Inside this week's LWN.net Weekly Edition:
- Front: MeshCore; x32 ABI; Open-source security; Package-manager metadata; More LSFMM+BPF coverage; Loadable crypto module.
- Briefs: Lightwell; jqwik protestware; RedHat package compromise; DistroWatch; Fedora election; Rust 1.96.0; rsync; Vim Classic 8.3; Quotes; ...
- Announcements: Newsletters, conferences, security updates, patches, and more.
Version:next-20260603 (linux-next)
Released:2026-06-03
TrueNAS CORE (previously known as FreeNAS) is a free and Open Source Network-Attached Storage (NAS) operating system that supports file, block and object storage. TrueNAS CORE is FreeBSD based and is a community-supported branch of the TrueNAS project, sponsored by iXsystems. It also has a commercial branch called TrueNAS Enterprise and a free and HyperConverged storage solution called TrueNAS SCALE. The TrueNAS SCALE branch is based on the Debian Linux distribution.
Over time, many open-source maintainers face the same problem: they
lack the time to do all of the work that their project needs, and no
one else is stepping up to provide adequate help. Maintainers, though,
are often reluctant to throw in the towel. The result is suboptimal
all around; the maintainer is stressed out, project quality suffers,
and users face security risks that they may not be fully aware of. At
the 2026 Open
Source Summit North America, Robin Bender Ginn spoke about this
problem, when it might be time for maintainers to pass the torch, and
the responsibilities of users.
Alexei Starovoitov gave "less of a presentation, more of a scream of
realization" at the BPF track of the 2026
Linux Storage, Filesystem,
Memory-Management, and BPF Summit. He shared a set of ideas for how BPF could
change to avoid being swept away by the sea-change in programming represented by modern
large language models (LLMs) and the coding agents based on them.
In a follow-up session, the discussion covered
more problems with how coding agents use tools like bpftrace, and the current deluge of
patches in need of review in the BPF subsystem.
Andrew Tridgell has written a blog
post responding to complaints that he has begun using LLM tools in
his work maintaining rsync:
Like many developers of open source packages I've been hit by a
flood of security reports lately in my role as the rsync
maintainer. Many of those reports are AI generated (not all though,
there are some notable ones with very careful and high quality manual
analysis).
As this flood started to get more intense I realised I needed to
raise the defences on rsync a lot — we needed much more thorough test
suites, code coverage analysis, CI testing on a lot more platforms,
deliberate and thorough scanning for possible security issues (so I
find at least some of them before other people!) and the addition of a
whole lot of defence-in-depth hardening techniques.
[...] Now to the future, because we're not done yet by a long
shot. The security reports keep rolling in. I'm working on a bunch of
CVEs right now. Luckily I've been joined by some other very good
developers with great systems development skills and security
knowledge. Some of these people came to my attention partly because of
all the rage happening at the moment, so I get some rage storm clouds
have silver linings. Watch out for some credits for some great new
rsync developers in the next release.
Security updates have been issued by Debian (php-twig), Fedora (hplip, python-wsgidav, roundcubemail, and xorg-x11-server), Oracle (compat-openssl10, httpd:2.4, and kernel), Red Hat (osbuild-composer), SUSE (busybox, cloudflared, cockpit, cups, ffmpeg-4, gnutls, google-osconfig-agent, helm, hplip, kernel, kubelogin, libjxl, libsoup, libunbound8, LibVNCServer-devel, mapserver, nvidia-open-driver-G06-signed, nvidia-open-driver-G07-signed, openssh, python-idna, qemu, rqlite, shadowsocks-v2ray-plugin, ucode-intel, unbound, vim, vorbis-tools, and xorg-x11-server), and Ubuntu (age, dovecot, editorconfig-core, gobgp, libapache-mod-jk, libcommons-lang-java, libcommons-lang3-java, libeconf, linux, linux-aws, linux-aws-6.8, linux-aws-fips, linux-azure, linux-fips,
linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gke, linux-gkeop,
linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8,
linux-nvidia-lowlatency, linux-nvidia-tegra, linux-oracle,
linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-realtime,
linux-realtime-6.8, linux, linux-aws, linux-azure, linux-azure-6.17, linux-hwe-6.17,
linux-nvidia-6.17, linux-oem-6.17, linux-oracle, linux-oracle-6.17,
linux-raspi, linux-realtime, linux-realtime-6.17, linux, linux-aws, linux-gcp, linux-ibm, linux-nvidia, linux-oracle,
linux-raspi, linux-realtime, linux-aws-6.17, linux-gcp, linux-gcp-6.17, luanti, mysql-8.0, mysql-8.4, node-tar-fs, and unbound).
T2 Linux SDE is an independently-developed open-source system development environment (or distribution build kit). It enables the creation of custom distributions with bleeding-edge technology. Currently, the Linux kernel is used, but the project plans an expansion to Hurd, OpenDarwin and OpenBSD kernels too. T2 started as a community driven fork from the ROCK Linux Project with the aim to create a decentralised development and a clean framework for spin-off projects and customised distributions.
Nemesis Linux is a set of lightweight, minimalist live Linux distributions inspired by the Slackware-based Porteus project, but based on Artix Linux instead. It uses the Pacman package manager and the OpenRC init system. Nemesis Linux offers four desktop variants featuring the Cinnamon, LXDE, LXQt and Xfce desktop environments.
Aeon is an immutable desktop Linux distribution based on openSUSE. It is a relatively small, low-maintenance system with automated daily updates, thus recommended for Linux beginners or "lazy developers". Some of the distribution's other features include a custom system installer called Transactional Installation Kit (TIK), a pre-configured GNOME desktop, out-of-the-box support for Flatpak packages, Distrobox configured to launch Tumbleweed containers, and automatic rollbacks to its last working state.
HackerOS is a live Linux distribution based on Debian's "Testing" branch and designed for regular users, gamers and cybersecurity enthusiasts. Some of its features include an optimised XanMod Linux kernel for faster boot times and reduced resource usage, out-of-the-box support for NVIDIA graphics cards, and a collection of cybersecurity tools, such as enhanced firewalls and intrusion detection software. The distribution uses the KDE Plasma desktop.
RakuOS is an immutable Linux distribution based on Fedora, with a choice of KDE Plasma, GNOME and COSMIC desktops. It combines an immutable, read-only base system with the full package flexibility of a traditional Linux distribution. While the core system updates atomically and can be instantly rolled back, the system's persistent overlay lets the user install any package, either through the dnf package manager or the distribution's own software center called RakuOS Software. Installation of Flatpak packages is also supported. RakuOS uses the performance-optimised CachyOS Linux kernel and also includes a graphical CPU scheduling utility to fine-tune the system for gaming, workloads or power efficiency use cases.
Exton Linux is a set of over 15 Linux distributions based on Arch Linux, CRUX, Debian, deepin, Fedora, openSUSE, Puppy Linux and Slackware Linux. They are designed to be lightweight, fast and easy to use. Exton Linux comes with popular pre-configured desktop environments and a set of pre-installed software packages, including web browsers, office suites, multimedia players and development tools. It also includes various customization options, such as the ability to change the appearance of the desktop and install additional software packages. Exton Linux is available in several editions, each tailored to a specific use case, such as general-purpose computing, gaming, multimedia or servers.
Extended
attributes (xattrs) provide a way to attach key/value metadata to
inodes—files, directories, and the like—in a filesystem. As with many
Linux filesystems, the
FUSE filesystem
supports xattrs. In a filesystem-track session at the 2026
Linux Storage,
Filesystem, Memory Management, and BPF Summit, FUSE maintainer Miklos
Szeredi led a discussion about caching xattrs in kernel memory; he would
like to create some common infrastructure that could be used by FUSE and
shared with other filesystems.
blendOS is an Arch Linux-based, rolling-release distribution which automates installing software from supported distributions (Arch Linux, Fedora and Ubuntu) into containers. blendOS tries to make software management in across containers feel native and provides access to the user's home directory for each container.
Version:next-20260602 (linux-next)
Released:2026-06-02
Synex is a GNU/Linux distribution based on Debian's "Stable" branch, developed with the official Debian Live Build tool. It offers four separate desktop options with GNOME, LXDE, KDE Plasma and Xfce, all of which are composed of a rather frugal set of applications in its default state, without any development tools or offices suites. Some of the distribution's main features include Calamares installer with support for both BIOS and UEFI, CUPS integration for printing and network support, out-of-the box support for Flatpak applications, official NVIDIA driver installation assistant with support for both X11 and Wayland, and additional repositories containing Microsoft Edge, OnlyOffice and Zabbix.
Package managers for operating systems and programming languages have been
around for decades. Each package manager, and its accompanying packaging format,
has been shaped by the needs of its respective ecosystem, but there is a growing
need to make use of package metadata for more than software management: for
example, in vulnerability scans, software bills of materials (SBOMs), and more. On
May 19, Damián Vicino spoke at the Open Source Summit North America 2026
about his experiences in the past year trying to make sense of the varied
metadata provided by more than 20 package managers.
Version
8.3 of Vim Classic has been
released. This is the first release of the Vim fork since the project
was announced
in March.
This release is based on Vim 8.2.0148, with a number of bug fixes
and patches conservatively backported from future versions of Vim
upstream. We elected to clean up this version of Vim, prepare it for a
release, and imagine an alternate history where Vim 8.3 was released
without Vim9 script. The result is Vim Classic 8.3. We chose to take
this approach in order to reduce the long-term maintenance burden of
Vim Classic, acknowledging that our fork lacks the resources and
institutional knowledge available to Vim upstream. However, a
consequence is that there are some Vim plugins which are not
compatible with Vim Classic.
We have made a special effort to assess patches from Vim upstream
which mitigate some of the many CVEs affecting Vim which were
discovered and fixed between versions 8.2 and modern-day Vim, but we
can't be sure we've got all of the security patches which are
applicable to Vim Classic (and practically exploitable). This version
of Vim Classic is therefore recommended for early adopters who are
comfortable adopting a security posture which accounts for the fact
that we may have overlooked some bugs.
LWN covered Vim
Classic and another Vim fork, EVi, in April.
Security updates have been issued by AlmaLinux (php:8.2 and php:8.3), Debian (gst-plugins-good1.0, symfony, and yelp), Fedora (dovecot, freeipa, hplip, libpng, perl-Catalyst-Plugin-Authentication, postfix, samba, unbound, and vim), Mageia (assimp, libcaca, sdl2_sound, and tar), Slackware (kernel), SUSE (alloy, apache-commons-lang3, apache-commons-text,, apache2, bubblewrap, busybox, chromium, cups, docker-stable, ffmpeg-8, google-osconfig-agent, gsasl, ignition, java-26-openjdk, kernel, libsolv-demo, libsoup, libzypp, localsearch, openjpeg2, postgresql-jdbc, putty, python-mistune, python-Pillow, python-python-multipart, python-Twisted, python3-Twisted, re, roundcubemail, vim, wireshark, and xz), and Ubuntu (evolution-data-server, exim4, gsasl, haveged, lcms2, libreoffice, linux-aws, linux-lts-xenial, linux-lowlatency, linux-nvidia-tegra, nginx, nncp, qtdeclarative-opensource-src, sslh, sssd, and xz-utils).
Pages
