus/composables@11.5.0-rc.1
  • @directus/constants@14.4.0-rc.1
  • create-directus-extension@12.0.0-rc.1
  • @directus/env@6.0.0-rc.1
  • @directus/extensions@4.0.0-rc.1
  • @directus/extensions-registry@4.0.0-rc.1
  • @directus/extensions-sdk@18.0.0-rc.1
  • @directus/memory@4.0.0-rc.1
  • @directus/pressure@4.0.0-rc.1
  • @directus/schema-builder@1.0.0-rc.1
  • @directus/storage-driver-azure@13.0.0-rc.1
  • @directus/storage-driver-cloudinary@13.0.0-rc.1
  • @directus/storage-driver-gcs@13.0.0-rc.1
  • @directus/storage-driver-s3@13.0.0-rc.1
  • @directus/storage-driver-supabase@4.0.0-rc.1
  • @directus/system-data@4.5.0-rc.1
  • @directus/themes@2.0.0-rc.1
  • @directus/types@16.0.0-rc.1
  • @directus/utils@13.5.0-rc.1
  • @directus/validation@3.0.0-rc.1
  • @directus/sdk@22.0.0-rc.1

  •  

Development Release: Koozali SME Server 11.0 RC1

The DistroWatch news feed is brought to you by TUXEDO COMPUTERS. Terry Fage has announced the availability of the first release candidate for Koozali SME Server 11.0, the upcoming major release of the project's Rocky Linux-based server distribution for small and medium enterprises: "The Koozali SME Server development team is pleased to announce the release of SME Server 11.0....
  •  

Steve McIntyre: Secure Boot and Microsoft CA Rollover - user-facing documentation

I previously wrote some advice for developers and distributions about the upcoming Microsoft CA Rollover, and I hope that was useful for people.

I've now also added some user-facing documentation about the CA rollover in the Debian wiki at https://wiki.debian.org/SecureBoot/CAChanges. I've added guidance on managing certificate updates on Debian systems: how to check if a system needs those updates and various ways to make them happen. If you're running Secure Boot systems, this may be important for you.

While the same event is the primary cause for these docs, they're designed for different people. Again, I hope this new doc is helpful!

  •  

Introducing Indiana

Today, we are excited to officially announce that a brand-new map expansion is on the horizon for American Truck Simulator. Get ready to discover the crossroads of the Midwest with the upcoming...

Indiana DLC for American Truck Simulator


Known as the Hoosier State or Crossroads of America, Indiana is a land shaped by hardworking communities, rich agricultural heritage, iconic motorsports culture, and bustling industry. From scenic rural highways lined with endless cornfields to thriving urban centers filled with towering factories and busy freight depots, Indiana offers truckers a diverse and authentic slice of America waiting to be explored.


You will haul cargo through vibrant cities, each with its own unique atmosphere, landmarks, industries, and opportunities. At the heart of the state lies Indianapolis, home to a world-famous racing culture and a major hub for transportation and logistics. Whether you are navigating busy interstates around the capital or taking quieter roads through small-town America, every mile brings something new to experience.

As you journey across Indiana, you will encounter a wide variety of landscapes and industries. Deliver agricultural equipment and grain from the fertile farmlands, transport steel and heavy machinery through industrial regions, or supply bustling distribution centers. Keep an eye out for iconic water towers, classic red barns, charming downtown districts, and historic covered bridges that help give Indiana its unmistakable character.

Indiana is also home to an impressive network of highways and interstates that play a vital role in American commerce. With the continuation of I-90 through northern Indiana, you can also look forward to trucking all the way to Indianapolis and deeper into the Midwest. Along the way, drivers can expect a blend of open highways, dense urban traffic, industrial zones, and peaceful countryside roads that capture the true spirit of Midwestern trucking.

Our teams are hard at work bringing Indiana to life with the detail and authenticity our community expects, and while there is still a long road ahead before release, we are excited to begin sharing more from this upcoming expansion in the future. Please keep in mind that everything you see here is still a work-in-progress and may change during development.

If you are looking forward to hitting the roads of the Hoosier State, be sure to add the Indiana DLC to your Steam wishlist and show your support for the project!

Don’t forget to follow us on X/Twitter, Instagram, Facebook, Bluesky, and TikTokor subscribe to our newsletter for the latest updates and behind-the-scenes looks at the development. Until next time, keep on truckin’, and we will see you on the road!

  •  

Russell Coker: CPUs and Debian Package Building

Introduction

I have just bought a HP Z4 G4 with W-2125 CPU for $320 and I decided it was a good time to do some benchmarks on Debian package building to see which system I should use for that.

The W-2125 CPU scores only 9,954 on the passmark multithread test but scores 2,546 on single thread [1]. Passmark seems to have some limitations as the only DDR3 system that’s important to me at the moment (the HP Z420 workstation my parents use which cost me $750 in 2021) with a E5-2620 CPU scoring 5,325 for multithread and 1,113 for single thread [2]. From the passmark results one would expect that the system is slightly more than twice as fast as the Z420 for operations that involve less than 4 CPU cores.

For the initial tests of the Z4 G4 I ran them with hyper-threading enabled as 4 cores isn’t much by today’s standards and also the machine in question is going to be less exposed to hostile data and contain less secret data than most of my systems so the security risks of hyper-threading are less of a concern.

I did some tests with a couple of tasks that are very important to me, building SE Linux policy packages (something I may do a dozen times in a day) and building Warzone 2100 (which I do less often but is the most intensive build process I regularly run). At the bottom of this post there are tables with the results from building these packages on my Z640 workstation with a E5-2696 v4 CPU [3], the Z420, and the new machine.

For the Warzone 2100 package I tested building on my Z840 dual CPU system [4]. I didn’t test building the SE Linux policy on the Z840 this time because that package can’t take advantage of even 22 cores. When I initially got the Z840 running it built the policy packages faster because the Z640 had an older CPU that was slower for single core operations than the CPUs in the Z840.

BTRFS Compression

For some time I have noticed significant differences in compile time on my workstation, a factor of more than 2. I did more tests and noticed that “top” showed something like the following, those kernel threads are all BTRFS related, except for “gfx” which is probably something graphical caused by running Chrome with about 300 tabs open.

2144316 root      20   0       0      0      0 I  26.6   0.0   0:36.76 kworker/u88:20-btrfs-endio-write                                                                                                                                                                             
2221470 root      20   0       0      0      0 I  23.7   0.0   0:01.85 kworker/u88:12-gfx                                                                                                                                                                                           
2221436 root      20   0       0      0      0 I  15.1   0.0   0:07.48 kworker/u88:8-btrfs-compressed-write                                                                                                                                                                         
2166191 root      20   0       0      0      0 I  12.8   0.0   0:15.80 kworker/u88:23-btrfs-compressed-write                                                                                                                                                                        
2126387 root      20   0       0      0      0 I  10.2   0.0   1:29.11 kworker/u88:4-events_unbound 

I had been running BTRFS with the mount option “compress=zstd:15” which caused much of the performance problems when building. It was also a random performance issue which I think happened due to the BTRFS 30 second write-back sometimes taking more than 30 seconds during the build process which then caused a second write-back.

I did tests on ZSTD compression levels 5, 8, 10, and 15. 15 was never good and often really bad. 10 was not unbearable but consistently slower. 8 was sometimes as fast as 5 and sometimes quite a bit slower. I didn’t test levels below 5 because I need to have some compression and it seemed that the benefits of reducing compression were dropping off below 8.

I found that the BTRFS compression delay is not counted in system time for the process. I think it’s the fsync() system calls in the semodule and dpkg-deb programs that cause the delays related to BTRFS compression waiting for kernel threads.

BOINC

I have all my systems other than laptops running BOINC in the background so that CPU power is used for scientific research when I don’t have any personal use for it [5]. I believe that it’s immoral to waste CPU power when it could be used for research.

In the below table which has test results from building the package with and without BOINC, and with different ZSTD compression levels in BTRFS all the worst entries were from when BOINC was running apart from one where ZSTD level 15 compression was used. The really poor performance with ZSTD level 15 was an outlier, but it wasn’t an uncommon outlier so I left it in.

Running BOINC in the background configured to use all CPU cores caused a significant increase in “user CPU time” (the time a CPU core spent actually running the program). My initial thought was that it’s partly related to “turbo boost”.

The Intel ARK page for the CPU in the Z420 shows that it’s main clock speed is 2.0GHz with a 2.5GHz “turbo boost” [6]. The “turbo boost” is apparently largely based on temperature and apparently limited to one core, so if the other CPU cores are all being used then the CPU will probably be too hot to have the turbo boost and if it happens it might not happen for my compile processes.

The ARK page for the E5-2699 v4 (which is a similar CPU to the E5-2696 v4 that I’m using but is officially documented by Intel) [7] shows that it has a base clock speed of 2.2GHz and a turbo boost speed of 3.6 GHz. 322 vs 244 seconds of user CPU time means running 32% slower which can plausibly be explained by the lack of a 64% turbo boost with a bit of help from the 55MB L3 cache being thrashed.

Turbo boost would only be a noticeable issue for building packages like the SE Linux policy packages which doesn’t take much advantage of multi-core CPUs. For a build process to average at best 362% CPU use there has to be large parts of the process that are limited to one or two cores which can potentially give a benefit from turbo-boost.

When building the Warzone 2100 packages most of the build time is running basis-universal which is a multi-threaded program to compress GPU texture data. This usually causes a load average of 300+ on the Z640 or 600+ on the Z840. But the build time is still increased by more than 50% on both the Z640 and the Z840 when BOINC is running in the background, which seems to be an indication that it’s not related to turbo boost. I verified that BOINC is running at IDLE schedule priority with the following command:

# chrt -p $(pidof -s einstein_O4MD_2.01_x86_64-pc-linux-gnu)
pid 2974874's current scheduling policy: SCHED_IDLE
pid 2974874's current scheduling priority: 0

In theory this means that BOINC won’t affect foreground processes.

Hyper Threading on the W-2125

The best claims I’ve seen about HT are 15% to 30% performance boost. The best I’ve actually seen in the past is about 18%. Seeing a 10% benefit for building Warzone 2100 is at the low end of the range I expected. 8 virtual cores is not many for a build process that causes a load average of 600+ when running on a system with 44 real cores.

I was surprised to see a 6% performance benefit in hyper-threading for building the SE Linux policy as I didn’t think there was enough use of threading or multiple processes to allow that.

Many build scripts use a number of processes that match the number of apparent CPU cores. While “make -j 88” might give a theoretical performance benefit on a 44 core system it will also take a lot of RAM and any paging will outweigh the benefits of hyper-threading. On a system with only 4 real cores there’s less potential for using too much RAM and as security isn’t so important on that system I will leave it on.

Comparing the CPUs

The best results of the Z640 and Z4G4 are only 50% faster than the best results of the Z420.

The Z420 has a E5-2620 CPU which is far from the fastest CPU available for that system – the E5-2687W has 8 cores and rates 10,021/1,669 on passmark [8] which is far better than the 5,331/1,114 the E5-2620. The E5-2687W is the fastest CPU that HP lists as supported by the Z420 and it supports DDR3-1666 RAM as opposed to the DDR3-1333 that is the fastest that the E5-2620 supports. With suitable hardware upgrades the Z420 would probably only take about 20% longer to do builds of the SE Linux policy and other packages that can’t take advantage of more than 8 CPU cores.

The Z4G4 system has 4 RAM channels which means that you should get some performance benefits from having 4 DIMMs, my system currently has 2 and I haven’t yet managed to get more DDR4-2666 DIMMs. But I’d still expected a W-2125 CPU with 2*DDR4-2666 DIMMs outperform any E5-26xx CPU with 4*DDR4-DDR-2400 DIMMs for tasks that average less than 4 CPU cores.

In retrospect I would have been better off getting a HP Z820 (two socket server with DDR3 RAM) than the first DDR4 systems I got. It seems that for reasonable size builds a two socket system comes close to twice the speed of a single socket system. I did briefly own a HP ML350 two CPU system with DDR3 RAM but it was too noisy for my intended use as a deskside workstation so I sold it.

Things to Investigate

I plan to do more investigation on BTRFS compression, how to get the best compression without excessive delays and how to recognise when delays are happening. I have some SSDs that have sustained write speeds as low as 15MB/s (Crucial P1 series) so for those I could probably have very high compression levels without slowing the system down.

The fact that BIONC slows things down so much seems to be a bug. When processes are running with the IDLE scheduling class there shouldn’t be such significant delays. Is it due to cache thrashing? How can I best get BOINC suitably throttled when I’m sitting at my workstation, I don’t want BOINC connecting to the local X server (which it repeatedly tries to do). Do I need to tune my kernel for better handling of IDLE scheduling?

When I get more DIMMs in the Z4G4 I need to do more tests to see if it gives an overall performance boost.

Also the Z4G4 system has a BIOS option for “sub NUMA” which basically means treating the different RAM channels on a single CPU as NUMA zones, I enabled that option which does nothing presumably because I only have 2 DIMMs, the results when I have 4 DIMMs will be interesting. I will also do some NUMA tests on the Z840 to see what benefits it gives.

I have a selection of RAM speeds that will work in the Z4G4, if I have enough spare time I’ll test what difference that makes for CPU bound tasks that matter to me.

For package building fsync() is not helpful, if the system crashes before it’s done then I will just do the build again. For a build cluster it is probably a good feature and probably doesn’t affect aggregate performance when multiple packages are built at the same time, but for the single user case probably not. I will investigate libeatmydata for package building [9].

Conclusion

The progress in CPUs seems to have slowed down a lot recently. The main benefits seem to be in more CPU cores and for newer sockets with more RAM channels.

The CPUs that do have improvements in single core performance are the i9 series (which mostly doesn’t come with motherboards supporting ECC) and AMD CPUs (which is rare in enterprise class hardware). Maybe I should get a server with an i9 or AMD CPU for tasks that need a fast turn around with a small number of cores. That would probably outperform any CPU designed for large core counts for things like building the policy and setting up test VMs (which depends on package installation speed that is single core bottlenecked).

The W-21xx CPUs seem to offer little benefit over the E5-26xxv4 CPUs and not a lot of benefit over E5-26xx CPUs (with DDR3). Even the W-22xx CPUs look like they aren’t going to offer a lot as they are only an incremental improvement over the W-21xx series. I had considered making the Z4G4 my main desktop workstation after the high end W CPUs become affordable, but it looks like that won’t be worth it until such CPUs drop from the current ebay price of $900 to $100.

I think I’ll keep waiting for a decent socket LGA3647 or DDR5 based server [10] for my next significant upgrade.

Tables

Building SE Linux Refpolicy

System BOINC Compression CPU Time Elapsed CPU%
Z640 no 8 248.82user 55.58system 1:23.88elapsed 362%CPU
Z4G4 no 5 245.15user 34.63system 1:24.93elapsed 329%CPU
Z640 no 5 244.75user 34.87system 1:25.98elapsed 325%CPU
Z4G4 no 10 245.21user 35.64system 1:29.63elapsed 313%CPU
Z640 no 8 248.71user 55.90system 1:33.01elapsed 327%CPU
Z640 no 10 250.90user 55.78system 1:42.12elapsed 300%CPU
Z640 yes 8 298.19user 69.30system 1:59.77elapsed 306%CPU
Z640 yes 10 300.58user 68.90system 2:01.53elapsed 304%CPU
Z420 no 5 359.01user 44.95system 2:07.33elapsed 317%CPU
Z640 yes 5 322.40user 71.82system 2:34.66elapsed 254%CPU
Z420 yes 5 372.03user 42.95system 2:42.15elapsed 255%CPU
Z640 yes 15 299.26user 67.18system 2:59.77elapsed 203%CPU
Z640 no 15 250.05user 54.60system 3:07.61elapsed 162%CPU

Building Warzone 2100

System BOINC Compression CPU Time Elapsed CPU%
Z840 no 10 6549.21user 89.46system 4:18.90elapsed 2564%CPU
Z840 no 5 6533.81user 90.50system 4:19.24elapsed 2555%CPU
Z640 no 5 7040.87user 183.12system 7:13.50elapsed 1666%CPU
Z840 yes 5 8039.52user 169.62system 8:02.86elapsed 1700%CPU
Z640 yes 5 7486.44user 205.03system 11:09.97elapsed 1148%CPU
Z4G4 no 5 7891.32user 74.45system 17:48.03elapsed 745%CPU
Z4G4 no 10 7942.10user 77.43system 17:58.72elapsed 743%CPU

Hyper-Threading

Build HT Compression CPU Time Elapsed CPU%
Warzone yes 5 7891.32user 74.45system 17:48.03elapsed 745%CPU
Warzone yes 10 7942.10user 77.43system 17:58.72elapsed 743%CPU
Warzone no 5 4492.45user 59.09system 19:59.01elapsed 379%CPU
Warzone no 10 4497.28user 59.46system 20:07.15elapsed 377%CPU
Refpolicy yes 5 245.15user 34.63system 1:24.93elapsed 329%CPU
Refpolicy yes 10 245.21user 35.64system 1:29.63elapsed 313%CPU
Refpolicy no 5 180.84user 29.74system 1:32.30elapsed 228%CPU
Refpolicy no 10 180.29user 30.07system 1:35.01elapsed 221%CPU

Related posts:

  1. HP z840 Many PCs with DDR4 RAM have started going cheap on...
  2. Firebuild After reading Bálint’s blog post about Firebuild (a compile cache)...
  3. Matching Intel CPUs To run a SMP system with multiple CPUs you need...
  •  

Birger Schacht: Status update, May 2026

Debian Related Work

  • Uploaded labwc 0.9.7-1 to unstable; labwc 0.20 was released upstream since then, but it requires wlroots 0.20.1 which has not landed in Debian yet
  • Uploaded usbguard 1.1.4+ds-3 & 1.1.4+ds-4: cleaned up the packaging and fixed some long standing issues with the configuration; the legacy permission system isn’t the default anymore
  • Uploaded foot 1.27.0-1 to unstable
  • Uploaded scdoc 1.11.4-2 to unstable
  • Uploaded cage 0.3.0-2 to unstable
  • Uploaded sway 1.12~rc3-2 to unstable; on the same day sway 1.12 was released and I uploaded 1.12-1 to unstable
  • Uploaded swayimg 5.2-1 to unstable
  • Uploaded git-quick-stats 2.11.0-1 to unstable
  • Uploaded grim 1.5.0+ds-1 to unstable

DH Related Work

A big chunk of my DH related work went into designing & implementing a search app for the APIS framework. Our goal is to have a way of searching over various types of Django models. The app introduces a search model that indexes all registered models. We use a combination of PostgreSQLs full text search and Trigram Similarity to find the search results. Using a SearchVectorField and GinIndices for the trigram indexed fields we can reach a somewhat acceptable performance.

We released versions 0.63 and 0.64 of the APIS framework. The 0.63 release introduced the new entities app, which will soon hopefully replace the legacy apis_entities & apis_metainfo modules. Version 0.64 moved some logic from the legacy modules the entities module.

We made some progress in defining the endpoints for the PFP API.

  •  
❌