UPDATE 16:30 UTC: BuildSystem is back online.
UPDATE 18:30 UTC: Website, Bugzilla, Forums, Wiki are back online
UPDATE Feb 28 01:15 UTC: Mailing lists are back online (web interface still WIP)
UPDATE 16:30 UTC: BuildSystem is back online.
UPDATE 18:30 UTC: Website, Bugzilla, Forums, Wiki are back online
UPDATE Feb 28 01:15 UTC: Mailing lists are back online (web interface still WIP)
Before we get in to the roundup, here’s a huge thank-you to the Mageians who helped with all the password resets after our security problem reported last week. Everything is mostly sorted now, but please contact the forum or the discuss mailing list if you still need help.
Over the last two weeks, 1282 packages came into updates/testing – the dev team has not been idle! And as you’ll see below, some security updates are still coming through for Mageia 5, but make sure you’re ready for the EOL if you haven’t yet upgraded to Mageia 6.

As always, you can check for yourself on Mageia Advisories, the Mageia AppDB, PkgSubmit to see the last 48 hours, and Bugzilla to see what’s currently happening.
A user was able to gain access to our LDAP database and has published the email addresses and names, as well as apparent password hashes, of anyone who has signed up to identity.mageia.org. However, the published hashes do not match those on record, and all capitalisation has been removed, so it is not clear that the actual passwords have been compromised. All of the passwords have since been reset as a security precaution. New rules have been added to prevent access to the LDAP server. The sysadmins are investigating how the fields were read, as the configuration should have specifically prevented this.
The passwords stored by the Mageia LDAP server are hashed and salted, meaning that the full decryption of the password, if they have actually been leaked, into a human-usable format would require significant computing power for safe and complex passwords. Despite the leaked data only appearing to be names and email addresses of identity.mageia.org users, we strongly urge users to be cautious if the password used for their Mageia account is used elsewhere, and we recommend changing passwords wherever else it is used.
To regain access to your Mageia account, the reset password link should be sufficient for all users without git access.The reset password link can be obtained by asking for a password reset on https://identity.mageia.org/forgot_password after which you’ll receive a mail with the link.
For privileged users, a sysadmin should be contacted to regain access.
We sincerely apologise for any problems and inconvenience that this might cause.
This update comes to us courtesy of tmb, our kernel magician:
Since we released 4.14.18 yesterday, we now are in pretty good shape with the mitigations, especially on x86_64. We now have bits in place for Spectre v1, v2 and Meltdown.
Of course over the coming weeks/months there will be more follow-up fixes upstream to cover corner cases, missed fixes and improvements for all of this…
And we still need Intel and AMD to release microcodes so hardware vendors can release updated BIOS/EFI firmwares and to the public so we can provide microcode updates in case of vendors not providing new BIOS/EFI firmwares.
Oh, and for those that like to check 🙂 The official way of checking the kernel status is:
grep . /sys/devices/system/cpu/vulnerabilities/*
We still lack meltdown support for 32bit in mga6, but we have now (Feb 9th) merged the upstream suggested patches for it in Cauldron, so a kernel with those patches will land in testing later today along with an update to 4.14.19
It still lacks some performance related bits, but we are getting there.
Many thanks to tmb for taking the time to bring us this update!
Edit: we corrected the grep command due to the helpful comments.
Before we get to FOSDEM, an important update came through in the last few hours – this follows tmb’s explanation from the last roundup:
MGASA-2018-0125 – Updated kernel packages fix security vulnerabilities
Publication date: 11 Feb 2018
URL: https://advisories.mageia.org/MGASA-2018-0125.html
Type: security
CVE: CVE-2017-5715, CVE-2017-5753
Description:
This kernel update is based on the upstream 4.14.18 and and adds some support for mitigating Spectre, variant 1 (CVE-2017-5753) and as it is built with the retpoline-aware gcc-5.5.0-1.mga6, it now provides full retpoline mitigation for Spectre, variant 2 (CVE-2017-5715). WireGuard has been updated to 0.0.20180202. This update also fixes the rtl8812au driver that got broken/missing in the upgrade to 4.14 series kernels (mga#22524). For other fixes in this update, read the referenced changelogs.
Many thanks to tmb and the other devs for all their work on this!
We’ll be back with a more complete roundup next week; now to FOSDEM, from one who has been there every year…
Since Mageia was born, FOSDEM has been a very important event for us. Six times we had a booth and our General Assembly during the event, we’ve always had a Mageia dinner and there were always more ways to enjoy meeting one another.
This blog post was almost not written, though, because until less than a week before FOSDEM, it was only sure of one council member, akien, that he’d be there. However, he’d mainly be there for another really nice project, the Godot Engine. Apart from that, our application for a stand was turned down (again).
Six days before FOSDEM, names started to get added to our FOSDEM 2018 Wiki page. One day later, it became certain that ennael would be at FOSDEM and on Wednesday, the number of council members who’d go increased from 2 to 4. It was only after that, that we tried to find volunteers to help organise various ways to meet one another in Brussels.
We do regret that – we’re aware that likely more Mageians would have been there, had things been organised better and earlier!
In the end, there were at least 14 Mageia community members at FOSDEM. We didn’t all manage to meet one another, but most of us were at an informal non-GA meeting (the General Assembly is expected to be done on-line with Mumble later on, so that more council/board/association members can participate).
Most of the things said during the informal meeting will be repeated during the GA, apart from karine stepping forward as new contributor (she’ll be an existing contributor when we have the GA 😉 ) and from a remark that tmb made after ennael told us about the large number of contributors with health problems that we have. He said something like “Mageia, the distribution for people with health issues”. We all laughed, but there’s a lot of truth in that remark: contributors with health issues have always been just as welcome in Mageia as contributors in perfect health.
Mageia wouldn’t exist if it had been created by healthy people only (nor when it had been created by ill people only, of course 😉 ). Anyway, if you’d like to contribute but worry whether you’re healthy enough to be accepted: stop worrying, your contribution is just as welcome as anyone else’s. There’s no minimum amount of work a contributor should do, so find a team or a task and just contribute when you feel up to it 🙂
Without having made a reservation, and after a good walk along many restaurants, looking for one with enough room for us, eight of us had a nice dinner in a halal restaurant, a “first time” for most or all of us. It has become a tradition to go to another place after the restaurant, to enjoy a waffle . It might not be the best tradition, though, given how much some bellies are growing.
During the non-GA meeting, akien proposed what might become a new tradition: meet around lunch time next day for a beer together. For some it was more lunch than beer, but in any case it was nice to have another opportunity to get together, because without a Mageia stand, there is no natural place to meet.
It seems every year FOSDEM gets more crowded, and more and more often talks attract a lot more interested visitors than fit in the room. I didn’t manage to see ovitters, who was on the GNOME stand – it was so busy I couldn’t get near.
One of the Mageians attending found FOSDEM very difficult: “Because of the huge amount of people I missed important speaks I wanted to attend as you had to crash and disturb the previous talk to have any chance what so ever to attend until the room was “closed”. While in a room the audio quality in the PA system was so bad I couldn’t hear anything. Because of these issues I will never go there again. I’m very disappointed and frustrated I wasted time on this. This was aimed at FOSDEM so they get criticism, the fact I enjoyed meeting you and other folks is irrelevant.”
Many talks are available as videos here: https://video.fosdem.org/2018/ and here https://www.youtube.com/user/fosdemtalks/videos.
Because FOSDEM is so crowded, meaning we couldn’t get access to a room or have a stand, it was kind of difficult for Mageians to get together. Maybe we need to consider some other venue to meet – at a less crowded and better-organised conference, or even outside a conference? Your input is very important here – please comment below, or raise your voice in the Forums or on the mailing lists.
Thanks to Marja for writing this up! W’d hoped to include some pics, but the Mageians who took them have gone all shy – maybe next week…