Packages changed: MicroOS-release (20261011 -> 20261012) fwupd gpg2 (2.5.22 -> 2.5.24) grub2 (2.14 -> 2.16) libbpf (1.7.0 -> 1.8.0) llvm23 (23.1.2 -> 23.1.3) sbc === Details === ==== MicroOS-release ==== Version update (20261011 -> 20261012) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== fwupd ==== Subpackages: libfwupd3 typelib-1_0-Fwupd-2_0 - move Polkit rules into the proper package - package org.freedesktop.fwupd.rules to allow fwupd-refresh.service to succeed for the "fwupd-refresh" service user (bsc#1279948). - add polkit-rules.patch: patch out the "wheel" group part from the Polkit policy, which was the reason for not packaging the rules files previously. ==== gpg2 ==== Version update (2.5.22 -> 2.5.24) - Update to 2.5.24: * scd: Fix for regression in 2.5.23 related to the new Nitrokey detection - Update to 2.5.23: * gpg: New option --allow-9980 to enable the processing of RFC-9980 specified data structures. The use of this option is only recommended if external policy requirements demand the use of these governmental approved specification. PGP folks requiring some PQC resistance should keep on using the standard LibrePGP Kyber algorithm introduced 2 years ago * gpg: In 9980 mode support PQC encryption using ML-KEM (aka Kyber) with X448, X25519, Brainpool, or NIST curves as specified by RFC-9980 et al * gpg: In 9980 mode support ED25519 and X25519 as specified by RFC-9580 under the names "ietf27" and "ietf27". * gpg: Add experimental support for a --compliance=fips mode to use GCM for bulk encryption. * scd: Add Nitrokey 3 to pcsc-shared interference detection * gpgsm: Fix an exploitable printf bug when using the debug option "--debug x509" * dirmngr: Make the LDAP upload flags also work for KS_SEARCH * dirmngr: Fix OOB read in DNS CERT record parser * scd: Fix OOB access in DO parsing of faulty cards * dirmngr: Add a mitigation for badly configured web key directories * New option --debug-no-libgcrypt for gpg, gpgsm, and agent This debug option is useful to avoid cluttering other debug output with libgcrypt generated debug details * gpg: New --list-options "debug-show-sexp" to print a secret key as an s-expression - drop patches due to different upstream changes: * gnupg-add-test-cases-for-import-without-uid.patch * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch - Rebase patches: * gnupg-add_legacy_FIPS_mode_option.patch * Rebase gnupg-revert-rfc4880bis.patch ==== grub2 ==== Version update (2.14 -> 2.16) Subpackages: grub2-common grub2-i386-efi grub2-i386-efi-bls grub2-i386-pc grub2-snapper-plugin grub2-x86_64-efi grub2-x86_64-efi-bls - Add upstream patch to fix CDROM boot failures (boo#1282614): * 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch - fix typos in description - Fix a potential boot error when loading the synthesized initrd * 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch - Backport upstream fixes to verify linux initrd in place to avoid the potential OOM (bsc#1275739) * 0001-kern-file-record-file-type-and-track-in-place-verifi.patch * 0002-verifiers-support-in-place-verification.patch * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch * 0004-loader-linux-measure-initrd-in-place.patch * 0005-docs-grub-dev.texi-Document-in-place-verification.patch - Patch refreshed * 0001-clean-up-crypttab-and-linux-modules-dependency.patch * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch - fix typos - Update to 2.16 * libgcrypt 1.12.2. * libtasn1 4.21.0. * ML-DSA post-quantum signature support for appended signatures. * Certificate revocation (dbx) checks for appended signatures. * PKCS#7 signedAttrs verification and X.509 validity period checking. * NVMe native disk support. * NVMe over Fibre Channel and multiple NVMe boot paths on IEEE 1275. * virtio-net driver. * AMBA PL011 UART support. * DHCPv6 support and network configuration from the UEFI device path. * Argon2 password hashing for GRUB users and the grub-mkpasswd-argon2 utility. * Access levels for authentication in grub-mkconfig. * MFA key protector. * TPCM (Trusted Platform Control Module) verifier on x86_64 EFI. * New tpm_record_pcrs command exposing a TPM PCR snapshot to the OS. * New efibootnext module and 31_efi_bootnext script for one-shot boot entries. * New connectefi, lsefivar, btrfs-info, btrfs-list-subvols and btrfs-get-default-subvol commands. * Downstream SBAT support and SBAT level validation in grub-mkimage. * Serial port addresses restricted to firmware-described UARTs under lockdown. * Drop UGA Draw and Console Control protocols support. * GitLab CI with multi-architecture builds, clang jobs and weekly Coverity scans. * Cygwin and mingw cross-build fixes. * Filesystems hardening and fixes. * Video readers and font fixes found by fuzzing. * EFI code improvements and fixes. * Network stack fixes. * Coverity and memory leak fixes. * ofpath and grub-install host utility robustness fixes. * Tests improvements. * Documentation improvements. * ... and tons of other fixes and cleanups... - Patch removed * 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch * 0002-fs-btrfs-add-btrfs-info-command.patch * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch * 0002-efinet-Add-structures-for-PXE-messages.patch * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch * 0004-grub.texi-Add-net_dhcp6-document.patch * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch * 0006-efinet-Configure-network-from-UEFI-device-path.patch * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch * 0001-test-Fix-f-test-on-files-over-network.patch * 0002-http-Return-HTTP-status-code-in-http_establish.patch * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch * 0004-tftp-Fix-hang-when-file-is-a-directory.patch * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch * 0003-disk-reduce-cache-slot-thrashing.patch * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0001-Make-grub.cfg-compatible-to-old-binaries.patch * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch * grub2-bls-boot-show-snapshot.patch * 0001-getroot-Skip-mount-points-in-grub_find_device.patch * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch * 0002-Revert-configure-Check-linker-for-image-base-support.patch * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch * 0001-Mandatory-install-device-check-for-PowerPC.patch * 0001-osdep-linux-ofpath-Update-strstr-calls.patch * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch * gcc16.patch * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch - Patch rebased * use-grub2-as-a-package-name.patch * info-dir-entry.patch * grub2-sysfb.patch * grub2-iterate-and-hook-for-extended-partition.patch * grub2-secureboot-chainloader.patch * grub2-s390x-04-grub2-install.patch ... changelog too long, skipping 24 lines ... 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch ==== libbpf ==== Version update (1.7.0 -> 1.8.0) - Update to version 1.8.0 * Add f{entry,exit,session}.multi support on x86-64 * Add tp.s/raw_tp.s/tp_btf.s (sleepable) support * Support attaching struct_ops maps to cgroups * Support reading BPF streams through pollable fds * Support custom loads of individual programs from prepared BPF objects * Add helpers to change specific program flags while preserving others * Support kernel logs for map creation and fd-based uprobe_multi targets * Add BTF kind layouts, 24-bit vlen, and location kinds * Add type lookup within the current BTF object * Add allowlist for kernel module BTF loading * Emit BTF declaration tags as C attributes * Add .percpu global variable and callx (indirect call) support * Optimize nop/nop10 USDTs on Linux 7.3+, use regular uprobes otherwise - Update %license to LICENSE.LGPL-2.1-only ==== llvm23 ==== Version update (23.1.2 -> 23.1.3) - Update to version 23.1.3. * This release contains bug-fixes for the LLVM 23.1.0 release. This release is API and ABI compatible with 23.1.0. ==== sbc ==== - Add Fix-offby1-sbc_unpack_frame_internal.patch (CVE-2026-16473 bsc#1272367)