fidzu : Ubuntu

Ubuntu developers confirm plans to ship 2 new apps in Ubuntu 26.04 LTS, replacing its video and system monitor apps with a pair it feels are more 'modern'.

You're reading Ubuntu 26.04 Replaces System Monitor and Totem with New Apps, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

27 Nov 2025 4:18am GMT

Nesta semana e seguintes, vamos apostar no Ubuntu Touch e trazer o Software Livre nos telefones para as massas! O Miguel resolveu problemas com a ajuda da comunidade, o Diogo vai ao Porto evangelizar à bruta com o Ruben Carneiro e o sol brilhará para todos nós. A Canonical promete suporte para 15 anos; o Xubuntu foi hackeado porque não usa Hugo (womp, womp); o Miguel agora usa mano e bro em cada frase por causa de impressoras e vai converter-se ao Debian com Plasma e MEU DEUS, AS MÁQUINAS DA STEAM SÃO LINDAS!! FUUUUYYYYYOOOOH!!!

Já sabem: oiçam, subscrevam e partilhem!

• Ubuntu Touch: https://www.ubuntu-touch.io/
• Sessão sobre Ubuntu Touch no LCD Porto (27 e 29 de Novembro): https://porto.ectl.softwarelivre.eu/pt/schedule/2025/
• Ruben Carneiro: https://rubencarneiro.github.io/rubencarneiro.io/
• Bugs do UT no Gitlab: https://gitlab.com/ubports/development/ubuntu-touch
• Pesquisar sem IA: https://noai.duckduckgo.com
• Canon Pixma, controladores para Linux: https://www.canon.pt/support/consumer/products/printers/pixma/ts-series/pixma-ts3150.html?type=drivers&os=Linux%20(64-bit)
• CUPS? Temos tudo: https://openprinting.github.io/cups/
• Mais apps? Não, obrigado: https://youtu.be/kfgtqNrGAFs
• Câmara da UBports: https://open-store.io/app/camera.ubports
• Manigâncias para o Mistério da Câmara Desaparecida: https://forums.ubports.com/topic/10425/camera-app-cannot-be-installed/30
• Podcat: https://open-store.io/app/podcat.cibersheep
• Podbird: https://open-store.io/app/com.mikeasoft.podbird
• Debian 13 Trixie: https://www.debian.org/releases/trixie/
• KDE Plasma 6: https://kde.org/announcements/megarelease/6/
• João Gabriel Ribeiro (Shifter.pt): https://shifter.pt/author/joao-gabriel-ribeiro/
• Uncle Roger, embaixador da cozinha oriental, originário da Malásia: https://www.youtube.com/channel/UCVjlpEjEY9GpksqbEesJnNA
• Tio Roger num casamento Bengali em Sintra: https://youtu.be/wJoLjhgguwA
• O site do Xubuntu foi hackeado e distribuiu malware:
  • https://www.omgubuntu.co.uk/2025/10/xubuntu-website-malware-hack
  • https://www.omgubuntu.co.uk/2025/11/xubuntu-website-breach-report
  • https://lists.ubuntu.com/archives/xubuntu-users/2025-November/012210.html
• A Canonical oferece suporte para 15 anos:
  • https://discourse.ubuntu.com/t/foundations-team-updates-2025-11-20/72480/3?u=d0od
  • https://www.omgubuntu.co.uk/2025/11/ubuntu-lts-releases-15-years-of-support
  • https://ubuntu.com/blog/canonical-expands-total-coverage-for-ubuntu-lts-releases-to-15-years-with-legacy-add-on
• Steam da Valve; hardware para fartura de jogos em Linux: https://store.steampowered.com/sale/hardware
• Steam Machine:
  • https://youtu.be/VkW3wTHT-p8
  • https://youtu.be/g3FkuZNSGkw
• Steam Frame:
  • https://youtu.be/b7q2CS8HDHU
  • https://youtu.be/dU3ru09HTng
• NeXT computer (1988): https://en.wikipedia.org/wiki/NeXT_Computer
• LoCo PT: https://loco.ubuntu.com/teams/ubuntu-pt/
• Mastodon: https://masto.pt/@pup
• Youtube: https://youtube.com/PodcastUbuntuPortugal

Atribuição e licenças

Este episódio foi produzido por Diogo Constantino, Miguel e Tiago Carrondo e editado pelo Senhor Podcast. O website é produzido por Tiago Carrondo e o código aberto está licenciado nos termos da Licença MIT. (https://creativecommons.org/licenses/by/4.0/). A música do genérico é: "Won't see it comin' (Feat Aequality & N'sorte d'autruche)", por Alpha Hydrae e está licenciada nos termos da CC0 1.0 Universal License. Os separadores de péssima qualidade foram tocados ao vivo e sem rede pelo Miguel, pelo que pedimos desculpa pelos incómodos causados. Os efeitos sonoros têm os seguintes créditos: [patrons laughing.mp3 by pbrproductions] (https://freesound.org/s/418831/) - License: Attribution 3.0. Concurso: [01 WINNER.mp3 by jordanielmills] - (https://freesound.org/s/167535/) - License: Creative Commons 0. Este episódio e a imagem utilizada estão licenciados nos termos da licença: Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), cujo texto integral pode ser lido aqui. Estamos abertos a licenciar para permitir outros tipos de utilização, contactem-nos para validação e autorização. A arte de episódio foi criada por encomenda pela Shizamura - artista, ilustradora e autora de BD. Podem ficar a conhecer melhor a Shizamura na Ciberlândia e no seu sítio web.

27 Nov 2025 12:00am GMT

KDE Plasma 6.8 will be Wayland-only, shipping without a desktop session to run the popular Qt-based desktop on top of the legacy X display server. As with GNOME (who ripped the bandaid off in GNOME 49), this change does not mean X11 applications will no longer work in KDE Plasma 6.8. Legacy software will run, as it already does on Wayland, though the Xwayland compatibility layer. But a dedicated Plasma X11 desktop session will not be provided. The deprecation is being signposted well in advance. KDE Plasma 6.5 was released in October 2025 and Plasma 6.8 is not due for […]

You're reading KDE Plasma is Going Wayland-Only (But Don't Panic Yet), a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

26 Nov 2025 5:44pm GMT

A font's a font - unless you're into typography! Google Sans Flex font is a new open source font made for screens. It looks great set as Ubuntu's system font.

You're reading Google Releases its New Google Sans Flex Font as Open Source, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

24 Nov 2025 10:35pm GMT

Raspberry Pi Image 2.0 goes stable with a major redesign, user flow and new features. Details on what's changed, what it can do and where to get it - inside!

You're reading Raspberry Pi Imager 2.0 Released with New Design, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

24 Nov 2025 5:17pm GMT

The collaboration makes it easy to boot directly into Ubuntu from AMI's UEFI firmware solutions

Nuremberg, Germany, November 24, 2025 - Today, Canonical, the publisher of Ubuntu, announced a partnership with AMI, a provider of Unified Extensible Firmware Interface (UEFI) solutions. The partnership will enable users of AMI's Aptio® V UEFI Firmware to netboot directly into Ubuntu by simply selecting Ubuntu Cloud Installation in the boot menu.

This new native boot functionality makes it easy and convenient to use Ubuntu, and eliminates the need for flashing images or using additional media or external devices. A simple Ethernet connection is enough to install and launch Ubuntu.

Alexander Lehmann (Sales Director - IoT, Canonical) and B. Parthiban (General Manager, Boot Firmware Group at AMI) are excited to provide users with the best out-of-the-box experience for Ubuntu.

"At AMI, we value partnerships that strengthen the ecosystem and deliver trusted solutions. Canonical's widely adopted, community-supported platform is recognized for its stability and reliability, making this collaboration a natural fit," commented B. Parthiban, General Manager, Boot Firmware Group at AMI. "Together, we're enabling secure, high-performance experiences for customers everywhere."

"Our collaboration with AMI furthers our commitment to deliver the best Ubuntu experience right out of the box. It's now even easier to install Ubuntu," said Alexander Lehmann, Sales Director - IoT, at Canonical.

The collaboration between Canonical and AMI kicks off at SPS - the Smart Production Solutions summit - in Nuremberg from November 25 to 27, 2025.

To find out more about Ubuntu, visit Canonical's booth in hall 6, number 112 and AMI's booth in hall 6, number 223.

* * *

About Canonical

Canonical, the publisher of Ubuntu Pro, provides open source security, support and services. Our portfolio covers critical systems, from the smallest devices to the largest clouds, from the kernel to containers, from databases to AI. With customers that include top tech brands, emerging startups, governments and home users, Canonical delivers trusted open source for everyone. Learn more at https://canonical.com/

About AMI

AMI is Firmware Reimagined for modern computing. As a global leader in Dynamic Firmware for security, orchestration, and manageability solutions, AMI enables the world's compute platforms from on-premises to the cloud to the edge. AMI's industry-leading foundational technology and unwavering customer support have generated lasting partnerships and spurred innovation for some of the most prominent brands in the high-tech industry. AMI is a registered trademark of AMI US Holdings, Inc. Aptio is a registered trademark of AMI in the US and/or elsewhere.

24 Nov 2025 9:41am GMT

Today, Canonical, the publisher of Ubuntu, announced a partnership with AMI, a provider of Unified Extensible Firmware Interface (UEFI) solutions, allowing users of AMI's Aptio® V UEFI Firmware to netboot directly into Ubuntu by simply selecting Ubuntu Cloud Installation in the boot menu.

24 Nov 2025 9:41am GMT

Open source software is known for its ability to lower IT costs. But in 2025, affordability is only part of the story. A new Linux Foundation report, The strategic evolution of open source, reveals that open source has evolved from a tactical cost-saving measure to a mission-critical infrastructure supporting enterprise-grade investments, and delivering stronger business outcomes as a result.

This transformation is supported by academic research estimating that, without open source, companies would pay roughly 3.5 times more to build the software running their businesses - an $8.8 trillion increase.[1]

Open source: from "free alternative" to core infrastructure

The 2025 World of Open Source Survey by the Linux Foundation reveals that open source is deeply embedded across enterprise technology stacks, making it a foundation for global IT operations. In fact, over 55% of analyzed tech stacks used a Linux-based operating system; and similarly, around half of all analyzed cloud, container, and DevOps technologies have Linux at their core.

The survey illuminates the many great reasons businesses are choosing open source: improved productivity, reduced vendor lock-in, and, unsurprisingly, lower total cost of ownership (TCO). Nearly half of organizations (46%) report an increase in business value from open source compared to last year, with 83% considering it valuable for their future. According to the World of Open Source Survey, 58% of organizations reported lower software ownership costs, and 63% cited higher productivity as a direct benefit of adopting open source. In addition, 62% reported reduced vendor lock-in and 75% judged their software quality to be higher thanks to OSS. Overall, 56% said the benefits of OSS exceeded the costs.[3] A Gartner study echoes these findings, showing that cost control and application development flexibility remain the top drivers of open source adoption.[2]

And it's not just about the costs: organizations that invest strategically in open source are 20% more likely to perceive competitive advantage, while 78% report workplace satisfaction and better talent attraction. Nearly 80% say open source makes their organization a better workplace, and 74% say it improves their ability to attract technical talent.

One respondent put it this way: "Open source is not supplementary tooling but an ecosystem of core infrastructure dependencies." This captures the shift perfectly: cost savings may start the conversation, but reliability, flexibility, and long-term value now drive adoption.

Why open source reduces IT costs and keeps cutting them

The same characteristics that make open source adaptable also make it economical:

• No per-seat licensing: organizations avoid scaling costs tied to user counts or cores
• Modular adoption: businesses can deploy only what they need, minimizing waste
• Shared innovation: security fixes, feature improvements, and bug patches benefit from collective community investment
• Interoperability and exit freedom: avoiding proprietary lock-in reduces switching costs and enables infrastructure that fits business strategy rather than the vendor's roadmap

Systems based on open source tend to have lower maintenance overhead and longer life cycles, advantages that compound fast. That's why enterprises see real savings,not just from shifting license costs to labor, but through genuine efficiency gains across teams.

Here's a real-world case study of that in action: Greek telecom leader Nova leveraged Canonical's planning and open pricing to control its CAPEX and OPEX, benefiting from predictable costs and freedom from management software licensing fees. Support from Canonical paid for "real expertise that enriches our team, rather than paying for access."[3]

Open source is also the backbone of AI, making it easier to adopt this increasingly must-have technology into business operations. McKinsey research highlights how open source frameworks accelerate AI adoption, enable faster product development, and catalyze ecosystem innovation, amplifying the total value beyond mere cost savings.[4] In fact, the LF's survey found that AI is the technology that benefits the most from being open source, according to 38% of respondents, and research from the Microsoft AI cloud Partners team showed that Linux environments such as Ubuntu deploy 63% faster with up to 306% ROl over three years.[5]

Mission-critical workloads demand enterprise-ready support

The data is clear: open source software lowers IT costs, but cost benefits only reach their full potential when paired with enterprise-ready support. For technical audiences, this isn't about "just" having a backstop: it's about operational excellence, security, and resilience. When issues do arise, they must be addressed quickly and precisely.

The survey shows 71% of organizations expect response times under 12 hours for critical OSS production issues, marking a shift from traditional community support to commercial-grade service-level agreements. In financial services and manufacturing, over 90% consider paid OSS support essential. This need for enterprise-grade support peaks in mission-critical workloads (54%), systems handling sensitive data (43%), and regulated sectors (38%).

There's a perception that support is 'too expensive', but quite to the contrary, paid commercial support does not diminish open source's cost benefits; instead, it enhances them. Just like OSS adoption saves on costs and licences, robust support services protect organizations against the potentially disastrous costs of downtime, compliance failures, or data breaches.

Canonical's own experience confirms that long-term OSS support is an increasingly strategic investment, especially in markets with high regulatory demands and cloud migration complexities.[6]

Take, for example, The European Space Agency (ESA), which depends on Canonical's distributions of Kubeflow and Spark running on Kubernetes for its mission operations. ESA highlights that Canonical's support lets them "sleep soundly," focusing on space missions while trusting infrastructure experts for uptime and reliability.[3]

How Ubuntu Pro locks in the value of open source

The biggest IT cost benefits of open source software come when free software innovation is combined with investments in professional support. After all, these low-cost (or sometimes free) tools are highly accessible and often intuitive to build with, but they can take a lot of time, effort, and specialized skills to maintain and secure in the long term.

Canonical takes away that time-consuming effort from developers, and allows them to focus on building, through Ubuntu Pro + Support, our comprehensive security maintenance and support service.

Ubuntu Pro + Support gives users a wide range of benefits, including:

• Up to 15 years of security maintenance and support covering thousands of open source components from the kernel to the applications layer.
• Compliance-ready patching for mission-critical, regulated, and sensitive workloads.
• Predictable enterprise SLAs aligned with the sub-12-hour incident response expectations of 71% of organizations.
• Transparent, forecastable total cost of ownership, eliminating license uncertainties.

Ubuntu Pro extends cost benefits beyond licensing into comprehensive lifecycle management, turning open source affordability into sustained business value.

Open source is an economic strategy, not a shortcut

In conclusion, the business benefits of open source are clear to see, and widely reflected in the business landscape, where record numbers of organizations and tech stacks have open source as a core part of their mission-critical systems. The permissive licences, lack of vendor lock-in, and flexibility of open source make it a clear cost optimizer; but the most significant IT cost savings emerge when organizations combine free software innovation with enterprise-grade support, governance, and active engagement. Those who treat open source as core infrastructure aren't just saving money: they're building competitive, secure, and innovative foundations for growth.

$8.8 trillion - that's what open source is worth to the global economy. If you're not building on it, you're paying for it somewhere else. The organizations leading in innovation, efficiency, and resilience already know: open source is the foundation of competitive advantage.

Sources

1. Open Source Software: The $9 Trillion Resource Companies Take for Granted, HBS
2. Top challenges to using Open-source for product and application development, Gartner
3. What's the state of open source adoption in Europe?, Ubuntu blog
4. Open source technology in the age of AI, McKinsey
5. IDC Business Value Study: A 306% ROI within 3 years using Ubuntu Linux on Azure, Microsoft Azure
6. 54% of European enterprises want long term open source support: how Ubuntu Pro + Support delivers, Ubuntu blog
7. The value of open source software is more than cost savings, Linux Foundation

24 Nov 2025 9:40am GMT

Open source software is known for its ability to lower IT costs. But in 2025, affordability is only part of the story. A new Linux Foundation report, The strategic evolution of open source, reveals that open source has evolved from a tactical cost-saving measure to a mission-critical infrastructure supporting enterprise-grade investments, and delivering stronger business […]

24 Nov 2025 9:40am GMT

Canonical's engineers have submitted pull requests to add RISC-V support to Google's Flutter toolkit, which Ubuntu uses to built many of its desktop apps.

You're reading Ubuntu Upstreams Patches to Bring Flutter Apps to RISC-V, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

23 Nov 2025 7:51pm GMT

Can the Raspberry Pi 500+ work as a standalone Bluetooth keyboard? Yes, using the open-source btferret project - but not without limitations, as I report.

You're reading Raspberry Pi 500+ Works as Standalone Keyboard (Well, Kinda), a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

21 Nov 2025 11:12pm GMT

What if you could work on real-world projects, shape cutting-edge technology, collaborate with developers across the world, make a meaningful impact with your design skills, and grow your portfolio… all without applying for an internship or waiting for graduation? That's what we aim to do with open design: an opportunity for universities and students of […]

21 Nov 2025 9:39am GMT

Enhanced Android device simulation, smarter diagnostics, and OIDC-enforced authentication The Anbox Cloud team has been working around the clock to release Anbox Cloud 1.28.0! We're very proud of this release that adds robust authentication, improved diagnostic tools, and expanded simulation options, making Anbox Cloud even more secure, flexible, and developer-friendly for running large-scale Android workloads. […]

21 Nov 2025 8:00am GMT

LibrePods brings AirPods Pro features to Linux desktops, including active noise cancellation, transparency mode, ear detection and accurate battery levels.

You're reading Use AirPods Pro Features on Linux with LibrePods, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

20 Nov 2025 11:58pm GMT

But what if we could write something that would take a static binary, replace at least the direct syscalls with ones going through libc and load it with the dynamic linker? We are in luck, because the excellent QEMU project has a user space emulator! It can be compiled as a dynamically linked executable, honors LD_PRELOAD and uses the host libc's syscall - well, at least sometimes. Sometimes syscalls just bypass libc.

The missing piece was a way to make QEMU always take the interposable path and call the host libc instead of using an arch-specifix assembly routine (`safe_syscall_base`) to construct the syscall and going directly to the kernel. Luckily, this turned out to be doable. A small patch later, QEMU gained a switch that forces all syscalls through libc. Suddenly, our static binaries started looking a lot more dynamic!

$ faketime '2008-12-24 08:15:42'  qemu-x86_64 ./test_static_clock_gettime
2008-12-24 08:15:42.725404654
$ file test_static_clock_gettime 
test_clock_gettime: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, ...

With this in place, Firebuild can finally wrap even those secretive statically linked tools. QEMU runs them, libc catches their syscalls, LD_PRELOAD injects libfirebuild.so, and from there the usual interposition magic happens. The result: previously uncachable build steps can now be traced, cached, and shortcut just like their dynamic friends.

There is one more problem though. Why would the static binaries deep in the build be run by QEMU? Firebuild also intercepts the `exec()` calls and now it rewrites them on the fly whenever the executed binary would be statically linked!

$ firebuild -d comm bash -c ./test_static
...
FIREBUILD: fd 9.1: ({ExecedProcess 161077.1, running, "bash -c ./test_static", fds=[0: {FileFD ofd={FileO
FD #0 type=FD_PIPE_IN r} cloexec=false}, 1: {FileFD ofd={FileOFD #3 type=FD_PIPE_OUT w} {Pipe #0} close_o
n_popen=false cloexec=false}, 2: {FileFD ofd={FileOFD #4 type=FD_PIPE_OUT w} {Pipe #1} close_on_popen=fal
se cloexec=false}, 3: {FileFD NULL} /* times 2 */]})
{
    "[FBBCOMM_TAG]": "exec",
    "file": "test_static",
    "// fd": null,
    "// dirfd": null,
    "arg": [
        "./test_static"
    ],
    "env": [
        "SHELL=/bin/bash",
 ...
        "FB_SOCKET=/tmp/firebuild.cpMn75/socket",
        "_=./test_static"
    ],
    "with_p": false,
    "// path": null,
    "utime_u": 0,
    "stime_u": 1017
}
FIREBUILD: -> proc_ic_msg()  (message_processor.cc:782)  proc={ExecedProcess 161077.1, running, "bash -c 
./test_static", fds=[0: {FileFD ofd={FileOFD #0 type=FD_PIPE_IN r} cloexec=false}, 1: {FileFD ofd={FileOF
D #3 type=FD_PIPE_OUT w} {Pipe #0} close_on_popen=false cloexec=false}, 2: {FileFD ofd={FileOFD #4 type=F
D_PIPE_OUT w} {Pipe #1} close_on_popen=false cloexec=false}, 3: {FileFD NULL} /* times 2 */]}, fd_conn=9.
1, tag=exec, ack_num=0
FIREBUILD:   -> send_fbb()  (utils.cc:292)  conn=9.1, ack_num=0 fd_count=0
Sending message with ancillary fds []:
{
    "[FBBCOMM_TAG]": "rewritten_args",
    "arg": [
        "/usr/bin/qemu-user-interposable",
        "-libc-syscalls",
        "./test_static"
    ],
    "path": "/usr/bin/qemu-user-interposable"
}
...
FIREBUILD: -> accept_ic_conn()  (firebuild.cc:139)  listener=6
...
FIREBUILD: fd 9.2: ({Process NULL})
{
    "[FBBCOMM_TAG]": "scproc_query",
    "pid": 161077,
    "ppid": 161073,
    "cwd": "/home/rbalint/projects/firebuild/test",
    "arg": [
        "/usr/bin/qemu-user-interposable",
        "-libc-syscalls",
        "./test_static"
    ],
    "env_var": [
        "CCACHE_DISABLE=1",
...
        "SHELL=/bin/bash",
        "SHLVL=0",
        "_=./test_static"
    ],
    "umask": "0002",
    "jobserver_fds": [],
    "// jobserver_fifo": null,
    "executable": "/usr/bin/qemu-user-interposable",
    "// executed_path": null,
    "// original_executed_path": null,
    "libs": [
        "/lib/x86_64-linux-gnu/libatomic.so.1",
        "/lib/x86_64-linux-gnu/libc.so.6",
        "/lib/x86_64-linux-gnu/libglib-2.0.so.0",
        "/lib/x86_64-linux-gnu/libm.so.6",
        "/lib/x86_64-linux-gnu/libpcre2-8.so.0",
        "/lib64/ld-linux-x86-64.so.2"
    ],
    "version": "0.8.5.1"
}

The QEMU patch is forwarded to qemu-devel. If it lands, anyone using QEMU user-mode emulation could benefit - not just Firebuild.

For Firebuild users, though, the impact is immediate. Toolchains that mix dynamic and static helpers? Cross-builds that pull in odd little statically linked utilities? Previously "invisible" steps in your builds? All now fair game for caching.

Firebuild 0.8.5 ships this new capability out of the box. Just update, make sure you're using a patched QEMU, and enjoy the feeling of watching even static binaries fall neatly into place in your cached build graph. Ubuntu users can get the prebuilt patched QEMU packages from the Firebuild PPA already.

Static binaries, welcome to the party!

20 Nov 2025 8:56pm GMT

Mozilla's new TABS API helps developers build AI agents to automate web tasks, as the company continues to bet on AI as its future. Details, pricing, and links inside.

You're reading TABS API is Mozilla's Latest Bet on the Agentic Web, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

19 Nov 2025 4:11pm GMT

The Xubuntu team has shared an incident report on its October website breach. Attackers brute-forced the site to inject malware - but was anything else affected?

You're reading Xubuntu Reveals How its Website Was Hijacked, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

18 Nov 2025 11:59pm GMT

Paintbrushes at the ready, as the first GIMP 3.2 release candidate is available for testing. New features and a flurry of fixes are on offer - more details inside!

You're reading GIMP 3.2 Hits Release Candidate with Improved Text Editing + More, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

18 Nov 2025 7:53pm GMT

A new Linux Foundation report reveals how organizations worldwide are adopting, using, and perceiving open source software. The Linux Foundation's latest report, The state of global open source, has just been released in collaboration with Canonical. The report follows the Linux Foundation's European spotlight report, released earlier this year, and confirms that many of the […]

18 Nov 2025 4:10pm GMT

We get a lot of questions about FIPS 140-3, and so we decided to put together this comprehensive collection of video resources to answer the most burning ones we've had so far.

17 Nov 2025 6:23pm GMT

Wattage is a modern GTK4/libadwaita app that detailed battery information on Linux, including capacity, health, cycles, and power draw - no terminal required.

You're reading Monitor Your Linux Laptop Battery Health with Wattage, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

16 Nov 2025 11:05pm GMT

Thunderbird 145 has been released with support for Microsoft Exchange e-mail accounts, DNS over HTTPS, renamed Junk folder and other improvements.

You're reading Thunderbird 145 Brings Microsoft Exchange Support + More, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

14 Nov 2025 4:04pm GMT

Where is open source going next? What's in store for open source in the coming years, particularly in relation to security? Here's a CISO's reflection on the state of open source, and the trends that you can expect to have an impact going into 2026.

14 Nov 2025 8:00am GMT

AI browsing mode is coming to the Firefox web browser, Mozilla announce. Interested users can join a waiting list to get invite-only early access. Details inside.

You're reading Firefox is Getting a New AI Browsing Mode, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

13 Nov 2025 11:37pm GMT

Canonical has announced Ubuntu LTS releases will now be supported for 15 years from release through the Ubuntu Pro Legacy Add-on.

You're reading Ubuntu LTS Releases Now Get 15 Years of Support, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

13 Nov 2025 7:18pm GMT

Sylva 1.5 becomes the first release to include Kubernetes 1.32, bringing the latest open source cloud-native capabilities to the European telecommunications industry. With the launch of Sylva 1.5, Canonical Kubernetes is now officially part of the project's reference architecture. This follows its earlier availability as a technology preview in Sylva 1.4. What is the Sylva […]

13 Nov 2025 5:37pm GMT

A new version of miracle-wm, the Mir-based compositor/tiling window manager, is out with a clutch set of new configuration options - details inside.

You're reading Miracle-WM Adds Accessibility, Touchpad & Animation Options, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

13 Nov 2025 4:08pm GMT

Ubuntu Pro now supports LTS releases for up to 15 years through the Legacy add-on. More security, more stability, and greater control over upgrade timelines for enterprises.

13 Nov 2025 9:11am GMT

O Miguel está enervadíssimo com Ubuntu Touch e fez peixeirada no Telegram, mas o Diogo tem boas notícias: para além de ter um monitor todo «gamer» para jogar SuperTuxKart, ele e o Ruben Carneiro vão ao Porto combater bravamente oligopólios malvados nos telefones! Revimos excelentes novidades do Firefox 145 que ajudam no combate às invasões de privacidade; discutimos a entrevista de Jon Seager sobre a última BRONCA da Canonical com Flatpaks e o que esperar do Ubuntu Core Desktop; debatemos violentamente as lojas de aplicações móveis e para acabar, planeámos raptar pessoas, inventar séries de Netflix com Linux e explicar porque é que o Pipewire não é um tubo ligado a um fio.

Já sabem: oiçam, subscrevam e partilhem!

• Ubuntu Touch: https://www.ubuntu-touch.io/
• Entrevista a Jon Seager (Canonical) no The Register:
  • https://www.theregister.com/2025/11/03/canonical_jon_seager_qa/
  • https://web.archive.org/web/20251110215122/https://www.theregister.com/2025/11/03/canonical_jon_seager_qa/
• Mozilla - as extensões de Firefox devem anunciar se recolhem dados:
  • https://web.archive.org/web/20251024131902/https%3A%2F%2Fwww.bleepingcomputer.com%2Fnews%2Fsoftware%2Fmozilla-new-firefox-extensions-must-disclose-data-collection-practices%2F
• Firefox testa resultados de pesquisa na barra de endereço, com um olho em patrocínios:
  • https://alternativeto.net/news/2025/10/firefox-tests-privacy-focused-direct-answers-in-the-address-bar/
• Firefox 145 protege-nos contra «fingerprinting» malvadão:
  • https://www.bleepingcomputer.com/news/security/mozilla-firefox-gets-new-anti-fingerprinting-defenses/
• A EFF ensina, induca e instrói: https://coveryourtracks.eff.org
• LCD Porto: https://lcdporto.org
• Agenda da ECTL Porto: https://porto.ectl.softwarelivre.eu/pt/schedule/2025/
• Launchpad: https://launchpad.net/
• Open Store: https://open-store.io/
• LoCo PT: https://loco.ubuntu.com/teams/ubuntu-pt/
• Mastodon: https://masto.pt/@pup
• Youtube: https://youtube.com/PodcastUbuntuPortugal

Atribuição e licenças

Este episódio foi produzido por Diogo Constantino, Miguel e Tiago Carrondo e editado pelo Senhor Podcast. O website é produzido por Tiago Carrondo e o código aberto está licenciado nos termos da Licença MIT. (https://creativecommons.org/licenses/by/4.0/). A música do genérico é: "Won't see it comin' (Feat Aequality & N'sorte d'autruche)", por Alpha Hydrae e está licenciada nos termos da CC0 1.0 Universal License. Os separadores de péssima qualidade foram tocados ao vivo e sem rede pelo Miguel, pelo que pedimos desculpa pelos incómodos causados. Os efeitos sonoros têm os seguintes créditos: [crowd booing by HowardV] (https://freesound.org/s/264378/) - License: Creative Commons 0; [Police Car Siren in Traffic by hyderpotter] (https://freesound.org/s/268809/) License: Creative Commons 0; [patrons laughing.mp3 by pbrproductions] (https://freesound.org/s/418831/) - License: Attribution 3.0. Este episódio e a imagem utilizada estão licenciados nos termos da licença: Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0), cujo texto integral pode ser lido aqui. Estamos abertos a licenciar para permitir outros tipos de utilização, contactem-nos para validação e autorização. A arte de episódio foi criada por encomenda pela Shizamura - artista, ilustradora e autora de BD. Podem ficar a conhecer melhor a Shizamura na Ciberlândia e no seu sítio web.

13 Nov 2025 12:00am GMT

Kaspersky launches Linux antivirus for Ubuntu and other distros. Features, system requirements and why the banned security firm has come to open-source desktops.

You're reading Kaspersky Brings Its Antivirus Software to Linux Desktops, a blog post from OMG! Ubuntu. Do not reproduce elsewhere without permission.

12 Nov 2025 11:24pm GMT

Today at KubeCon North America, Canonical, the publisher of Ubuntu, released support to enable FIPS mode in its Kubernetes distribution, providing everything needed to create and manage a scalable cluster suitable for high-security and Federal deployments.

11 Nov 2025 2:45pm GMT

Today Canonical, the publishers of Ubuntu, and Google Cloud announced the immediate availability of optimized Ubuntu images for the new Axion-based N4A virtual machines (VMs) on Google Compute Engine.

10 Nov 2025 10:08pm GMT

This is the first of two blog posts about how we created the color palette for a new design system at Canonical. In this post I share my journey into perceptually uniform color spaces and perceptual contrast algorithms. If you're already familiar with these concepts, skip to this section (or visit the Github repository) to […]

10 Nov 2025 12:49pm GMT

About 95% of my Debian contributions this month were sponsored by Freexian.

You can also support my work directly via Liberapay or GitHub Sponsors.

OpenSSH

OpenSSH upstream released 10.1p1 this month, so I upgraded to that. In the process, I reverted a Debian patch that changed IP quality-of-service defaults, which made sense at the time but has since been reworked upstream anyway, so it makes sense to find out whether we still have similar problems. So far I haven't heard anything bad in this area.

10.1p1 caused a regression in the ssh-agent-filter package's tests, which I bisected and chased up with upstream.

10.1p1 also had a few other user-visible regressions (#1117574, #1117594, #1117638, #1117720); I upgraded to 10.2p1 which fixed some of these, and contributed some upstream debugging help to clear up the rest. While I was there, I also fixed ssh-session-cleanup: fails due to wrong $ssh_session_pattern in our packaging.

Finally, I got all this into trixie-backports, which I intend to keep up to date throughout the forky development cycle.

Python packaging

For some time, ansible-core has had occasional autopkgtest failures that usually go away before anyone has a chance to look into them properly. I ran into these via openssh recently and decided to track them down. It turns out that they only happened when the libpython3.13-stdlib package had different versions in testing and unstable, because an integration test setup script made a change that would be reverted if that package was ever upgraded in the testbed, and one of the integration tests accidentally failed to disable system apt sources comprehensively enough while testing the behaviour of the ansible.builtin.apt module. I fixed this in Debian and contributed the relevant part upstream.

We've started working on enabling Python 3.14 as a supported version in Debian. I fixed or helped to fix a number of packages for this:

• cxxopt
• cython
• m2crypto
• pymongo (already fixed by Alexandre Detiste, but after checking this I took the opportunity to simplify its arrangements for disabling broken tests and to switch to autopkgtest-pkg-pybuild)
• python-cytoolz
• python-lz4
• python-msgspec

I upgraded these packages to new upstream versions:

• aiomysql (fixing CVE-2025-62611)
• audioread
• bitstruct
• black (fixing a build failure)
• blake3-py
• buildbot (fixing a regression)
• cxxopt
• django-cte
• django-pipeline
• django-q
• isort
• khard
• lazy-object-proxy (fixing a build failure)
• psycopg3 (fixing a build failure)
• pydantic
• pydantic-core
• pydantic-extra-types
• pytest-mock
• pytest-rerunfailures
• python-bcrypt
• python-bitarray
• python-confluent-kafka (#1089748)
• python-crispy-bootstrap4
• python-crispy-bootstrap5
• python-django-mptt
• python-ewoksppf (fixing a build failure)
• python-greenlet (fixing a build failure on powerpc and a Python 3.14 build failure)
• python-gssapi
• python-holidays
• python-persistent
• python-pyluach
• python-pytest-asyncio
• python-pytest-run-parallel
• python-pytokens (contributed supporting fix upstream)
• python-semantic-release
• python-stdlib-list
• python-tblib
• python-telethon
• python-treq
• python-typing-inspection
• python-watchfiles
• pyupgrade
• rpds-py (fixing a build failure)
• zope.hookable
• zope.schema
• zope.testrunner (removing run-time dependency on setuptools)

I packaged python-blockbuster and python-pytokens, needed as new dependencies of various other packages.

Santiago Vila filed a batch of bugs about packages that fail to build when using the nocheck build profile, and I fixed several of these (generally just a matter of adjusting build-dependencies):

• pastedeploy (#1116833)
• python-ewokscore (#1116858)
• python-ewoksdask (#1116859)
• python-ewoksorange (#1116862)
• python-odmantic (#1116866)
• python-processview (#1116871)
• python-semantic-release (#1116881)
• sqlfluff (#1116916)

I helped out with the scikit-learn 1.7 transition:

• python-gplearn (contributed upstream)
• scikit-optimize (contributed upstream)
• sklearn-pandas

I fixed or helped to fix several other build/test failures:

• beangulp (contributed upstream)
• beanquery
• buildbot (contributed upstream)
• celery (contributed upstream)
• cython (only on i386; involved a rather slow bisection process first)
• django-measurement
• django-select2
• ocrmypdf (partial investigation, still open)
• poetry-plugin-export
• pytest-aiohttp
• python-aiohttp-session
• python-cups (cross-building)
• python-django-postgres-extra (actually needed a fix in python-django)
• python-fabio
• python-jellyfish (contributed upstream)
• python-maturin (thanks to a patch from Peter Michael Green in #1115459)
• python-requests-oauthlib
• python-telethon
• python-webargs
• silx
• sphinx-inline-tabs

I fixed some other bugs:

• cython: The man page is /usr/bin/env: 'python': No such file or directory
• depthcharge-tools: SyntaxWarnings with Python 3.12 about invalid escape sequences (contributed upstream a while ago)
• django-auditlog: Please drop dependencies on python3-pytzdata
• pysmi: Might trigger: AttributeError: module 'importlib' has no attribute 'machinery' (attempted to contribute upstream, although that repository is dead)
• python-msgspec: Please use pseudo-packages for architecture whitelisting
• python-tomlkit: Binary package rejected

I investigated a python-py build failure, which turned out to have been fixed in Python 3.13.9.

I adopted zope.hookable and zope.location for the Python team.

Following an IRC question, I ported linux-gpib-user to pybuild-plugin-pyproject, and added tests to make sure the resulting binary package layout is correct.

Rust packaging

Another Pydantic upgrade meant I had to upgrade a corresponding stack of Rust packages to new upstream versions:

• rust-idna
• rust-jiter
• rust-pyo3
• rust-regex
• rust-regex-automata
• rust-speedate
• rust-uuid

I also upgraded rust-archery and rust-rpds.

Other bits and pieces

I fixed a few bugs in other packages I maintain:

• halibut: FTCBFS: passes host flags to the build compiler
• iprutils: No package available for other architectures

I investigated a malware report against tini, which I think we can prove to be a false positive (at least under the reasonable assumption that there isn't malware hiding in libgcc or glibc). Yay for reproducible builds!

I noticed and fixed a small UI deficiency in debbugs, making the checkboxes under "Misc options" on package pages easier to hit. This is merged but we haven't yet deployed it.

I notced and fixed a typo in the Being kind to porters section of the Debian Developer's Reference.

Code reviews

• base-passwd: Add clock group (rejected)
• debbugs: Fix dep8 autopkgtests, make Salsa CI fully green (reviewed, awaiting revisions)
• python-gmpy2: FTBFS (sponsored fix for Martin Kelly)

09 Nov 2025 3:33pm GMT

After over a year of work, I'm very excited to announce the general availability of IncusOS, our own immutable OS image designed from the ground up to run Incus!

IncusOS is designed for the modern world, actively relying on both UEFI Secure Boot and TPM 2.0 for boot security and for full disk encryption. It's a very locked down environment, both for security and for general reliability. There is no local or remote shell, everything must be done through the (authenticated) Incus API.

Under the hood, it's built on a minimal Debian 13 base, using the Zabbly builds of both the Linux kernel, ZFS and Incus, providing the latest stable versions of all of those. We rely a lot on the systemd tooling to handle image builds (mkosi), application installation (sysext), system updates (sysupdate) and a variety of other things from network configuration to partitioning.

I recorded a demo video of its installation and basic usage both in a virtual machine and on physical hardware:

Full release announcement: https://discuss.linuxcontainers.org/t/announcing-incusos/25139

07 Nov 2025 9:33am GMT

Welcome to the Ubuntu Weekly Newsletter, Issue 916 for the week of October 26 - November 1, 2025. The full version of this issue is available here.

In this issue we cover:

• Upgrades to 25.10 (Questing Quokka) are now live!
• Ubuntu Stats
• Hot in Support
• Other Meeting Reports
• Upcoming Meetings and Events
• LoCo Events
• Ubuntu Project docs: That's a wrap!
• Introducing architecture variants: amd64v3 now available in Ubuntu 25.10
• [Ubuntu Studio] Upgrading from 25.04 to 25.10
• Other Community News
• What Say You
• Ubuntu Cloud News
• Canonical News
• In the Press
• In the Blogosphere
• In Other News
• Featured Audio and Video
• Updates and Security for Ubuntu 22.04, 24.04, 25.04 and 25.10
• And much more!

The Ubuntu Weekly Newsletter is brought to you by:

• Krytarik Raido
• Bashing-om
• Chris Guiver
• Wild Man
• irihapeti
• And many others

If you have a story idea for the Weekly Newsletter, join the Ubuntu News Team mailing list and submit it. Ideas can also be added to the wiki!

.

03 Nov 2025 11:53pm GMT

The Incus team is pleased to announce the release of Incus 6.18!

This is a reasonably busy release with quite a few smaller releases in every corner of Incus so there should be something for everyone!

The highlights for this release are:

• Systemd credentials support
• File operations on storage volumes
• Exporting of ISO volumes
• BFP token delegation
• MacOS support in the Incus VM agent
• VirtIO sound cards for VMs
• Support for temporarily detaching USB devices
• Configurable DNS mode for OVN networks
• Configurable MAC address patterns for networks and instances
• Extended IncusOS management CLI

The full announcement and changelog can be found here.
And for those who prefer videos, here's the release overview video:

You can take the latest release of Incus up for a spin through our online demo service at: https://linuxcontainers.org/incus/try-it/

And as always, my company is offering commercial support on Incus, ranging from by-the-hour support contracts to one-off services on things like initial migration from LXD, review of your deployment to squeeze the most out of Incus or even feature sponsorship. You'll find all details of that here: https://zabbly.com/incus

Donations towards my work on this and other open source projects is also always appreciated, you can find me on Github Sponsors, Patreon and Ko-fi.

Enjoy!

03 Nov 2025 7:21pm GMT

I'm pleased to share that my career transition has been successful! I've joined our local county assessor's office, beginning a new path in property assessment for taxation and valuation. While the compensation is modest, it offers the stability I was looking for.

My new schedule consists of four 10-hour days with an hour commute each way, which means Monday through Thursday will be largely devoted to work and travel. However, I'll have Fridays available for open source contributions once I've completed my existing website maintenance commitments.

Open Source Priorities

Going forward, my contribution focus will be:

1. Ubuntu Community Council
2. Kubuntu/Debian
3. Snap packages (as time permits)

Regarding the snap packages: my earlier hope of transitioning them to Carl hasn't worked out as planned. He's taken on maintaining KDE Neon single-handedly, and understandably, adding snap maintenance on top of that proved unfeasible. I'll do what I can to help when time allows.

Looking for Contributors

If you're interested in contributing to Kubuntu or helping with snap packages, I'd love to hear from you! Feel free to reach out-community involvement is what makes these projects thrive.

Thanks for your patience and understanding as I navigate this transition.

31 Oct 2025 3:38pm GMT

An issue has been identified

The Ubuntu Release team has now enabled upgrades from 25.04 to 25.10! This is great news! In fact, you may have noticed this icon on your toolbar and a notification to upgrade.

However, upon doing so, you may have noticed something a little more unfortunate:

Yep, we know. This tells you nothing about what is wrong. What is wrong is slightly more technical. As it turns out, the backend application that actually performs the upgrade removed an argument from its command line unannounced during the Plucky Puffin release cycle, approximately a year ago.

As our project leader, Erich Eickmeyer, maintains the upgrade notifier widget for both Ubuntu Studio and Kubuntu, he woke up and immediately got to work identifying what's wrong and how to patch the Plasma widget in question to correctly execute the upgrade process. He has uploaded the fix, and it was accepted by a member of the Ubuntu Stable Release Updates team.

At the moment, the fix needs to be tested and verified. In order to test it, one must install the fix from the plucky-proposed repository. In order for it to be available, it must build for all architectures and, as of this writing, is awaiting building on riscv64 which has a 40-hour backlog.

The Workaround

If you wish to begin the upgrade process manually rather than waiting on the upgrade notifier fix to be implemented, feel free to make sure you are fully updated, type alt-space to execute Krunner, and paste this:

do-release-upgrade -f DistUpgradeViewKDE

This is the exact command that will be executed by the notifier widget as soon as it is updated.

Of course, if you're in no hurry, feel free to wait until the notifier is updated and use that method. Do bear in mind, though, that as of this writing, you have exactly 90 days to perform the upgrade to 25.10 before your system will no longer be supported. At that time, you'll risk being unable to upgrade at all unless certain procedures for End-Of-Life Upgrades are done, which can be tedious for those uncomfortable in a command line as it will require modifying system files.

Mea Culpa

We do apologize for the inconvenience. Testing upgrade paths like this are hard to do and things go missed, especially when teams don't communicate with each other. We're try to identify things before they happen but, unfortunately, certain items cannot be foreseen.

This issue has now been added to the Ubuntu Studio 25.10 Release Notes.

29 Oct 2025 8:08pm GMT

Launchpad Builders do not have direct access to the Internet. To reach external resources, they must acquire an authentication token that allows access to a restricted set of URLs via a proxy. This can either be a custom authenticated builder proxy or the fetch service.

The fetch service is a custom sophisticated context-aware forward proxy. Whereas the builder proxy allows requests to allowlisted URLs, the fetch service also keeps track of requests and dependencies for a build.

Users can now opt-in to use the fetch service while building snaps, charms, rocks and sourcecraft packages. You can read more about the fetch service here.

Why is the fetch service important?

To achieve traceability and reproducibility, artifact dependencies retrieved during a build must be identified. The fetch service mediates network access between the build host and the outside world, examining the request protocol, creating a manifest of the downloaded artifacts, and keeping a copy of the artifacts for archival and metadata extraction for each package build.

How to use the fetch service?

To be able to use the fetch service, users must opt-in. For snaps, charms, rocks and sourcecraft packages, the use_fetch_service flag should be set to true in the API. For snaps and charms, this setting is also available in the Edit Recipe UI page.

The fetch service can be run in two modes, "strict" and "permissive", where it defaults to the former. Both modes only allow certain resources and formats, as defined by inspectors which are responsible for inspecting the requests and the various downloads that are made during the build, ensuring that the requests are permitted.

The "strict" mode errors out if any restrictions are violated. The "permissive" mode works similarly, but only logs a warning when encountering any violations. The mode can be configured using the fetch_service_policy option via the API. For snaps and charms, the mode can also be selected from a dropdown on the Edit Recipe UI page.

When to use the fetch service?

Use the fetch service when you need to keep track of requests and dependencies for a build, e.g., when you need to verify that the artifacts belong to secure, trusted sources.

28 Oct 2025 11:31am GMT

Welcome to the Ubuntu Weekly Newsletter, Issue 915 for the week of October 19 - 25, 2025. The full version of this issue is available here.

In this issue we cover:

• Enabling updates on Ubuntu 25.10 systems
• [Updated] Questing Quokka Release Notes
• Resolute Raccoon is now open for development
• Ubuntu Stats
• Hot in Support
• Rocks Public Journal; 2025-21-10
• Other Meeting Reports
• Upcoming Meetings and Events
• Vote result: LoCo rebranding and rescoping resolution
• Discover your fully open source robotics observability at ROSCon 2025
• Ubuntu 25.10 Release Party @ Taipei
• LoCo Events
• TPM-backed FDE: Take 2 minutes to help widen Ubuntu compatibility with your TPM configuration!
• Canonical's new design system : towards a design system ontology
• Other Community News
• Canonical News
• In the Press
• In the Blogosphere
• Other Articles of Interest
• Featured Audio and Video
• Updates and Security for Ubuntu 22.04, 24.04, 25.04 and 25.10
• And much more!

The Ubuntu Weekly Newsletter is brought to you by:

• Krytarik Raido
• Bashing-om
• Chris Guiver
• Wild Man
• Cristovao Cordeiro (cjdc) - Rocks
• irihapeti
• And many others

If you have a story idea for the Weekly Newsletter, join the Ubuntu News Team mailing list and submit it. Ideas can also be added to the wiki!

.

27 Oct 2025 9:51pm GMT

I've written down a new rule (no name, sorry) that I'll be repeating to myself and those around me. "If you can replace 'DNS' with 'key value store mapping a name to an ip' and it still makes sense, it was not, in fact, DNS." Feel free to repeat it along with me.

Sure, the "It's always DNS" meme is funny the first few hundred times you see it - but what's less funny is when critical thinking ends because a DNS query is involved. DNS failures are often the first observable problem because it's one of the first things that needs to be done. DNS is fairly complicated, implementation-dependent, and at times - frustrating to debug - but it is not the operational hazard it's made out to be. It's at best a shallow take, and at worst actively holding teams back from understanding their true operational risks.

IP connectivity failures between a host and the rest of the network is not a reason to blame DNS. This would happen no matter how you distribute the updated name to IP mappings. Wiping out all the records during the course of operations due to an automation bug is not a reason to blame DNS. This, too, would happen no matter how you distribute the name to IP mappings. Something made the choice to delete all the mappings, and it did what you asked it to do

There's plenty of annoying DNS specific sharp edges to blame when things do go wrong (like 8.8.8.8 and 1.1.1.1 disagreeing about resolving a domain because of DNSSEC, or since we're on the topic, a DNSSEC rollout bricking prod for hours) for us to be cracking jokes anytime a program makes a DNS request.

We can do better.

27 Oct 2025 5:15pm GMT

Launchpad now supports the FIDO2 hardware-backed SSH key types ed25519-sk and ecdsa-sk. These keys use a hardware device, such as a YubiKey or Nitrokey, to perform cryptographic operations and keep your private keys safely off your computer. They can be used anywhere Launchpad accepts SSH authentication, including git+ssh and SFTP PPA uploads.

To generate a new key, run

ssh-keygen -t ed25519-sk -C "your@email.com"

or use ecdsa-sk for backwards compatibility. You will be asked to touch your security key during the key creation, and OpenSSH will store the resulting files in ~/.ssh/. If you want to make your key resident, meaning it can be stored on the hardware device and later retrieved even if the original files are lost, use the -O resident option:

ssh-keygen -t ed25519-sk -O resident -C "your@email.com"

Resident keys are useful if you use multiple machines or if you want a portable login method tied directly to your hardware key. To register a new key on your Launchpad account, visit https://launchpad.net/~username/+editsshkeys.

These new key types offer strong protection against key theft and phishing, but require a physical device each time you connect. It is recommended you keep a separate backup key if you use them regularly.

The introduction of security key backed SSH key types is the next step on making Launchpad even more secure. Let us know if you have any feedback!

27 Oct 2025 3:29pm GMT

Problem statement

Currently if you have an automatically installed package A (= 1) where

• A (= 1) Depends B (= 1)
• A (= 2) Depends B (= 2)

and you upgrade B from 1 to 2; then you can:

1. Remove A (= 1)
2. Upgrade A to version 2

If A was installed by a chain initiated by Recommends (say X Rec Y, Y Depends A), the solver sometimes preferred removing A (and anything depending on it until it got).

I have a fix pending to introduce eager Recommends which fixes the practical case, but this is still not sound.

In fact we can show that the solver produces the wrong result for small minimal test cases, as well as the right result for some others without the fix (hooray?).

Ensuring sound removals is more complex, and first of all it begs the question: When is a removal sound? This, of course, is on us to define.

An easy case can be found in the Debian policy, 7.6.2 "Replacing whole packages, forcing their removal":

If B (= 2) declares a Conflicts: A (= 1) and Replaces: A (= 1), then the removal is valid. However this is incomplete as well, consider it declares Conflicts: A (< 1) and Replaces: A (< 1); the solution to remove A rather than upgrade it would still be wrong.

This indicates that we should only allow removing A if the conflicts could not be solved by upgrading it.

The other case to explore is package removals. If B is removed, A should be removed as well; however it there is another package X that Provides: B (= 1) and it is marked for install, A should not be removed. That said, the solver is not allowed to install X to satisfy the depends B (= 1) - only to satisfy other dependencies [we do not want to get into endless loops where we switch between alternatives to keep reverse dependencies installed].

Proposed solution

To solve this, I propose the following definition:

Definition (sound removal): A removal of package P is sound if either:

1. A version v is installed that package-conflicts with B.
2. A package Q is removed and the installable versions of P package-depends on Q.

where the other definitions are:

Definition (installable version): A version v is installable if either it is installed, or it is newer than an installed version of the same package (you may wish to change this to accomodate downgrades, or require strict pinning, but here be dragons).

Definition (package-depends): A version v package-depends on a package B if either:

1. there exists a dependency in v that can be solved by any version of B, or
2. there exists a package C where v package-depends C and any (c in C) package-depends B (transitivity)

Definition (package-conflicts): A version v package-conflicts with an installed package B if either:

1. it declares a conflicts against an installable version of B; or
2. there exists a package C where v package-conflicts C, and b package-depends C for installable versions b.

Translating this into a (modified) SAT solver

One approach may be to implement the logic in the conflict analysis that drives backtracking, i.e. we assume a package A and when we reach not A, we analyse if the implication graph for not A constitutes a sound removal, and then replace the assumption A with the assumption A or "learned reason.

However, while this seems a plausible mechanism for a DPLL solver, for a modern CDCL solver, it's not immediately evident how to analyse whether not A is sound if the reason for it is a learned clause, rather than a problem clause.

Instead we propose a static encoding of the rules into a slightly modified SAT solver:

Given c1, …, cn that transitive-conflicts A and D1, …, Dn that A package-depends on, introduce the rule:

A unless c1 or c2 or ... cn ... or not D1 or not D2 ... or not Dn

Rules of the form A... unless B... - where A... and B... are CNF - are intuitively the same as A... or B..., however the semantic here is different: We are not allowed to select B... to satisfy this clause.

This requires a SAT solver that tracks a reason for each literal being assigned, such as solver3, rather than a SAT solver like MiniSAT that only tracks reasons across propagation (solver3 may track A depends B or C as the reason for B without evaluating C, whereas MiniSAT would only track it as the reason given not C).

Is it actually sound?

The proposed definition of a sound removal may still proof unsound as I either missed something in the conclusion of the proposed definition that violates my goal I set out to achieve, or I missed some of the goals.

I challenge you to find cases that cause removals that look wrong :D

18 Oct 2025 7:37pm GMT