[$] Improvements to GCC's -fanalyzer option
For the second year in a row, the GNU Tools Cauldron (the
annual gathering of GNU toolchain developers) has been held as a dedicated track
at the online Linux Plumbers Conference. For the 2021 event, that track started
with a talk by David Malcolm on his work with the GCC -fanalyzer option, which
provides access to a number of static-analysis features. Quite a bit has been
happening with -fanalyzer and more is on the way with the upcoming GCC 12
release, including, possibly, a set of checks that have already found at least
one vulnerability in the kernel.
Security updates for Thursday
Security updates have been issued by Debian (ruby-kaminari
and tomcat8), Mageia (389-ds-base, ansible, apache, apr, cpio, curl, firefox,
ghostscript, gifsicle, gpac, libarchive, libgd, libssh, lynx, nextcloud-client,
openssl, postgresql, proftpd, python3, thunderbird, tor, and vim), openSUSE
(chromium, ffmpeg, grilo, hivex, linuxptp, and samba), Oracle (go-toolset:ol8,
kernel, kernel-container, krb5, mysql:8.0, and nodejs:12), SUSE (ffmpeg,
firefox, grilo, hivex, kernel, linuxptp, nodejs14, and samba), and Ubuntu (ca-
certificates, edk2, sqlparse, and webkit2gtk).
[$] LWN.net Weekly Edition for September 23, 2021
The LWN.net Weekly Edition for September 23, 2021 is
available.
Courtès: What's in a package
Over at the Guix-HPC blog, Ludovic Courtès writes about
trying to package the PyTorch machine-learning library for the Guix
distribution. Building from source in a user-verifiable manner is part of the
philosophy behind Guix, but there were a number of problems that were
encountered: The first surprise when starting packaging PyTorch is that, despite
being on PyPI, PyTorch is first and foremost a large C++ code base. It does have
a setup.py as commonly found in pure Python packages, but that file delegates
the bulk of the work to CMake.
The second surprise is that PyTorch bundles
(or "vendors", as some would say) source code for no less than 41 dependencies,
ranging from small Python and C++ helper libraries to large C++ neural network
tools. Like other distributions such as Debian, Guix avoids bundling: we would
rather have one Guix package for each of these dependencies. The rationale is
manifold, but it boils down to keeping things auditable, reducing resource
usage, and making security updates practical.
[$] A discussion on folios
A few weeks ago, Matthew Wilcox might have guessed that his
session at the 2021 Linux Plumbers Conference would be focused rather
differently. But, as we reported earlier in September, his folio patch set ran
into some, perhaps unexpected, opposition and, ultimately, did not land in the
mainline for 5.15. Instead of discussing how to use folios as part of the File
Systems microconference, he led a discussion that was, at least in part, on the
path forward for them.
