Various small bug fixes, nothing major.

I'd suggest certbot by Lets Encrypt: https://certbot.eff.org/

It'll do everything for you besides check your email and plug the certs into your program.

A new community of KDE wants the project to adopt a strict no-AI policy for KDE Plasma.

It’s the FreeBSD challenge! We all get it running on a laptop and it’s great. Honest.

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

Thanks, Martin.

Well, as an old "EMC-Chap", I have seen several examples and been able to "identify" them in some way.

Our village has 500 souls. All of them have a terrestrial birth certificate and most probably no
relatives up there, hi.

I will carry on to run my OWRX and observe possible further phenomena.

Such developments may change the orbital spectrum in the future: 

https://www.heise.de/en/news/Data-centers-in-space-Google-to-launch-satellite-with-four-AI-accelerators-11465062.html

Regards
Wolfgang

By Philipp Reisner, CEO LINBIT®

Sovereignty is a word borrowed from statecraft. A sovereign country is independent in its decisions. The term “digital sovereignty” is a more recent invention that applies to organizations and even individuals.

In this article, I discuss what the push for digital sovereignty implies for Linux-focused, open source developers and companies. The framework I use is a European one, because I am Vienna-based and familiar with it. As I discuss later, the implications are not limited to Europe.

A framework for defining and rating digital sovereignty

The European Commission published the EU Cloud Sovereignty Framework (CSF), which breaks sovereignty down into eight objectives:

• SOV-1, Strategic: Ownership and governance are controlled, avoiding external dependencies.
• SOV-2, Legal and Jurisdictional: Protects against external laws and unauthorized access.
• SOV-3, Data and AI: Control and privacy compliance for data and AI models in the cloud.
• SOV-4, Operational: Day-to-day cloud administration, management, and support are handled securely from within.
• SOV-5, Supply Chain: Protects against vendor lock-in and external bottlenecks.
• SOV-6, Technology Openness: Encourages open standards and the freedom to choose technologies.
• SOV-7, Security and Compliance: Aligns cloud services with European cybersecurity standards, frameworks, and compliance audit rules.
• SOV-8, Environmental Sustainability: Adoption of energy-efficient infrastructure, environmentally responsible practices, and activity reporting intended to reduce environmental impacts of technological activity.

Rating technology providers for digital sovereignty compliance

The framework rates providers on two scales: a Sovereignty Effectiveness Assurance Level (SEAL), and a complementary Sovereignty Score for cloud services. The first indicates a minimum level of sovereignty objectives met. The second shows a provider’s strengths and weaknesses across the objectives.

Each objective is rated from SEAL-0 to SEAL-4. SEAL-4 means an EU supply chain, from the physical chips up to the software.

The mechanic I find most interesting is that a provider does not get one SEAL level. It receives eight, and the overall level is the lowest of them. Your weakest objective decides your rating, not your average. Anyone who has ever tuned a storage stack will recognize that logic.

Meeting the technology-openness objective

Open source software can put providers in a strong position to address the technology-openness objective, SOV-6, because customers can inspect the code, operate it independently, and avoid dependencies on proprietary implementation. Because the source is open, that argument does not stop at the EU border. A service provider in the US or in Asia aiming for full SEAL-4 is not held back by choosing open source software.

Open standards need open implementations

SOV-6 specifies two things: open standards and the freedom to choose technologies. In software, an open standard might define an interface that anyone can implement, but if only one vendor has implemented it, a buyer still has a single supplier for it. Depending on a single supplier also weakens a provider on SOV-5, the supply-chain objective, which protects against vendor lock-in. Freedom to choose means being able to substitute one implementation for another.

An example is the Container Storage Interface (CSI), a vendor-neutral storage standard developed under the Cloud Native Computing Foundation (CNCF) and used by Kubernetes. CSI is the standard, LINBIT provides a CSI driver for LINSTOR® and its upstream CNCF project, Piraeus Datastore, and a buyer running Kubernetes can use this driver. Because of the open standard nature of the interface, the buyer can also move between storage back ends. This is freedom for the buyer, motivation for providers to make a better solution, and neutrality from a foundation like the CNCF.

Implications of digital sovereignty for cloud and technology services providers

Digital sovereignty is no longer an exercise on paper. In April 2026, the European Commission awarded a sovereign cloud contract worth up to €180 million over six years to four European providers, with SEAL-2 as the minimum bar for eligibility. Sovereignty has become a procurement instrument with money attached. Predictably, one of the awards is already being publicly contested as “sovereignty-washing”.

What poured oil on the fire was an incident involving the chief prosecutor of the International Criminal Court. After the US sanctioned court officials, the chief prosecutor reportedly lost access to his Microsoft-hosted email account, and bank accounts in the United Kingdom were frozen. Since these actions, some EU banks with US exposure are preferring to over-comply rather than take any risk. Microsoft disputes the framing and maintains it never suspended services to the ICC as an organization. For me, the detail of who pressed which button matters far less than the lesson: neither the email nor the banking depended on a European decision.

In the US, similar discussions have taken place, only with different verbiage. There it is “economic security” and “supply chain resilience”, mostly aimed at China, and where Europe says “technological sovereignty”, Washington says “technological leadership”. Different branding, same substance.

Conclusion

As digital sovereignty gains weight in technology sourcing decisions, smaller vendors benefit.

A framework that asks, “Who owns you? Whose laws apply? Can I operate this without you, and can I read the source?” rewards exactly the properties a small open source company has by default. The hyperscalers will feel some headwind, though they are not standing still, and “sovereign” regions run by local operating entities are their answer. Whether that clears a SEAL-3 or SEAL-4 bar is the argument of the next few years.

LINBIT already made an investment in developing in the open. An open license is necessary but not enough on its own, because a project can be open and still be controlled by a single company that can relicense it. What makes the openness durable is governance that the original vendor cannot reverse. DRBD® ships in the mainline Linux kernel, and we are working to upstream the current DRBD 9 code. Code in the commons, for example, in the mainline kernel, under a foundation such as the CNCF, or in another home that no single vendor controls, is the strongest answer to SOV-6 I know of. Every project that puts it there widens the set of technology a sovereign buyer can choose from.

The post The Impact of Digital Sovereignty on Open Source Companies appeared first on Linux.com.

Microsoft really wants you to update your Exchange server, our thoughts on immutable distros, more on Jim’s approach to internet access for his kids, restricting access to servers on a corporate network, and cloning and backing up operating systems with ZFS.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

OpenZFS User and Developer Summit 2026: October 27-30

News

Microsoft to bounce mail from outdated Exchange servers

See our contact page for ways to get in touch.

Lunedì 19 ottobre, dalle 21:00, tornano le serate a tema del LuccaLUG, presso il Foro Boario di Lucca.

Docker and the CNCF will partner on an open spec to make agent permissions portable 

Docker Sandbox Kits let you package an AI agent together with exactly what it is allowed to do, so anyone can pull the same agent with the same limits, review changes to those limits, and enforce them. Now, Docker has published the Docker Sandbox Kit Spec, the open specification behind Kits, under Apache 2.0 and is committing to contributing the spec to the Cloud Native Computing Foundation for neutral governance.

A Kit is an ordinary OCI container image that carries three things: the agent, the tools it uses, and a typed list of everything it asks to reach, such as network hosts, credentials, and volumes. That list lives inside the image, so pinning the image pins the agent and its requests together. A Kit builds, pushes, pulls, signs, and scans like any container image, because it is one.

“Standards are what let an ecosystem move fast without fragmenting, and few companies understand that better than Docker. By delivering Sandbox Kits as standard OCI images, Docker is giving the industry an open, repeatable way to package an AI agent, its tools, and its guardrails as one artifact. OCI is the foundation the cloud native ecosystem is built on, so a standard for agents that builds on OCI reaches the whole ecosystem at once. The CNCF welcomes this, and we’re excited to work with Docker and the community on making it broadly adopted.”

Chris Aniszczyk, CTO of the CNCF

Why the OCI image is not enough on its own

An OCI image tells a runtime how to build and start a piece of software. It has no place to state which hosts that software may call, which credentials it may use, or which files it may keep between runs. Those decisions are made outside the image, at launch: in docker run flags, a Compose file, a CI job, an onboarding doc. For a web service, that was fine. The program was fixed, it needed a network and a port, and the flags rarely changed.

Agents are different. Claude Code and Codex decide at runtime what to do: install packages, call APIs, use credentials, change the environment they run in. So the access they need is granted piece by piece, by hand, usually to get a task unblocked. A few months in, nobody can answer a simple question: what is this agent allowed to do? The answer is spread across shell history, dashboards, and someone’s memory, and it cannot be handed to a teammate or compared with last week.

Every team answers that question on its own today, and every runtime vendor could ship its own format for the answer. That is the fragmentation OCI was created to prevent, and it is why Docker is now proposing one artifact, built on OCI, governed in the open by the CNCF community.

How a Sandbox Kit Spec fills the gap

The Sandbox Kit Spec does not fork or replace any OCI specification. It uses the annotation extension point OCI already defines to carry the agent’s requests in the image manifest. Nothing in a registry, scanner, or signing tool needs to change.

Kits began as a feature of Docker Sandboxes, Docker’s product for running agents inside isolated microVMs, where a Kit defined one sandbox: the agent, its tools, and what it could reach. The Sandbox Kit Spec turns that definition into a standard OCI image and opens the format so any runtime can implement it. Docker Sandboxes is the first runtime that enforces it. It should not be the only one, and under Linux Foundation governance it will not be.

Two things follow for anyone running agents. The answer travels with the agent: a teammate can pull it, a reviewer can diff it, and a conforming runtime can enforce it. And when a new version asks for more, the change shows up as added lines someone can refuse.

Kits from across the ecosystem

Kits for tools from AWS, Box, Datadog, Dynatrace, JFrog, NanoClaw, OpenClaw, Palo Alto Networks, and Snyk are available now, covering cloud, observability, security, artifact management platforms and more.

That is what a shared format makes possible. A database vendor can publish a Kit that connects any agent to its service with the scope it recommends. An agent maker can publish its own Kit, so the request list comes from the people who built the agent. A platform team can publish one for the company, and every engineer starts from the same place.

Containers made software portable. Kits make authority portable: the set of things you deliberately hand an agent travels with the agent, in the same image, and means the same thing wherever a conforming runtime opens it. Docker looks forward to formally submitting Kits to the CNCF and working with the community to ensure Kits further the goal of secure, reliable agentic AI and AI governance.

Build a Kit

If you make a tool that agents use, publish a Kit for it. If you run agents, start from one and share it with your team. The Docker Sandbox Kit Spec, its capability pages, and a worked tour of a real Kit are available at docker/sandbox-kit-spec. If there is a Kit you cannot express, or a rule a runtime cannot implement, open an issue.

The post Docker Commits to Bringing the Sandbox Kit Spec to the CNCF appeared first on Linux.com.

This is to announce parted-3.8, a stable release. This is the same as the
3.7.14 alpha release except that gnulib has been updated.

The full set of changes since parted 3.7:

Brian C. Lane (21):
      maint: post-release administrivia
      README-release: Fix typos in doxygen instructions
      Cleanup zero as null pointer constant warnings
      libparted: Catch FAT metadata triggered errors
      resize: Make sure 32bit build cannot overflow frag_count
      resize: Make sure hfsc_new_cachetable cannot overflow on 32bit
      fdasd: Make sure data set name is positive
      parted: Fix partition number allocation in do_print
      maint: Update to latest gnulib and bootstrap script
      maint: Update copyright statements to 2026
      NEWS: Update news for next release
      version 3.7.13
      maint: post-release administrivia
      hurd: Fix gnu_read problems with block size > 512b
      NEWS: Update news for next release
      maint: Update to latest gnulib
      version 3.7.14
      maint: post-release administrivia
      maint: Update to latest gnulib
      NEWS: Releasing stable version 3.8
      version 3.8

Colin Watson (1):
      maint: Distribute Doxyfile

Victor Couty (1):
      Adding support for ExFAT filesystem

bug-parted@gnu.org (1):
      bug #80795: [PATCH] build: mark functions with const attribute, per gcc warnings

Brian
 [on behalf of the parted maintainers]
==================================================================

Here is the GNU parted home page:
    https://gnu ... g/s/parted/

Here are the compressed sources and a GPG detached signature:
  https://ftp.gnu.o ... parted-3.8.tar.xz
  https://ftp.gnu.o ... ed-3.8.tar.xz.sig

Use a mirror for higher download bandwidth:
  https://www.gnu.o ... rg/order/ftp.html

Here are the SHA256 and SHA3-256 checksums:

  File: parted-3.8.tar.xz
  SHA256 sum:   a2b7811f47b0ddb1f7b1d0aa456f7c1270da70708ce231c2fe054c7199eafa63
  SHA3-256 sum: dd794daa59755a9201d7cc493bcdf35903e231d48f93f7bdc79a780fcd8bf594

Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.

Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.

Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  gpg --verify parted-3.8.tar.xz.sig parted-3.8.tar.xz

The signature should match the fingerprint of the following key:

  pub   ed25519/FF9868A2D488A5A9 2026-04-14 [SC]
        Key fingerprint = 872F 3A8A 0B84 905A FFBC  8766 FF98 68A2 D488 A5A9
  uid                 [ultimate] Brian C. Lane <bcl@redhat.com>

If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.

  gpg --locate-external-key bcl@redhat.com

  gpg --recv-keys FF9868A2D488A5A9

  wget -q -O- 'https://savannah. ... ed&download=1' | gpg --import -

As a last resort to find the key, you can try the official GNU
keyring:

  wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
  gpg --keyring gnu-keyring.gpg --verify parted-3.8.tar.xz.sig parted-3.8.tar.xz

This release is based on the parted git repository, available as

  git clone https://https.git ... rg/git/parted.git

with commit 5f600791b40a48c51aeb6db0432e67a29e8e7951 tagged as v3.8.

For a summary of changes and contributors, see:

  https://gitweb.gi ... a=shortlog;h=v3.8

or run this command from a git-cloned parted directory:

  git shortlog v3.7.14..v3.8

This release was bootstrapped with the following tools:
  Autoconf 2.72
  Automake 1.18.1
  Gettext 0.25.1
  Gnulib 2026-09-23 0b416a8a26dbdaea4f413d4fb0c41ef8ea846e4d
  Gperf 3.2.1

NEWS

• Noteworthy changes in release 3.8 (2026-09-23) [stable]

  Promoting alpha release to stable release 3.8

KDE Connect reveals the goals for the Linux desktop darling, with one of those goals long overdue.

Automake 1.19 released. Announcement:

https://lists.gnu ... -09/msg00001.html

The Steam Frame is finally here and it’s not quite as expensive as we feared. Graham was selected in the lottery but will he actually buy one? We finally talk about Omarchy, its huge fundraising effort, and why we are disappointed in companies who are contributing. Plus LibreOffice’s enviable download numbers. With guest hosts Andy from Linux Dev Time, and Shane from Hybrid Cloud Show.

News

Steam Frame

Not just Proton: Getting to know Valve’s new SteamOS compatibility layers

Power grab

DigitalOcean has $3 million for DHH and nothing for CSS-Tricks

CSS-Tricks could be a co-op

One week of LibreOffice 26.8 – The stats!

Yes, no AI is now a feature

Development/AI policy – The Document Foundation Wiki

Support us on patreon and get an ad-free RSS feed with some early episodes

Our fantasy programming language features.

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Our fantasy programming language features.

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

This is to announce gzip-1.15, a stable release.
Special thanks to Paul Eggert for his indefatigable support.

There have been 119 commits by 5 people in the 75 weeks since 1.14.

See the NEWS below for a brief summary.

Thanks to everyone who has contributed!
The following people contributed changes to this release:

  Bruno Haible (2)
  Collin Funk (2)
  Jim Meyering (24)
  Mark Adler (3)
  Paul Eggert (88)

Jim
 [on behalf of the gzip maintainers]
==================================================================

Here is the GNU gzip home page:
    https://gnu.org/s/gzip/

Here are the compressed sources:
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.gz   (1.2MB)
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.xz   (792KB)
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.zip   (1.5MB)

Here are the GPG detached signatures:
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.gz.sig
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.tar.xz.sig
  https://ftp.gnu.org/gnu/gzip/gzip-1.15.zip.sig

Use a mirror for higher download bandwidth:
  https://www.gnu.org/order/ftp.html

Here are the SHA256 and SHA3-256 checksums:

  SHA256 (gzip-1.15.tar.gz) = VFiGz1f6iKZeln+/cFkD1/yyVnyCxzQkk+gujXsaIQs=
  SHA3-256 (gzip-1.15.tar.gz) = Pi3C560xPn/r7b8OPXzDZolBiOfpW/Bo9G+wUAdbgCw=
  SHA256 (gzip-1.15.tar.xz) = mqDMeA3sFWuCgoRIM7NCq3ywjCXSzZoYac3Q3zHe/0g=
  SHA3-256 (gzip-1.15.tar.xz) = gwwVDPignGjkxS/sw1QPN+PInnUE5sxAjkefL5C3/Mk=
  SHA256 (gzip-1.15.zip) = UvU0W04E/rexLC/qZ1/40GucNXMTtUh2yDu6cdICzhA=
  SHA3-256 (gzip-1.15.zip) = nhoi+h4j1rwxGJSA8pwkqehAoraNQGbcgvGxYOcxQkg=

Verify the base64 SHA256 checksum with 'cksum -a sha256 --check'
from coreutils-9.2 or OpenBSD's cksum since 2007.

Verify the base64 SHA3-256 checksum with 'cksum -a sha3 --check'
from coreutils-9.8.

Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  gpg --verify gzip-1.15.tar.gz.sig gzip-1.15.tar.gz

The signature should match the fingerprint of the following key:

  pub   rsa4096/0x7FD9FCCB000BEEEE 2010-06-14 [SCEA]
        Key fingerprint = 155D 3FC5 00C8 3448 6D1E  EA67 7FD9 FCCB 000B EEEE
  uid                   [ultimate] Jim Meyering <jim@meyering.net>
  uid                   [ultimate] Jim Meyering <meyering@fb.com>
  uid                   [ultimate] Jim Meyering <meyering@gnu.org>

If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.

  gpg --locate-external-key jim@meyering.net

  gpg --recv-keys 7FD9FCCB000BEEEE

  wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=gzip&download=1' | gpg --import -

As a last resort to find the key, you can try the official GNU
keyring:

  wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
  gpg --keyring gnu-keyring.gpg --verify gzip-1.15.tar.gz.sig gzip-1.15.tar.gz

This release is based on the gzip git repository, available as

  git clone https://https.git.savannah.gnu.org/git/gzip.git

with commit e6263160768c73f6117f3c1de78291a60f2cb796 tagged as v1.15.

For a summary of changes and contributors, see:

  https://gitweb.git.savannah.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.15

or run this command from a git-cloned gzip directory:

  git shortlog v1.14..v1.15

This release was bootstrapped with the following tools:
  Autoconf 2.73.1-b400b
  Automake 1.19
  Gnulib 2026-09-04 331c8d065a8a753de71f084f068473ccd5e4c34a

NEWS

* Noteworthy changes in release 1.15 (2026-09-20) [stable]

** Bug fixes

  gzip no longer can mistakenly remove the wrong file if some other
  process simultaneously renames a gzip destination's ancestor.
  [bug present since the beginning]

  gzip -d no longer rejects PKZIP signatures, local header, and data
  descriptors.  These can appear in well-formed streamed zip files.
  [bug present since the beginning]

  gzip diagnostics now quote file names containing unusual characters.
  [bug present since the beginning]

  A use of uninitialized memory on some malformed inputs has been fixed.
  [bug present since the beginning]

  A buffer overflow has been fixed when decompressing an .lzh file
  after decompressing a .Z file.
  [bug present since the beginning]

  When decompressing an .lzh file, the output is no longer corrupted
  when an internal bit buffer is not properly cleared.
  [bug present since the beginning]

  When decompressing an .lzh file after another .lzh file, the output is
  no longer corrupted by the previous file's decoding table.
  [bug present since the beginning]

  gzip --synchronous no longer fails to synchronize unreadable parent
  directories on platforms like GNU/Linux that have O_PATH, or to
  synchronize any parent directories on platforms like FreeBSD that
  have O_SEARCH but not O_PATH.
  [bug introduced in gzip-1.7]

  On old-fashioned or limited platforms lacking mktemp, gzexe, zdiff
  and znew no longer have a race when creating a temporary file.
  [bug present since the beginning]


** Changes in behavior

  gzip no longer insists on the "C" locale; instead, it follows the
  typical practice of using the locale specified by the environment.
  This change, which is needed for file name quoting, can affect the
  format of floating-point numbers output by gzip's -l and -v options.
  Diagnostics are still in English, though.

  gzip -l now reports "-Inf%" instead of "0.0%" for the infinite
  compression ratio of an empty file.

  znew's -P option is now ignored, with a warning.  It was present
  only to improve performance, and its implementation had too many
  bugs to be worth supporting.

** Platforms no longer supported

  The following platforms (or earlier) are no longer supported because
  their old multibyte libraries do not work well enough: FreeBSD 4.11
  (2005), HP-UX 11.00 (1997), Minix 3.1.8 (2010), MS-Windows 8.1
  (2013) via mingw without UCRT.

I'm very pleased to announce the release of a new version of GNU PSPP.  PSPP is a program for statistical analysis of sampled data.  It is a free replacement for the proprietary program SPSS.

Changes from 2.1.1 to 2.1.2:

• Translation updates.
• Bug fixes.

Please send PSPP bug reports to bug-gnu-pspp@gnu.org.

How we approach the development and testing of our infrastructure as code, and how it differs at the homelab and professional scales. Plus our Ansible best practices.

Support us on patreon and get an ad-free RSS feed with some early episodes

Subscribe to the RSS feed.

Some of the ways you can mitigate the ridiculous hardware prices, and designing a small business LAN.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

FreeBSD’s Release Cycle: What It Means for Your Upgrade Schedule

Free consulting

We were asked about designing a small business LAN.

Fedora 45 beta has been released with updated Gnome, KDE Plasma, and kernel.

• Public Mirrors to DQS Migration

Abbiamo già creato un account presso la Blocklist via DNS Query in precedenza, nella pagina dedicata a RBL (si veda qui).

Installazione del plugin per SpamaAssassin

• Plugin per SpamAssassin

Intanto disabilitiamo le query ordinarie aggiungendo questo in /etc/mail/spamassassin/local.cf:

# disable spamhaus 
score URIBL_DBL_SPAM 0 
score URIBL_DBL_PHISH 0 
score URIBL_DBL_MALWARE 0 
score URIBL_DBL_ABUSE 0 
score URIBL_DBL_ABUSE_REDIR 0 
score URIBL_DBL_ABUSE_PHISH 0 
score URIBL_DBL_ABUSE_MALWARE 0 
score URIBL_DBL_BLOCKED 0 
score URIBL_DBL_BLOCKED_OPENDNS 0
# disable DNSWL 
score RCVD_IN_DNSWL_BLOCKED 0 
score RCVD_IN_DNSWL_MED 0 
score RCVD_IN_DNSWL_HI 0 
score RCVD_IN_DNSWL_LOW 0

Scaricare l'ultimo pacchetto:

git clone https://github.com/spamhaus/spamassassin-dqs

sh hbltest.sh
	Please input your DQS key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
	Looking up test record for HBL... done
	Your DQS key xxxxxxxxxxxxxxxxxxxxxxxxxxxx is enabled for HBL
	You can copy sh_hbl.cf and sh_hbl_scores.cf if you want HBL enabled

sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf
sed -i -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf

sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh.cf
sed -i "" -e 's/your_DQS_key/xxxxxxxxxxxxxxxxxxxxxxxx/g' sh_hbl.cf

cp sh.cf sh_scores.cf /etc/mail/spamassassin

loadplugin       Mail::SpamAssassin::Plugin::SH <config_directory>/SH.pm

loadplugin       Mail::SpamAssassin::Plugin::SH /etc/mail/spamassassin/SH.pm

cp SH.pm sh.cf sh_scores.cf sh_hbl.cf sh_hbl_scores.cf sh.pre /etc/mail/spamassassin

loadplugin Mail::SpamAssassin::Plugin::HashBL

spamdctl restart

spamassassin --lint

Content analysis details:   (19.5 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
 0.7 SPF_HELO_SOFTFAIL      SPF: HELO does not match SPF record (softfail)
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.0573]
 0.0 DMARC_MISSING          Missing DMARC policy
 2.8 TXREP                  TXREP: Score normalizing based on sender's reputation
 8.0 SH_DBL_HEADERS         A domain found in headers (mail from, reply-to etc..)
                            is listed in DBL
                            [dbl-dqs.blt.spamhaus.net]
 8.0 SH_DBL_BODY            The domain of an email address found in body is listed in
                             DBL
                            [dbl-dqs.blt.spamhaus.net]

Content analysis details:   (12.1 points, 5.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
 8.0 SH_HELO_ZRD_VERY_FRESH The domain used in the HELO string is listed
                            in ZRD and the domain age is between 0 and 4
                            hours
                            [zrd-dqs.blt.spamhaus.net]
-0.0 BAYES_20               BODY: Bayes spam probability is 5 to 20%
                            [score: 0.1579]
 1.0 FORGED_SPF_HELO        No description available.
 0.4 KHOP_HELO_FCRDNS       Relay HELO differs from its IP's reverse DNS
 0.0 DMARC_MISSING          Missing DMARC policy
 2.7 TXREP                  TXREP: Score normalizing based on sender's reputation

A new article by Jacob Bachmeyer and Richard Stallman
to answer the question, What's Wrong with GitHub?
has been published at https://www.gnu.o ... -with-github.html

Software developers, the GNU Project urges you to avoid
hosting your repositories on GitHub. This is to avoid
being on the receiving end of harmful practices, and
avoid leading others to be victims too. This article
focuses on a few of GitHub's worst problems, and the
wrongs and harm they can do.

16 September 2026 Unifont 18.0.01 is now available.  This release is aligned with Unicode 18.0.0, adding almost 400 new glyphs.

Download this release from GNU server mirrors at:

     https://ftpmirror ... /unifont-18.0.01/

or if that fails,

     https://ftp.gnu.o ... /unifont-18.0.01/

or, as a last resort,

     ftp://ftp.gnu.org ... /unifont-18.0.01/

These files are also available on the unifoundry.com website:

     https://unifoundr ... /unifont-18.0.01/

Font files are in the subdirectory

     https://unifoundr ... 0.01/font-builds/

A more detailed description of font changes is available at

      https://unifoundr ... nifont/index.html

and of utility program changes at

      https://unifoundr ... nt-utilities.html

Information about Hangul modifications is at

      https://unifoundr ... hangul/index.html

and

      http://unifoundry ... l-generation.html

Enjoy!
Paul Hardy, GNU Unifont Maintainer

Ubuntu 26.10 has completed its migration to the Rust-based coreutils.

Dear community

The XI edition of GNUHealthCon will take place in Gran Canaria, Spain, this December 18th, and you are invited!

Celebrating 20 years of Freedom and Equity in Healthcare

This edition is special for us because we will be celebrating the 20th anniversary of the first GNU Solidario mission that took place in Santiago del Estero, Argentina in October 2006. That remote rural school, the teachers, the children and their families generated a profound inspirational impact on me, so deep that since then I have dedicated most of my life to the field Social Medicine. GNU Health is both a result of that experience, and the main channel to deliver freedom and dignity around the globe.

In this edition, besides the technical and social talks, we will have the space to commemorate these 20 years. During these two decades we have gone through many things. We have many happy stories to share, but we also have sad ones, that made us learn and be more resilient. Stories of people from countries around the world that have conformed this wonderful community around GNU Solidario. Stories and experiences that have made GNU Health the leading Free/Libre Health and Hospital Information System.

I want to personally invite all of you who has been part of this beautiful journey: The GNU community; hospitals and health institutions around the world that use GNU Health; sister projects (Tryton, Orthanc,..); national and regional governments that have adopted GNU Health; sponsors; the open science and academic communities; developers and core team members… you are all part of the success of the project and we have to celebrate this edition together.

Pre-conference party

GHCON2026 will be on Friday, December 18th in Gran Canaria. The night before we will have the pre-conference party. Most probably, the event will be in a hotel in the mountains, and the idea is to arrive to the hotel on Thursday 17th. We will update in our official Mastodon account. (look for #GHCon2026 hashtag)

Please make sure you register (https://www.gnuhealth.org/ghcon/2026/) so we can prepare de logistics.

Looking forward to meeting personally all of you, and have a wonderful time in Gran Canaria!

Love and happy hacking
Luis

We answer your questions including the last new distro we tried, what distro we’d switch to if ours went away, whether we should limit our computer use, our vision for the Linux desktop, and our unpopular Linux opinions.

Tailscale

Tailscale is a modern, secure, zero-trust connectivity platform. Tailscale’s personal plan will be free forever for up to 6 users and unlimited devices! No credit card required. Go to tailscale.com/lnl to get started. If you’d like to bring Tailscale to work, use code latenightlinux for three free months of any paid plan.

Support us on patreon and get an ad-free RSS feed with some early episodes

This is to announce coreutils-9.12, a stable release.

Notable changes include:

env supports a new --env0-from=FILE option to support
full persistence and restoration of the environment.
This also supports e.g. filtering like:
  env -i --env0-from=<( env -0 | sed -z ... )

Commands now have safer terminal output,
avoiding confusing output or corrupted terminal state.

Commands that traverse directories no longer
fail merely if files are being removed in parallel.

ptx has improved robustness, avoiding potential infinite loops.

tee fixes robustness issues introduced in the previous release,
where it could go into an infinite loop or incorrectly error
in the presence of short writes.

stty is more accepting of variations in requested speed.

sort(1) will now better use available memory
and parallel operation when reading from pipes.

There have also been many bug fixes and other changes
as summarized in the NEWS below.

There have been 288 commits by 16 people in the 21 weeks since 9.11.
Thanks to everyone who has contributed!

  Arun Bhattacharya (1)           Leonid Evdokimov (1)
  Ayesha Shafique (1)             Mateusz Nosek (1)
  Bruno Haible (5)                Max Downey Twiss (1)
  Collin Funk (98)                Paul Eggert (12)
  Guanqiang Han (1)               Pádraig Brady (118)
  H. Peter Anvin (1)              Sylvestre Ledru (33)
  Ismail Ramzi (1)                aizu-m (2)
  Iván Ezequiel Rodriguez (2)     oech3 (11)

Pádraig [on behalf of the coreutils maintainers]
==================================================================

Here is the GNU coreutils home page:
    https://gnu.org/s/coreutils/

Here are the compressed sources:
  https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.gz   (16MB)
  https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.xz   (6.4MB)

Here are the GPG detached signatures:
  https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.gz.sig
  https://ftp.gnu.org/gnu/coreutils/coreutils-9.12.tar.xz.sig

Use a mirror for higher download bandwidth:
  https://www.gnu.org/order/ftp.html

Here are the SHA256 and SHA3-256 checksums:

  SHA256 (coreutils-9.12.tar.gz) = FMv1pN4Me3+jufp/raTFiy3v4zM2qo/YPXYixcTr3BM=
  SHA3-256 (coreutils-9.12.tar.gz) = 14aJyepDW60jsaL4cq5T/UFMwUJEkXDyUqZEQlsnLFM=
  SHA256 (coreutils-9.12.tar.xz) = pIAZhVlzPps9qZnpBUOsb4iKLKpUTY1mTFofF+Uo4hA=
  SHA3-256 (coreutils-9.12.tar.xz) = cKcyD1sxJr1tdWgWbh0+OKwOEIpaf2ACThlaHZooZDA=

Verify the base64 SHA256 checksum with 'cksum -a sha256 --check'
from coreutils-9.2 or OpenBSD's cksum since 2007.

Verify the base64 SHA3-256 checksum with 'cksum -a sha3 --check'
from coreutils-9.8.

Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  gpg --verify coreutils-9.12.tar.gz.sig coreutils-9.12.tar.gz

The signature should match the fingerprint of the following key:

  pub   rsa4096/0xDF6FD971306037D9 2011-09-23 [SC]
        Key fingerprint = 6C37 DC12 121A 5006 BC1D  B804 DF6F D971 3060 37D9
  uid                   [ultimate] Pádraig Brady <P@draigBrady.com>
  uid                   [ultimate] Pádraig Brady <pixelbeat@gnu.org>

If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.

  gpg --locate-external-key P@draigBrady.com

  gpg --recv-keys DF6FD971306037D9

  wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=coreutils&download=1' | gpg --import -

As a last resort to find the key, you can try the official GNU
keyring:

  wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
  gpg --keyring gnu-keyring.gpg --verify coreutils-9.12.tar.gz.sig coreutils-9.12.tar.gz

This release is based on the coreutils git repository, available as

  git clone https://https.git.savannah.gnu.org/git/coreutils.git

with commit c0f8514d989184921d9b12a4d103a7b23abc5af8 tagged as v9.12.

For a summary of changes and contributors, see:

  https://gitweb.git.savannah.gnu.org/gitweb/?p=coreutils.git;a=shortlog;h=v9.12

or run this command from a git-cloned coreutils directory:

  git shortlog v9.11..v9.12

This release was bootstrapped with the following tools:
  Autoconf 2.73.16-0a513
  Automake 1.18.1
  Gnulib 2026-09-07 106e9b2384d08a1696fcbd40cbab52237943f208
  Bison 3.8.2

NEWS

* Noteworthy changes in release 9.12 (2026-09-14) [stable]

** Bug fixes

  'chcon', 'chgrp', 'chmod', 'chown', 'du', 'ls' which traverse hierarchies with
  -R,  no longer fail merely because files may be being removed in parallel.
  [This bug was present in "the beginning".]

  'comm - -' no longer closes standard input twice.  Previously it would
  mistakenly exit with a nonzero status.
  [This bug was present in "the beginning".]

  'cp', 'install', and 'mv' now fall back to a standard copy
  if a --reflink=auto clone fails due to EDQUOT, ENOMEM, or ENOSPC.
  E.g., with XFS, a clone can exhaust metadata space in an allocation
  group, while a standard copy works.
  [bug introduced in coreutils-9.2]

  'cut -d' with multiple multi-byte delimiter options specified
  will correctly match the last delimiter specified.
  [bug introduced with multi-byte support in coreutils-9.11]

  'date -d '1-2-3' "+%_D"' no longer propagates flags like _ and - to the year
  component of the %D date specifier, keeping consistent component formatting.
  [bug introduced in coreutils-8.31]

  'du --max-depth=N' now exits with a nonzero exit status and an error message
  if N is negative.  Previously it behaved as if N were zero.
  [bug introduced in coreutils-9.4]

  'factor' avoids a buffer over-read (CWE-126) for certain values.
  [bug introduced in coreutils-9.8]

  'head' and 'tail' now quote names in file headers when needed.
  [This bug was present in "the beginning".]

  'ls --color' no longer reads freed memory when LS_COLORS sets "ln=target"
  and later becomes unparsable, e.g., LS_COLORS='ln=target:x'.
  [This bug was present in "the beginning".]

  'mv' now warns when copying extended attributes fails with ENOTSUP, e.g., when
  moving files to a file system that does not support them.
  [bug introduced in coreutils-7.3]

  'numfmt', 'printf', and 'seq' on Solaris, no longer output an extraneous e+00
  when using a large precision like "%.5119f".
  [This bug was present in "the beginning".]

  'pinky -l' no longer no longer prints output in the incorrect order when
  standard output is fully buffered, e.g., when redirected to a file.
  [bug introduced in coreutils-9.10]

  'pr' now exits gracefully upon exceeding internal accounting limits,
  like when processing large tab stops.
  [This bug was present in "the beginning".]

  'ptx -G' no longer loops forever when the output width is smaller than
  twice the gap size, as with 'ptx -G -w4', or when a long reference
  leaves that little room, as with 'ptx -G -r'.
  [This bug was present in "the beginning".]

  'ptx -W' no longer loops forever with a word regular expression that can
  match the empty string, like: echo ab | ptx -W 'a*'.
  [This bug was present in "the beginning".]

  'shred' no longer blocks when opening a FIFO that has no readers.
  [This bug was present in "the beginning".]

  'stty' no longer fails when the system uses speed encodings that
  are variations of the requested speed.
  [bug introduced in coreutils-9.8]

  'tee' no longer loops infinitely after writing all output if a write call sets
  errno to EAGAIN.
  [bug introduced in coreutils-9.11]

  'tee' no longer treats short writes as errors.
  [bug introduced in coreutils-9.11]

  'test' no longer treats '-a' and '-o' as operators when given as strings to a
  binary operator.  E.g., 'test -a -a -a' exits successfully instead of exiting
  with an error.
  [This bug was present in "the beginning".]

  'truncate --reference=R' no longer hangs when R is a FIFO with no readers.
  [bug introduced in coreutils-8.17]

  'unexpand -t' no longer overflows a heap buffer, for tab values > SIZE_MAX/16,
  or with multi-byte blank characters longer than the tab value.
  [bugs introduced in coreutils-9.11]

  'uniq -w' no longer overruns the read buffer in multibyte locales.
  [bug introduced in coreutils-9.5]

  'wc' no longer reads past the end of a lookup table in legacy multibyte
  locales like SHIFT-JIS where a single byte can decode to a wide character.
  [bug introduced in coreutils-9.5]

  Messages from Gnulib are no longer mistranslated in non-English locales.
  [bug introduced in coreutils-9.6]

** New Features

  'env' now supports --env0-from=FILE to read NUL-delimited environment entries
  from a file.  With -i, entries are preserved exactly, allowing full
  round-tripping of environments containing duplicate or nonstandard entries.

  'stat' and 'tail' now know about the "failfs" and "nullfs" file system types.
  stat -f -c%T now reports the file system type,
  and tail -f uses inotify for these file systems.

  uname adds the -A,--all-labeled option to label all output, one item per line.

** Changes in behavior

  'env' and 'printenv' now quote printed environment variables honoring the
  QUOTING_STYLE environment variable, defaulting to shell-escape style. This
  avoids printing arbitrary data to the terminal and allows the output to be
  sourced by a POSIX shell.

  'ls' -w,--width no longer includes '\n' in the width of a line.
  I.e., the width or $COLUMNS is interpreted to be an _inclusive_ maximum.

  'stat' now uses shell quoting when required, to more robustly escape
  file names.  Previously it only quoted file names with the %N format.
  The default quoting honors the QUOTING_STYLE env variable (like %N).
  Also %Qn is a newly supported format combination to quote file names,
  leaving the existing %n format for when quoting is not desired.

** Improvements

  When built with the configure option '--with-wtmpdb', invocations of
  'who /var/log/wtmp' and 'users /var/log/wtmp' use the wtmpdb database
  instead of the file /var/log/wtmp.  This makes them Y2038-safe.

  'cut -w' operates more efficiently when extracting the start of a line
  in multi-byte locales, giving 4x more throughput with typical input.

  'df', 'du', 'ls', 'od', 'pr', and 'sort' now escape invalid arguments in error
  messages for options expecting an integer.

  'env -0, and 'printenv -0' now explicitly set binary mode on output
  so that no CRLF translation is done e.g., on windows.

  'install -C' will now avoid updating file metadata when the destination
  already has the appropriate ownership and permissions.

  'basename', 'dirname', 'du', 'readlink', and 'realpath' now quote output in
  shell-escape style when standard output is a terminal.  The QUOTING_STYLE
  environment variable can be used to adjust or disable the quoting.

  'ls -m' now quotes files names containing commas when appropriate,
  so users can better distinguish separating commas.

  'ls' now replaces newlines in file names if ambiguous with separators.
  Previously newlines were protected only when outputting to a terminal.

  'sort' will now better use available memory and parallel operation
  when reading from unknown sized inputs like pipes.

  'uniq -c' now operates up to 2.5x times faster on systems with unlocked stdio
  functions.


** Build-related

  'logname' now builds, where getlogin() is replaced (e.g. with musl),
  and systemd libs are being used, by linking the required libraries.

  The multi-call binary built with configure --enable-single-binary is reduced
  in size by around 10KB through the more efficient reuse of the 'test' code
  by '[', and the 'true' code by 'false'.

  configure no longer accepts the --with-linux-crypto option, which allowed
  cksum, md5sum, and sha*sum to use the Linux AF_ALG API.  This API will be
  deprecated in Linux 7.2 and is less performant than OpenSSL.

  The configure option '--enable-systemd' is renamed to '--with-systemd'.
  The option '--enable-systemd' was a misnomer and is now deprecated.

  The 'sort' binary now uses the UAPI Group's .note.dlopen ELF note
  to indicate its dependency on libcrypto.

Chris needs a solution for his family to watch ripped media while travelling, and Gary has a complex but cool travel network setup.

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

A Linux developer used AI to fix bottlenecks that caused problems when building the kernel. The resulting AI-generated code needed a lot of work.

A BGP hijack involved some basic errors, Microsoft teaches people to ignore warnings in Windows, Zoom appears to be reading the clipboard on X11, why a non-US open certificate authority is feasible in theory, and keeping a NAS powered on as little as possible.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

Send us an email

News/discussion

BGP hijack infecting networks caused by a comedy of errors that’s not funny at all

Windows bug incorrectly tells users that Microsoft Defender Antivirus is turned off

I noticed today that an update to the #Linux #Zoom client has made it start proactively reading _everything_ written to the X11 clipboard

Free consulting

We were asked about keeping a NAS powered on as little as possible.

Pop culture phenomena that passed us by, and how long it’s acceptable to wait before replying to a message. With Félim, Gary, Jim, and special guest Shane from Linux Lads.

Patrons got this this in their feed two weeks ago.

Brazilian patent BRPI0109962B1 has expired, which means that DivX and Xvid are no longer problematic for Linux, but it doesn’t mean that video is all of a sudden fully unleashed.

• Download https://github.com/sagredo-dev/qmHandle (copia locale)

qmHandle è un semplice programma che consente di visualizzare e di gestire la coda dei messaggi.

Changelog

• Sep 7, 2026 (version 1.3.5)
  - Use pgrep as a fallback when pidof is unavailable
  - Use env in Perl shebang for portability
• Jul 10, 2025
  - Add -x and -X parametr for remove email by To/Cc/Bcc by @Stetinac in #1
  - start/stop qmail command changed to daemontools svc
• 13 Aprile 13 2025
  - il progetto risulta abbandonato, così ho copiato i sorgenti nel mio spazio github, applicato le piccole patch e rilasciato il tutto come versione 1.3.3
• 17 febbraio 2024
  - applicata una patch per risolvere un refuso nell'uso dei parametri quando viene stampato l'help
  - unita la patch precedente con quella già usata per sostituire svc con qmailctl nei comandi stop/startqmail

Installazione

Scaricare da sourceforge e installare il binario:

wget https://github.com/sagredo-dev/qmHandle/archive/refs/tags/v1.3.5.tar.gz
tar xzf v1.3.5.tar.gz
cd qmHandle-1.3.5
chown -R root:root .
cp qmHandle /usr/local/bin

sei hai Debian GNU/Linux con il suo pacchetto qmail edita qmHandle e decommenta

#my ($stopqmail) = '/etc/init.d/qmail stop';

Utilizzo

# qmHandle --help

qmHandle v1.3.5
Copyright 1998-2003 Michele Beltrame

Available parameters:
  -a       : try to send queued messages now (qmail must be running)
  -l       : list message queues
  -L       : list local message queue
  -R       : list remote message queue
  -s       : show some statistics
  -mN      : display message number N
  -dN      : delete message number N
  -fsender : delete message from sender
  -F're'   : delete message from senders matching regular expression re
  -Stext   : delete all messages that have/contain text as Subject
  -h're'   : delete all messages with headers matching regular expression re (case insensitive)
  -b're'   : delete all messages with body matching regular expression re (case insensitive)
  -H're'   : delete all messages with headers matching regular expression re (case sensitive)
  -B're'   : delete all messages with body matching regular expression re (case sensitive)
  -xaddr   : delete all messages where recipient address matches 'addr' (To/Cc/Bcc) 
  -X're'   : delete all messages where recipient address (To/Cc/Bcc) matching regular expression re
  -t're'   : flag messages with recipients in regular expression 're' for earlier retry (note: this lengthens the time message can stay in queue)
  -D       : delete all messages in the queue (local and remote)
  -V       : print program version

Additional (optional) parameters:
  -c       : display colored output
  -N       : list message numbers only
           (to be used either with -l, -L or -R)

You can view/delete multiple message i.e. -d123 -v456 -d567

Audacity’s new major release makes it more like a proper digital workstation, Debian finally gets off the genAI fence and disappoints some of us, California exempts Linux from terrible age verification laws, and Asahi boots on M3 Macs. With guest host Shane from Hybrid Cloud Show.

News

Audacity 4

Debian Votes To Allow “Responsible Use Of Generative AI”

Results for LLM usage in Debian

Retiring from the Project (vv221)

California lawmakers unanimously pass Linux exemption from age-verification law

M2: Episode 1 (or, Asahi Linux on M3)

Support us on patreon and get an ad-free RSS feed with some early episodes

Guix system and Guix home introduce the concept of services. These provide users with a way to control background processes, commonly refereed as daemons, as well as ways of controlling the setup of files. For example, openssh-service-type is a service which controls a SSH daemon. In contrast, etc-service-type is a service that populates the contents of the /etc directory.

One peculiarity of Guix services is that it's customary to provide Scheme bindings for the different fields. By that I mean that the different fields of the configuration of most services will be a type. The benefit of this is that users get a uniform configuration language for their services, at the cost of additional complexity when developing the service. Which is why, for a long time, Guix users seem to struggle with defining complex configurations. There are a number of reasons for this, we will try to close the gap today by going through defining a configuration for Goimapnotify.

This blog post assumes that the reader is somewhat familiar with Guix and knows how to setup a development environment for it. If that's not the case, read The Perfect Setup and Using Guix interactively.

A Goimapnotify configuration is written in YAML. Therefore, we will need to serialize the different Guile Scheme fields to this format. Let's take the example configuration that the author gives in the project's README.md:

configurations:
  - host: example.com
    port: 143
    tls: true
    tlsOptions:
        rejectUnauthorized: false
        starttls: true
    idleLogoutTimeout: 15
    username: USERNAME
    alias: ExampleCOM
    password: PASSWORD
    xoAuth2: false
    boxes:
      - mailbox: INBOX
        onNewMail: 'mbsync examplecom:INBOX'
        onChangedMail: 'mbsync examplenet:INBOX'
        onChangedMailPost: SKIP
        onNewMailPost: SKIP
  - hostCMD: COMMAND_TO_RETRIEVE_HOST
      port: 993
      tls: true
      tlsOptions:
        rejectUnauthorized: true
        starttls: true
      username: ''
      usernameCMD: ''
      password: ''
      passwordCMD: ''
      xoAuth2: false
      onNewMail: ''
      onNewMailPost: ''
      onChangedMail: ''
      onChangedMailPost: ''
      onDeletedMail: ''
      onDeletedMailPost: ''
      boxes:
        - mailbox: INBOX
          onNewMail: 'mbsync examplenet:INBOX'
          onNewMailPost: SKIP
          onChangedMail: 'mbsync examplenet:INBOX'
        - mailbox: Junk
          onNewMail: 'mbsync examplenet:Junk'
          onNewMailPost: SKIP

Just by looking at the hierarchy we can already envision how to organize our scheme records. We will need the following:

• home-goimapnotify-configuration-fields
• goimapnotify-configuration
• goimapnotify-box-configuration
• goimapnotify-tls-options-configuration

The final configuration that the service for Goimapnotify will rely on, will be home-goimapnotify-configuration-fields. It will contain a configurations field where each item will be a goimapnotify-configuration; each box in those configurations will be a goimapnotify-box-configuration. Additionally, each of those configurations will have an optional goimapnotify-tls-options-configuration.

The (gnu services configuration) module provides us with the API that we need to define these configurations. The most important helpers for defining configurations are:

• define-configuration: For configurations that need to serialize fields into a different format, generally configuration files.

• define-configuration/no-serialization: For configurations that do not need to emit any files. Generally all the fields are consumed by the Shepherd services that rely on the configuration but no translation from Scheme to a different format is needed.

In our case, we need to translate the different configuration fields to YAML, so we will need to use define-configuration.

The following sections are written so you can follow along, you are encouraged to drop into a REPL (short for read-eval-print loop) and import the required module:

,use (gnu services configuration)

goimapnotify-tls-options-configuration

To make it easy for ourselves, we will start form the in-out, after all, you wouldn't want to build a house from the rooftop, would you?

(define-configuration goimapnotify-tls-options-configuration
  (reject-unauthorized?
   (boolean #f)
   "Whether to reject unauthorized TLS certificates.")

  (starttls?
   (boolean #f)
   "Whether to use STARTTLS.")

  (prefix goimapnotify-))

evaluating the above snippet will throw an unbound variable exception, bear with me.

Refer to the manual for an in-depth explanation of the syntax of define-configuration.

The first argument is the name of the configuration object, goimapnotify-tls-options-configuration in this case. After it, we define the different typed fields. We are defining boolean fields that are, by default, set to false. The biggest source of confusion when defining configurations comes because define-configuration is a macro that introduces identifiers that do not appear in the source code—it's an unhygienic macro. That means that the macro will expand to code which defines symbols that are not visible when reading the source file.

One can inspect the expansion of the macro by using the ,expand REPL command. It will be quite verbose, so don't try to read all of it, instead search through it; you will find some revealing things, such as:

scheme@(gnu home services mail)> ,expand (define-configuration goimapnotify-tls-options-configuration
  (reject-unauthorized?
   (boolean #f)
   "Whether to reject unauthorized TLS certificates.")
  (starttls?
   (boolean #f)
   "Whether to use STARTTLS.")
  (prefix goimapnotify-))
$20 = (begin ...
        (define goimapnotify-tls-options-configuration? ...)
        (define goimapnotify-tls-options-configuration-reject-unauthorized? ...)
        (define goimapnotify-tls-options-configuration-starttls? ...)
        ...
        (define <goimapnotify-tls-options-configuration> ...)
        ...
        (define goimapnotify-tls-options-configuration ...)
        (define goimapnotify-tls-options-configuration-fields
          ((@@ (gnu services configuration) list)
           (let* ((name (let ((x 'reject-unauthorized?)) x)) ...
                  (serializer (let ((x goimapnotify-serialize-boolean)) x)) ...)
             ...)
           (let* ((name (let ((x 'starttls?)) x)) ...
                  (serializer (let ((x goimapnotify-serialize-boolean)) x)) ...)
             ...))))

In the previous snippet, ... represents omitted code. As you can see from the macro expansion, define-configuration introduces quite a few identifiers. You may recognize the shared prefix in those identifiers, that's right, it's the prefix specified by that last field that we didn't explain from the configuration definition, (prefix goimapnotify-).

By inspecting the macro expansion, it's easy to understand what happens under the hood. When a prefix is specified, we instruct the macro to append that prefix to all the generated identifiers. This is useful to avoid naming collisions; for example, when defining the configuration in a module with other configuration records that serialize to different formats. After all, it's not the same to serialize to YAML than to INI, or any other format a tool may require.

Remember that unbound variable problem I mentioned before? If you paid close attention to the macro expansion, you may have noticed those references to goimapnotify-serialize-boolean, those are our unbound variables. The macro expects us to define these serialization procedures, let's do that.

Defining the missing serializers

Since the configuration machinery knows nothing about the output format, we must define how this translation happens. In our case, we are translating to YAML. By looking at the example configuration provided by the Goimapnotify developers, we can see that the field names are written in camel case, and their respective values are separated from the names through the : character.

Helpers

Let's start by making a function that takes a symbol and transforms it into a string that's a camelized version of that symbol. We will use object->camel-case-string from the (gnu home services utils) module:

,use (gnu home services utils)

(define (camelize-field-name field-name)
  (let ((str (object->camel-case-string field-name)))
    (if (string-suffix? "?" str)
        (string-drop-right str 1)
        str)))
;; Usage: (camelize-field-name 'reject-unauthorized?) => "rejectUnauthorized"

In YAML, there is no convention of suffixing booleans with a ?, so our camelizer drops it when found.

camelize-field-name gives us a field name, but we want to serialize the value too. Let's define a field serialization procedure to help us:

(define (goimapnotify-serialize-field field-name val)
  "The mapping is used to serialize certain FIELD-NAMES specially."
  (let* ((field-name-mapping '((host-command . hostCmd)
                               (user-name . username)
                               (user-name-command . usernameCmd)
                               (password-command . passwordCmd)))
         (field-name* (or (assq-ref field-name-mapping field-name)
                          field-name)))
    (format #f "~a: ~s~%"
              (camelize-field-name field-name*)
              val)))
;; Usage: (goimapnotify-serialize-field 'reject-unauthorized? 'true) => "rejectUnauthorized: true\n"

Notice how we introduced field-name-mapping to tailor the field name passed to camelize-field-name to emit the specific naming that Goimapnotify expects. In Guix, we have a specific naming convention, so we want fields like user-name to map to username (instead of userName) and fields like password-command to map to passwordCmd (instead of passwordCommand).

That's enough to serialize most values to YAML, but there's an extra Guix-specific feature we should make use of to make the service more convenient to users: G-Expressions.

Are you familiar with them? If not, I encourage you to read this wonderful trilogy of blog posts: Dissecting Guix. It took me some time to wrap my head around these concepts, but once you do, I think you will like them too. In any case, that serializer is using those expressions because we want users of our configuration to be able to intermingle packages and other file-like objects in their fields. Since this is a blog post about writing configurations, I won't dive deep into G-Expressions, but let's try to get you a sense for them.

You will need to import (guix gexp) for the following snippet to work.

(define (goimapnotify-serialize-field field-name val)
  "The mapping is used to serialize certain FIELD-NAMES specially."
  (let* ((field-name-mapping '((host-command . hostCmd)
                               (user-name . username)
                               (user-name-command . usernameCmd)
                               (password-command . passwordCmd)))
         (field-name* (or (assq-ref field-name-mapping field-name)
                          field-name)))
    #~(format #f "~a: ~s~%"
              #$(camelize-field-name field-name*)
              #$val)))

That's not so bad, is it? What was that? 6 more characters? Surely you wouldn't be scared of that, but just in case, let me give you some extra reassurance on what's happening here. This G-Expression thing, also known as gexp, is just the way you let Guix know that this code is for later. "When is later?", you may wonder. Simplifying it, that "later" is when Guix knows where file-like objects will be located in your disk; that long path on the store you may have seen before.

For example, a package is a file-like object, so when you build the package Guix will tell you where it was stored:

$ guix build cowsay
/gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4

Preceding an expression with #~ (or gexp), one effectively tells Guix "don't evaluate this code until you know what this expression should expand to". And that other syntax, #$ (or ungexp), is telling Guix to replace the file-like object for its lowered representation, usually a path in the store. For a package like cowsay, that would be that /gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4 paths we saw before.

With that said, if you are like me, you won't be comfortable if you cannot debug this expressions, so let me give you some supper powers.

In your REPL, import the (guix) module. This will augment the REPL with some additional commands that will simplify our life:

scheme@(guile-user)> ,use (guix)
scheme@(guile-user)> ,help guix
Guix Commands [abbrev]:

 ,run-in-store EXP                 - Run EXP through the store monad.
 ,verbosity LEVEL                  - Change build verbosity to LEVEL.
 ,lower OBJECT                     - Lower OBJECT into a derivation or store file and return it.
 ,build OBJECT [BUILD-MODE]        - Lower OBJECT and build it, returning its output file name(s).
 ,build-options OPTIONS            - Set build options to OPTIONS.  Print previous value (to allow easy restore).
 ,build-graft GRAFT?               - Set whether grafts should be performed.
 ,enter-store-monad                - Enter a REPL for values in the store monad.
 ,phases                           - Return the build phases of the package defined by FORM.
 ,configure-flags                  - Return the configure flags of the package defined by FORM.
 ,make-flags                       - Return the make flags of the package defined by FORM.

Let's see what that gexp is up to:

scheme@(gnu home services mail)> (goimapnotify-serialize-field 'reject-unauthorized? ''true)
$6 = #<gexp (format #f "~a: ~s\n" #<gexp-input "rejectUnauthorized":out> #<gexp-input (quote true):out>) gnu/home/services/mail.scm:252:2 7f4c7d9deb40>

There is a little helper to approximate a gexp to it's output:

scheme@(gnu home services mail)> (gexp->approximate-sexp $6)
$7 = (format #f "~a: ~s\n" "rejectUnauthorized" (quote true))
scheme@(gnu home services mail)> (primitive-eval $7)
$8 = "rejectUnauthorized: true\n"

That gets us an idea of what will be emitted to disk, but for more complex procedures, this is not going to cut it, specially if there are multiple gexps combined. So let's build that gexp:

;; 'gexp->file' comes from the '(guix gexp)' module. You can ask the REPL more
;; information about a symbol through ',a SYMBOL'.
scheme@(gnu home services mail)> ,a gexp->file
(guix gexp): gexp->file #<procedure gexp->file (name exp #:key guile set-load-path? module-path splice? system target)>

scheme@(gnu home services mail)> (gexp->file "test.scm" $6)
$8 = #<procedure 7f3f7d456ea0 at guix/gexp.scm:2098:2 (state)>

In order for Guix to build a value, it needs to be something Guix can lower—an object that can be "compiled" down to a file in the store (these are referred to as file-like objects, because they can be inserted in any piece of code that expects a file name). A gexp cannot be built by itself, because there is nowhere to output it to. The above snippet creates a file-like object that will be emitted to a file named test.scm in the store. That file will contain our expression. As you see, we've got a procedure. The REPL printer tells us that this procedure needs some state; this is just a way of indicating you that this is a monadic procedure that can only be run in the context of a store connection. Read The Store Monad for more information.

I will build it manually just once for demonstration purposes, don't blink:

scheme@(gnu home services mail)> ,use (guix store)
scheme@(gnu home services mail)> (run-with-store (open-connection)
                                   $8)
$9 = #<derivation /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv => /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm 7f3f7e2de000>

Where we are saying "run the procedure we got in the context of a store connection", we opened that connection through open-connection. Let's not do that again... Fortunately we have those useful REPL commands I just told you about, so we can archive the same result by doing this:

scheme@(gnu home services mail)> ,run-in-store $8
$10 = #<derivation /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv => /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm 7fcd92f7f0f0>

That's better, isn't it?

Now, this is a derivation. That's something Guix can build:

scheme@(gnu home services mail)> ,build $10
building /gnu/store/gq71r3sgilfvsicfnifln8n0wfksam13-test.scm.drv...
$11 = "/gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm"

What's that? You don't want this magic command? Okay, the same thing can be done with:

scheme@(gnu home services mail)> (run-with-store (open-connection)
                                   (built-derivations (list $10)))
$12 = #t
scheme@(gnu home services mail)> (derivation->output-path $10)
$13 = "/gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm"

At last, a file! What's in there?

$ cat /gnu/store/c3hxw7pgnxchw1zldnc9nrb8iwwrqf78-test.scm
(format #f "~a: ~a\n" "rejectUnauthorized" "true")

Okay that seems about right. We can even run it:

scheme@(gnu home services mail)> (call-with-input-file $13
                                   (lambda (port)
                                     (primitive-eval (read port))))
$14 = "rejectUnauthorized: true\n"

You've seen the secret sauce, let's continue with what brought us here.

(define (goimapnotify-serialize-boolean field-name val)
  (goimapnotify-serialize-field field-name (if val ''true ''false)))

With this our configuration won't complain about the missing serializer. Let's continue.

One last thing, notice how, after moving to the gexp version of goimapnotify-serialize-field, we started double quoting the symbols true and false, this is because the #$ syntax will replace the value in place, and the value of 'true is true, without the quote. If we didn't double quote, the staged code after expansion would look like this:

(format #f "~a: ~s\n" "rejectUnauthorized" true)

When what we really want is to expand to this:

(format #f "~a: ~s\n" "rejectUnauthorized" 'true)

The reason for this is that we want users to be able to write staged code on the different fields. If one of the values of a field where to be something like this:

(goimapnotify-serialize-field 'favorite-game #~(string-append #$cowsay "/bin/cowsay"))

The expansion would be this:

(format #f "~a: ~s\n" "favoriteGame" (string-append "/gnu/store/gz170ppi2hxssp4h3yw5jh4gdw6x9ws0-cowsay-3.8.4" "/bin/cowsay"))

The string-append procedure is evaluated right before the format call, not when the gexp is getting lowered.

Serializing

The (gnu services configuration) module we imported earlier provides us with serialize-configuration, it takes two arguments, a configuration object and the fields that compose that configuration.

The define-configuration macro defined the goimapnotify-tls-options-configuration constructor for us, we can create a configuration with the default values like this:

scheme@(gnu home services mail)> (goimapnotify-tls-options-configuration)
$10 = #<<goimapnotify-tls-options-configuration> reject-unauthorized?: #f starttls?: #f %location: #f>

Then, we can serialize it like this:

scheme@(gnu home services mail)> (serialize-configuration $10 goimapnotify-tls-options-configuration-fields)
$11 = #<gexp  gnu/services/configuration.scm:165:2 7ff1fd2cbf60>

If you recall form the macro expansion we saw earlier, goimapnotify-tls-options-configuration-fields, was one of those identifiers that got generated.

You should already know how to build that gexp we've got:

scheme@(gnu home services mail)> (gexp->file "test.yaml" $11)
$12 = #<procedure 7efd8b10c2d0 at guix/gexp.scm:2098:2 (state)>
scheme@(gnu home services mail)> ,use (guix)
scheme@(gnu home services mail)> ,run-in-store $12
$13 = #<derivation /gnu/store/z59sf3nhh80668z8njljfxcymgi071pr-test.yaml.drv => /gnu/store/xam1210yl1vdxix0bgpfalf6drpv6xbx-test.yaml 7efd8a80fd70>
scheme@(gnu home services mail)> ,build $13
$14 = "/gnu/store/xam1210yl1vdxix0bgpfalf6drpv6xbx-test.yaml"
scheme@(gnu home services mail)> (call-with-input-file $14
                                   (lambda (port)
                                     (display (primitive-eval (read port)))))
rejectUnauthorized: false
starttls: false

That's some nice YAML syntax... We better speed up the pace or I will retire before finishing up this blog post.

goimapnotify-box-configuration

Next in line is goimapnotify-box-configuration, you know the drill. We start by declaring the configuration with define-configuration, specifying each field name, type and docstring:

(define-configuration goimapnotify-box-configuration
  (mailbox
   string
   "The mailbox to monitor.")

  (on-new-mail
   maybe-string-or-gexp
   "The command to execute when new mail arrives.")

  (on-new-mail-post
   maybe-string-or-gexp
   "The command to execute after the new-mail command.")

  (on-changed-mail
   maybe-string-or-gexp
   "The command to execute when mail is changed.")

  (on-changed-mail-post
   maybe-string-or-gexp
   "The command to execute after the changed-mail command.")

  (on-deleted-mail
   maybe-string-or-gexp
   "The command to execute when mail is deleted.")

  (on-deleted-mail-post
   maybe-string-or-gexp
   "The command to execute after the deleted-mail command.")

  (prefix goimapnotify-))

You may have noticed that we have two new types. strings, easy enough, and maybe-string-or-gexp, not so easy; right? Worry not, here comes the explanation.

Let's start by defining the string type:

(define-maybe string (prefix msmtp-configuration-))

You may be very confused right now. What has msmtp-configuration to do with our goimapnotify-configuration example? Well, I want this blog post to get you ready for the real world, and in the wild, you will make configurations in modules that contain other configurations. The example we are looking up today is a narration of my adventures making the Goimapnotify service from the (gnu services mail) module, in that module, there is already a configuration for msmtp. With that said, if we tried to do this:

(define-maybe string (prefix goimapnotify-))

We would be surprised with a warning that looks something like this:

$ make
...
[ 94%] GUILEC   gnu/home/services/mail.go
gnu/home/services/mail.scm:67:0: warning: shadows previous definition of `maybe-string?' at gnu/home/services/mail.scm:63:0
gnu/home/services/mail.scm:278:0: warning: shadows previous definition of `goimapnotify-serialize-maybe-string' at gnu/home/services/mail.scm:67:0

That's unexpected, isn't it? Nothing we've seen so far points to a maybe-string? procedure, let's look at what is going under the hood of that define-maybe macro:

scheme@(gnu home services mail)> ,expand (define-maybe string (prefix msmtp-configuration-))
$15 = (begin
        (define (maybe-string? val)
          (or ((@@ (gnu services configuration) not)
               ((@@ (gnu services configuration) maybe-value-set?) val))
              (string? val)))
        (define (msmtp-configuration-serialize-maybe-string field-name val)
          (if (string? val)
              (msmtp-configuration-serialize-string field-name val)
              "")))

Do you see it? The macro is expanding to some code that introduces two new procedures into the module, one following the prefix, that would be msmtp-configuration-serialize-maybe-string, and one that just declares the predicate for the maybe type.

Given that, the warning is now apparent. If we call again that macro with a string as the first argument, we will get the same predicate after the expansion, leading to the redefinition warning.

So, for this particular case, instead of using the macro, we will define manually the two procedures required for our configuration:

;; The module already had this helper defined.
(define (string-or-gexp? obj)
  (or (string? obj)
      (gexp? obj)))

;; ... omitted lines ...

(define (goimapnotify-serialize-string field-name val)
  (goimapnotify-serialize-field field-name val))

(define (goimapnotify-serialize-maybe-string field-name val)
  (if (maybe-value-set? val)
      (goimapnotify-serialize-string field-name val)
      ""))

(define goimapnotify-serialize-string-or-gexp
  goimapnotify-serialize-string)

(define (goimapnotify-serialize-maybe-string-or-gexp field-name val)
  (if (and (maybe-value-set? val)
           (string-or-gexp? val))
      (goimapnotify-serialize-string-or-gexp field-name val)
      ""))

The above snippet defines all the serializers we need for the new types. Notice that they are just some simple wrappers around the goimapnotify-serialize-field helper. That procedure is doing all the heavy lifting here, and fortunately for us, it already handles gexps. Therefore, the fields that have a type that accepts a gexp are straightforward to declare.

That would be it for the goimapnotify-box-configuration declaration. As showed in the previous section, the REPL is your friend. I had never written such a complex configuration before, but thanks to this "elegant weapon for a more civilized age", I could find my way by poking things around.

Let's continue!

goimapnotify-configuration

You know the drill, we start by defining the fields we need. Again, I'm doing this just by looking at the README example provided by the developers of Goimapnotify:

(define-configuration goimapnotify-configuration
  (host
   string
   "The IMAP server hostname.")

  (host-command
   maybe-string-or-gexp
   "The command to retrieve the IMAP server hostname.")

  (port
   (integer 993)
   "The port that the IMAP server listens on.")

  (tls?
   (boolean #f)
   "Enable or disable TLS.")

  (tls-options
   maybe-goimapnotify-tls-options-configuration
   "TLS options for the IMAP connection."
   (serializer serialize-maybe-goimapnotify-tls-options-configuration))

  (idle-logout-timeout
   maybe-integer
   "The idle logout timeout in minutes.")

  (user-name
   maybe-string
   "The user-name for authentication.")

  (user-name-command
   maybe-string-or-gexp
   "The command to retrieve the user-name.")

  (alias
   maybe-string
   "An alias for the account.")

  (password
   maybe-string
   "The password for authentication.")

  (password-command
   maybe-string-or-gexp
   "The command to retrieve the password.")

  (xo-auth2?
   (boolean #f)
   "Enable or disable XOAUTH2 authentication.")

  (wait
   maybe-integer
   "The delay in seconds before the mail syncing is triggered.")

  (boxes
   list-of-goimapnotify-boxes-configurations
   "The mailboxes to monitor."
   (serializer serialize-list-of-goimapnotify-boxes-configurations))

  (prefix goimapnotify-))

You are already familiar with most of those types, but there are some new things here:

• integer and maybe-integer
• maybe-goimapnotify-tls-options-configuration
• list-of-goimapnotify-boxes-configurations

Let's start with the obvious ones first.

integer

The module already had a maybe definition for the integer. If you recall from the macro expansion earlier, that means that there is already a symbol for the predicate maybe-integer?:

(define-maybe integer (prefix msmtp-configuration-))

We still need a serializer that follows our prefix:

(define (goimapnotify-serialize-integer field-name val)
  (goimapnotify-serialize-field field-name val))

(define (goimapnotify-serialize-maybe-integer field-name val)
  (if (maybe-value-set? val)
      (goimapnotify-serialize-integer field-name val)
      ""))

Simple enough. Moving on!

maybe-goimapnotify-tls-options-configuration

(define (serialize-goimapnotify-tls-options-configuration field-name val)
  (let ((serialization (serialize-configuration val goimapnotify-tls-options-configuration-fields)))
    #~(begin
        (use-modules (ice-9 format) (ice-9 string-fun))
        (format #f "~a:
  ~a~%"
                '#$(camelize-field-name field-name)
                (string-replace-substring #$serialization "\n" "\n  ")))))

(define-maybe goimapnotify-tls-options-configuration)

You are already familiar with the define-maybe macro. The serializer is also quite simple. Since we already defined a record that contains within all the required information to serialize it, we just need to make a simple wrapper around serialize-configuration.

Before moving forward, notice how the serializers from this section doesn't contain that goimapnotify- prefix. This is an arbitrary decision, but since there is already goimapnotify in the symbol name, I think it's a bit redundant to add it. For the configuration definition to know which serializer to use, we have to be specific in the serializer argument of the fields, that's why in the configuration we had this declaration specifying a (serializer ...) for the field:

(define-configuration goimapnotify-configuration
  ;; ... omitted lines ...
  (tls-options
   maybe-goimapnotify-tls-options-configuration
   "TLS options for the IMAP connection."
   (serializer serialize-maybe-goimapnotify-tls-options-configuration))
  ;; ... omitted lines ...
  (prefix goimapnotify-))

list-of-goimapnotify-boxes-configurations

First we need a prefix to know if we have a list of goimapnotify-box-configuration objects, that one is simple:

(define (list-of-goimapnotify-boxes-configurations? lst)
  (and (not (null? lst))
       (every goimapnotify-box-configuration? lst)))

Now we need a serializer that knows how to handle a list of these objects:

(define (serialize-list-of-goimapnotify-boxes-configurations field-name value)
  (let ((serializations (cons 'list
                              (map (cut serialize-configuration <>
                                        goimapnotify-box-configuration-fields)
                                   value))))
    #~(begin
        (use-modules (ice-9 format) (ice-9 string-fun))
        (format #f "~a:
~{  - ~a~%~}"
                '#$(camelize-field-name field-name)
                (map (lambda (s)
                       (string-replace-substring s "\n" "\n    "))
                     #$serializations)))))

Looks a bit daunting, but it's just staged code, remember our earlier explanation of gexps. This code is only constructing a string with the shape we need.

As a reminder, we are serializing to YAML, that means that lists are prefixed by a - character. Following the Goimapnotify README, the indentation would be something like this:

boxes:
  - mailbox: INBOX
    onNewMail: 'mbsync examplenet:INBOX'
    onNewMailPost: SKIP
    onChangedMail: 'mbsync examplenet:INBOX'
  - mailbox: Junk
    onNewMail: 'mbsync examplenet:Junk'
    onNewMailPost: SKIP

This is what that format call is doing. Refer to Formatted-Output for more information.

We are only lacking a way to generate a complete configuration, remember that goimapnotify-configuration is an object for a single configuration. According to the README of Goimapnotify, the configuration file can take a list of configurations.

home-goimapnotify-configuration

This is the last configuration we will need, it will be used directly by the service:

(define-configuration home-goimapnotify-configuration
  (goimapnotify
   (file-like goimapnotify)
   "The @code{goimapnotify} package to use."
   empty-serializer)
  (configurations
   (list-of-goimapnotify-configurations)
   "A list of @code{goimapnotify-configuration} records which contain
information about all your accounts configurations."))

Simple enough, the first field is the Guix package that provides the goimapnotify program. This one is used by the service to start the process. Since it doesn't need to appear in any configuration file, we don't need to serialize it, hence the empty-serializer.

On last serializer:

(define (serialize-list-of-goimapnotify-configurations field-name value)
  (let ((serializations (cons 'list
                              (map (cut serialize-configuration <>
                                        goimapnotify-configuration-fields)
                                   value))))
    #~(begin
        (use-modules (ice-9 format) (ice-9 string-fun))
        (format #f "~a:
~{  - ~a~%~}"
                '#$(camelize-field-name field-name)
                (map (lambda (s)
                       (string-replace-substring s "\n" "\n    "))
                     #$serializations)))))

The rationale for this code is the same as the one explained for list-of-goimapnotify-boxes-configurations.

Defining the Shepherd service

The service definition; at last!

(define (home-goimapnotify-shepherd-service config)
  (let ((log-file #~(string-append %user-log-dir "/goimapnotify.log")))
    (list
     (shepherd-service
       (provision '(goimapnotify))
       (modules '((shepherd support)))   ;for '%user-log-dir'
       (documentation "Run a goimapnotify process")
       (start #~(make-forkexec-constructor
                 (list
                  #$(file-append
                     (home-goimapnotify-configuration-goimapnotify config)
                     "/bin/goimapnotify")
                  "-conf" #$(mixed-text-file "goimapnotify.yaml"
                                             (serialize-configuration config
                                                                      home-goimapnotify-configuration-fields)))
                 #:log-file #$log-file))
       (stop #~(make-kill-destructor))))))

Refer to Shepherd Services for more information on how to write Shepherd services. I will only highlight how to handle the configuration we just wrote.

We have already done all the hard work, the configuration declaration contains all the information needed to perform the serialization of the different fields to YAML, we just need to call serialize-configuration. For example:

scheme@(gnu home services mail)> (define test-config
  (home-goimapnotify-configuration
   (configurations
    (list
     (goimapnotify-configuration
      (host "test.example.com")
      (boxes
       (list
        (goimapnotify-box-configuration
         (mailbox "Test")))))))))

scheme@(gnu home services mail)> (serialize-configuration test-config home-goimapnotify-configuration-fields)
$6 = #<gexp  gnu/services/configuration.scm:165:2 7f3448e678a0>

That serialization gives a gexp ready to be wrapped in a file-like so it can be lowered to the store. That's what mixed-text-file is doing:

scheme@(gnu home services mail)> (mixed-text-file "goimapnotify.yaml"
                 (serialize-configuration test-config
                                          home-goimapnotify-configuration-fields))
$7 = #<<computed-file> name: "goimapnotify.yaml" gexp: #<gexp  guix/gexp.scm:2171:6 7f343915ef60> guile: #f options: (#:local-build? #t)>
scheme@(gnu home services mail)>

We've got ourselves a service, but there is one last thing before we go!

Defining the service type

As mentioned in the previous section, refer to Defining Services for what's going on here. The last thing we need do is declare the relation that this service has with respect to others:

(define home-goimapnotify-service-type
  (service-type
    (name 'home-goimapnotify)
    (extensions
     (list (service-extension home-shepherd-service-type
                              home-goimapnotify-shepherd-service)))
    (description "Configures the @code{goimapnotify} IMAP Mailbox notifier.")))

We did it!

Closing words

Still here? That was long... But here we are, we defined our complex configuration.

Congratulations on reading till the end, by this time you should already be an expert on defining Guix configurations.

We acknowledge that there are some improvements to do on the API for defining configurations. We would like to have a way to specify symbol mapping for field names in the declaration, so that serializers can be generalized better. It would also be nice if we could refactor some of our configuration definitions so the serializers that can be generalized are reused between declarations. After all, there are many configuration files in similar formats.

For all of these improvements, we are counting on you! I wrote this blog post to empower you to participate in the development. If this is something that resonates with you, come join the fun!

Call for talks aperta il 31 agosto 2026. Ventiquattresimo anno del gruppo, dodicesimo Linux Day irpino documentato.

Andy recently wrote that product quality is proportional to attention and code quality is inversely proportional to pressure. Is he right?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Andy recently wrote that product quality is proportional to attention and code quality is inversely proportional to pressure. Is he right?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Sean wonders about the best way to build a new platform and how opinionated it should be, and then Aaron and Shane think about buying a UPS.

Support us on patreon and get an ad-free RSS feed with some early episodes

Subscribe to the RSS feed.

Today marks the day of soft-launching of my Debian derivative, which I’ve been using on several of my own machines for the past year or so. This is still work in progress, but I wanted to establish a launch date of the project so below is the DiffOS manifesto as motivation for continued work.

DiffOS is For Freedom! DiffOS is the Debian Increment For Freedom Operating System.

• Aspire to the goals of GNU FSDG and become a recognized Free GNU/Linux distribution.
• Uses Debian GNU/Linux as upstream.
• Support for all architectures supported by Debian.
• Provide Containers, Cloud Images, LiveCD and installer ISOs.
• Provide standalone hosting of the package repository.
• Provide documentation and issue tracker.
• Keep changes to a minimal, in particular:
  • Upstream-first policy to prefer that any changes are made in Debian, and only if that fails they are considered for DiffOS.
  • Binary package re-use for as much as is possible.
  • Don’t modify any source-level Debian package unless REQUIRED by the FSDG (e.g., for freedom concerns) or REQUIRED by the Debian project (e.g., for branding reasons).
• Publish a list of packages that are added, removed or modified compared to Debian, with justification for each change.
• Publish Diffoscope-style outputs comparing our artifacts with comparable Debian artifact.
• Everything built from CI/CD pipelines, inspired by the Salsa CI pipeline but extended to cover the package repository and installation images as well, to allow modern GitSecDevOps of the entire supply-chain.
• Use inspiration from other Debian-derived FSDG distributions Trisquel GNU/Linux and PureOS, and broader with GNU Guix especially on how to approach existing freedom concerns in packages.
• Git Forge agnostic. While currently hosted on GitLab.com, scripts and configuration are (or will be) designed to allow setup on self-hosted GitLab instance, Codeberg.org or self-hosted Forgejo.
• Maintained by Humans – THE HUMAN MANIFESTO FOR THE AGE OF ARTIFICIAL INTELLIGENCE.

Happy Hacking!

Thanks to AI bug hunters, the Linux kernel is seeing record numbers of vulnerabilities, and it's overwhelming developers.

What to read into a study of long-term Backblaze hard drive failure data, why the difference between TB and TiB matters, and what to do about an overheating host bus adapter.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

ZFS vs Ceph: Choosing the Right Storage Architecture

News/discussion

Peer-reviewed study of 443,000 Backblaze hard drives ranks HGST most reliable and Toshiba the least — Analysis of 1.66 million drive-years finds Seagate and Toshiba HDDs fail at roughly twice the rate of WD and HGST

Changing Language for Storage Capacity

Free consulting

We were asked about an overheating host bus adapter.

GNU Parallel 20260822 ('Ceuta') has been released. It is available for download at: lbry://@GnuParallel:4

Quote of the month:

  Parallel has an option for almost everything, it's almost too much.
    -- tester457@ycombinator

New in this release:

• Replacement string: {%jq: jq-expression %}
• Use $^X when calling perl. So if different versions of perl are found in $PATH, we use the same version that started GNU Parallel.
• Bug fixes and man page updates.

GNU Parallel - For people who live life in the parallel lane.

If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.

About GNU Parallel

GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.

If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.

GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.

For example you can run this to convert all jpeg files into png and gif files and have a progress bar:

  parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif

Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:

  find . -name '*.jpg' |
    parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200

You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/

You can install GNU Parallel in just 10 seconds with:

    $ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
       fetch -o - http://pi.dk/3 ) > install.sh
    $ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
    12345678 c555f616 391c6f7c 28bf9380 44f4ec50
    $ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
    70727536 3428aa9e 9a136b9a 7296dfe4
    $ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
    83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
    b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
    $ bash install.sh

Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1

Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.

When using programs that use GNU Parallel to process data for publication please cite:

O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.

If you like GNU Parallel:

• Give a demo at your local user group/team/colleagues
• Post the intro videos on Reddit/Diaspora*/forums/blogs/ Identi.ca/Google+/Twitter/Facebook/Linkedin/mailing lists
• Get the merchandise https://gnuparall ... igns/gnu-parallel
• Request or write a review for your favourite blog or magazine
• Request or build a package for your favourite distribution (if it is not already there)
• Invite me for your next conference

If you use programs that use GNU Parallel for research:

• Please cite GNU Parallel in you publications (use --citation)

If GNU Parallel saves you money:

• (Have your company) donate to FSF https://my.f ... .org/donate/

About GNU SQL

GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.

The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.

When using GNU SQL for a publication please cite:

O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.

About GNU Niceload

GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.

o Fix minor groff warnings in manpages.
o Fix portability of building manpages.
o Fix minor bugs found by code analysis:
  - bmc-watchdog: Fix bug with --arp-response command line parsing.
  - ipmi/rmcpping: Fix bug with finding an IPv6 interface.
  - ipmidetect: fix bug in which hostname configs not used properly
  - ipmi-oem intelnm: fix parsing of hours/minutes error
  - ipmi-oem: Correct Dell CMC IPv6 autoconfiguration output.
  - ipmi-oem: Correct Dell iDRAC web server control output.
  - libipmidetect: Isolate partial results between fallback servers.
  - libipmidetect: Honor caller-provided hostnames over configured defaults.
  - common: Preserve stream state when finishing buffered output.
  - common: Fix buffer-output configuration parse issue.
  - common: Parse UTC offset configuration as an integer.
  - ipmiconsole: Monitor both console descriptors.
  - ipmiconsole: Check valid payload instance range correctly.
  - ipmi-sel: Honor post-clear after full tail output.
  - ipmi-fru: Report DIMM capacities in megabytes.
  - ipmi-chassis: Apply the Power-On Hours scale correctly.
  - libipmimonitoring: fix mem-leak on SEL iterator
  - libipmimonitoring: allow cipher suite 0 in configs
  - libipmimonitoring: report NO_SEL_RECORDS instead of
    NO_SENSOR_READINGS cut and paste errors in some functions.
o Fix potential stack overflows found by code analysis in ipmi-oem dell get-system-info command (specifically idrac-info, cmc-info, cmc-ipv6-info subcommands) and ipmi-oem fujitsu get-sel-entry-long-text.
o Fix potential stack overflow in libfreeipmi also related to Fujitsu long SEL entries.


https://ftp.gnu.o ... pmi-1.6.19.tar.gz

This is to announce automake-1.18.92, a beta release in preparation for automake-1.19.  Announcement:

https://lists.gnu ... -08/msg00000.html

unrtf 0.21.12 is released, fixing a serious recently submitted security issue.

Dear community

We have included in the GNU Health Code of Conduct the strict NO Generative Artificial Intelligence policy.

The current version reads:

GNU Health Strict No Generative Artificial Intelligence Policy

GNU Health is social project made by humans and for humans. We DO NOT accept any code, artwork, review, documentation or issues created by generative Artifical Intelligence (GenAI) / Large Language Models (LLMs).

The GNU Health no-AI policy is because we strongly believe that:

* GenAI is bad for Mother Nature
* GenAI is bad for human rights, especially for underserved and marginalized communities.
* GenAI is bad for the Free Software and Free Culture communities.
* GenAI is bad for you

Last but not least, GNU Health manages critical health information both at personal and population level. There must be a reasoning behind every single line of code. We make all the effort to minimize bugs that can jeopardize the integrity and security of the system, and we can not risk the project by putting it in hands of stochastic parrots.

Let’s keep the art and science of computing a human virtue.

You can read the entire, most current version of GNU Health Code of conduct here:
https://docs.gnuh ... ndix/conduct.html

So long as Linux is distributed under the GPL, MIT, BSD, and Apache licenses, the OS is  exempt from being required to verify the age of its users in California.

Flet lets you easily build real-time, cross-platform GUI apps using Python. We walk you through installing Flet to building your first interactive graphical application.

This month, we explore Hannah Montana Linux v26.0, RakuOS 2026.07.03, ArchBang Linux 010726, and Galactic Mandate Linux v00.

The flexibility of FOSS – and its open source nature – means it can address a number of issues, even beyond programming.

This month, we explore the top FOSS, including a stripped-down version of Brave, a lightweight audio player, and a command-line search utility.

A GUI application written in Go helps Mike Schilli select videos from his phone using animated thumbnails and get rid of the clutter.

This month in Linux Voice.

Use Octave to plot and run statistics on CSV files in as little as one line of code.

Object detection is easier than it used to be. We'll show you how to build an app that finds objects in medical images using the YOLOv8 model architecture.

The news gets weirder every day. It isn't hard to find something weird to write about, but the problem is that weird is the new normal, so the same old dystopian topics are starting to sound monotonous.

The powerful Opera GX browser has now come to Linux: Should gamers rejoice, or was this one port we could do without?

Despite its current bad rap, AI does have its uses. We'll show you how to best use some practical AI features in popular KDE apps.

Vosk lets you embed a simple voice decoder into your homegrown applications.

Install the KernelUNO firmware on your Arduino UNO R3 and get a Linux-like shell that lets you access files and talk to the GPIO pins. You can even extend the current feature set.

Running a shell on your Raspberry Pi Pico lets you use it like a classic Unix or MS-DOS workstation. All you need are basic filesystem commands – no C/C++ or Python skills required.

This innovative Linux distribution combines virtualization with the Tor network to deliver out-of-the-box privacy you won't find with the mainstream distros.

The AsteroidOS is designed to run on smartwatches, including several devices that are no longer supported by the original vendor.

In the news: The Linux Kernel Dev Staging Area Now Rejects AI-Generated Patches; Linux Surpasses Double-Digit Market Share; AI Helped Develop a Linux Exploit; Yet Another Linux Kernel Vulnerability Discovered; Ubuntu 26.10 to Include Ubuntu Certified Hardware Check; Substantial Update to IPFire Now Available; Gnome Working on Test Center App to Make Testing Easier; and New Vulnerability Discovered in Linux Kernel.

KDE has a new proper LTS and Joe is very interested, the Steam Frame is (really) nearly here, the Epic Games Store is coming to Linux, Nintendo continues to play whack-a-mole with Switch emulators, and GitHub’s serious scaling issues are getting ridiculous.

News/discussion

What a real LTS looks like: Kubuntu 26.04

Kubuntu Focus, Techpaladin Software, and KDE e.V. Announce the ‘bullet-proof’ KDE Software Initiative

New Frame welcome videos pushed to Steam Store assets

Epic Games Store Will Support Linux “Soon”

Nintendo Wipes Out 400+ Switch Emulator Repos in Single-Day GitHub Sweep

Fairphone 6 + PostmarketOS working main camera!

The August 17 GitHub outage, and the work ahead

Support us on patreon and get an ad-free RSS feed with some early episodes

• Versione: 1.2.28
• github
• Changelog
• Pagina originaria di Inter7

qmailAdmin è un software libero che fornisce un'interfaccia web per gestire sistemi qmail con domini virtuali basati su vpopmail. Fornisce amministrazione per la creazione/cancellazione di utenti, alias, forward, mailing list e autoesponder.

Changelog

• Aug 29, 2026
  - Bug fix: avoided to add translations from 400 to 450, as they are reserved strings for autoresponder's headers in #9. Thanks to ueli for spotting the bug.
• Nov 28, 2025 (v1.2.27)
  - Solved a compilation break on mailinglist.c when onchange is enabled in vpopmail a6395a9
  - --with-auth-log becomes --with-auth-logdir e6bdd48
  - Dropped VPOPMAIL_DEFS_H def in template.c 658eaa9
  - Revised the definition of PACKAGE and VERSION macros in several .c files 18abb99 bff23be
  - Functions file_exists() and str_replace() renamed to file_exists2() and str_replace2() on util.c because they are already defined in vpopmail bff23be
  - Fixed quick search button functionality (wasn't working well) bff23be
  - qmailadmin now requires vpopmail-5.6.11 a640c59
  - Solved undefined EZMLDIR and changing --enable-auth-log to --enable-auth-logdir in #5
  - Dropped a lot of br tags in lang files, fixed accents in italian language in #6
  - Dropped unusued --enable-help feature in configure in #7
  - mailinglist.c: if MySQL support is enabled mysql:localhost is the default host in #8
• Nov 8, 2025 (v1.2.26)
  - Improved the handling of program exit because of wrong configuration. This should avoid the unpleasant "blank screen" situation in some cases.
  * Configure program is now able to require a minimum vpopmail version 3846a52
  * Upgrade in auth-logging feature: added configurable auth log path via --with-auth-log=DIR (default ~vpopmail/log). Log file now written under vpopmail privileges instead of apache. 59e234d 04e2bf9 0c75b47 5f768b1
  * Added verbosity to the "File error" event #4

It’s the ten year old computer challenge! Can we daily drive a desktop or laptop from 2016? There’s only one way to find out!

Mike’s shitpost

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

• Info: https://github.com/qmail/simscan
• Chagelog
• John Simpson's simscan page (patch and a lot of info)
• README
• Versione: simscan-1.4.6.2
• Patch applicata (13 settembre 2023)

Simscan è un semplice programma che abilita il servizio qmail smtpd a rigettare virus , spam e a bloccare allegati durante la conversazione SMTP in modo da ridurre al minimo il carico per il sistema.

Dettagli sulla versione 1.4.6

Come si può notare, per comodità ho spostato i sorgenti di simscan nel mio spazio github. Ciononostante, tutte le informazioni riguardanti simscan continueranno a essere pubblicate qui, e questa è la pagina dove chiedere eventualmente supporto.

La versione 1.4.6 è un fork della version 1.4.1, che a sua volta aggiorna il programma originale di Inter7.

Nella versione 1.4.1 i sorgenti sono stati ripuliti e leggermente modernizzati (per evitare vari warming durante la compilazione), contegono varie correzioni di bug e patche, tra le quali quasi tutte quelle di John Simpson (l'unica mancante è la patch "debug" che applicheremo comunque, come mostrato sotto) e il bug fix di Gustavo Castro che era presente nella mia precedente patch combinata. Pertanto la versione 1.4.2 aggiunge solamente solo quanto segue:

• La debug patch di John Simpson, che consente di migliorare il debud a livello di qmail-smtpd (maggiori informazioni nel sito di jms);
• un bug fix di Bob Greco secondo il quale un messaggio ricevuto con destinatari locali multipli eseguiva spamc come utente null invece di estrarre il nome utente dal primo destinatario.
  Maggiori informazioni qui https://notes.sagredo.eu/en/qmail-notes-185/simscan-38.html#comment844

• La mia patch attachments-size-limit che consente di superare un limite di simscan per cui i messaggi con allegati di dimensione superiore a 250k non vengono passati a spamassassin. Questa patch consente di impostare la dimensione massima in byte attraverso la variabile size_limit nel file /var/qmail/control/simcontrol file. Inoltre, gli eventi dove simscan non viene attivato sono ora loggati (prima lo erano solo se il debug è attivo).

A TV station struggles to retrieve its data from the data centre company that a defunct intermediary used, why we don’t want AI to manage our networks (even if Microsoft thinks we should), and understanding vdevs, and datasets in ZFS.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

OpenZFS User and Developer Summit 2026 CfP is open until September 11

FreeBSD Security in Production: Vulnerability Response and Operational Best Practices

News/discussion

Nine PBS sues Iron Mountain over blocked access to archival data

Judge sets framework for Nine PBS to retrieve archival data

The patch window is collapsing: Why security needs a new control plane

Free consulting

We were asked about pools, vdevs, and datasets in ZFS.

35 years ago, a Finnish student began a humble project that would forever change the course of technology.

By Gilles Chehade

You change one line in a large file. Your “incremental” backup re-uploads the whole thing anyway.

Nine times out of ten, it’s not the network, and it’s not your storage backend. It’s the algorithm deciding where to cut your data into pieces.

Every deduplication system works the same way: split data into pieces, hash each piece, keep one copy per distinct hash. A piece is named after its own content, so two identical pieces are, by definition, the same piece. Snapshot a filesystem today and again tomorrow, and if most of the data hasn’t changed, most pieces are already in the store. The second snapshot costs you almost nothing.

That’s not a nice-to-have. A backup that actually survives an incident needs to be encrypted, frequent, immutable, replicated and verified, and each of those requirements multiplies what you store. When deduplication is weak, those multipliers stack until backing up everything becomes unaffordable, and teams quietly retreat to backing up only what they call “critical.” Good deduplication is what makes backing up everything affordable again.

And all of it rests on one assumption: unchanged data should yield unchanged pieces.

Where fixed-size chunking falls apart

The obvious way to split a file is to cut every N bytes. It’s fast. It also wrecks deduplication the moment you touch the file.

Add one byte near the front and every boundary after it slides over by one. Nothing lines up with where it used to be, so every hash downstream is “new,” so the store treats the entire rest of the file as fresh data. Edit one line in a 40 GB file and you re-upload close to 40 GB of it. Nothing meaningful changed, only the offsets did, and fixed-size boundaries are glued to offsets.

How content-defined chunking fixes it

Content-Defined Chunking (CDC) picks boundaries based on what the data is, not where it happens to sit.

Slide a small window over the byte stream and keep a rolling hash, cheap enough to update incrementally that the whole scan stays linear, then cut a boundary wherever that hash matches an agreed pattern.

Now insert a byte. The boundaries right around the edit shift. But once the window slides past the change, the hash sequence goes back to matching what it was before, and the boundaries fall back into place on their own. One piece changes. Everything else deduplicates cleanly against the previous snapshot. That self-resynchronizing behaviour is the whole point of CDC.

Picking an algorithm

There’s more than one way to build a rolling hash and a cut rule.

Rabin fingerprinting is the textbook original, correct but slow and allocation-heavy by today’s standards. FastCDC swapped the polynomial hash for a much cheaper Gear hash and normalized the chunk-size distribution, and it became the field’s workhorse. UltraCDC trades a bit of speed for fewer, larger chunks. JC is a newer design that turns out to be strikingly fast. There are also keyed variants, where the hash table is seeded from a secret so two different stores cut the same data at different points, which matters if you care about not leaking which chunks you hold.

We benchmarked these in go-cdc-chunkers, the open-source chunking library behind our backup engine, Plakar, on 1 GiB of random data, the worst case since there’s no structure to exploit. JC hits 3747 MB/s, comfortably ahead of the Gear-based FastCDC variants. Rabin runs about 7.5x slower and allocates roughly 3.3 MB per operation versus a few KB for the others, which on a busy host is the difference between a run you notice and one you don’t. Full benchmarks and charts are published separately.

Using it is trivial:

// One interface for the whole family.

c, _ := chunkers.NewChunker("jc", reader) // or "fastcdc", "ultracdc", "kfastcdc"

for {

    chunk, err := c.Next()

    // ... hash and store the chunk ...

    if err == io.EOF {

        break

    }

}

Determinism is the feature that matters most

Here’s the part that gets too little respect.

Give it enough time and “FastCDC” stops meaning one thing. Every implementation picks up small departures from the paper: a mask off by a bit, a window starting a byte early, a threshold nudged for taste. Harmless for a benchmark. For a storage system it’s a slow-motion disaster, because boundaries are part of your data’s identity. Change how you cut and yesterday’s pieces stop matching today’s, so deduplication degrades with no error and no warning. The store just grows faster than it should.

The fix is to publish spec-faithful, explicitly versioned variants and treat the version number as a promise: a given version cuts a given input the same way, on any machine, forever. Improvements ship under a new name people adopt on purpose, so nothing re-cuts existing data out from under anyone. Versioning also buys you cross-language conformance vectors, published inputs with expected boundaries that any implementation, in any language, can check itself against, byte for byte. That’s what turns “spec-faithful” from a claim into something you can actually test.

So whatever you pick, hold out for two things: a pinned, versioned spec of exactly how boundaries get computed, and published test vectors you can verify yourself. Speed is negotiable. Determinism isn’t.

Why we built this in the open

go-cdc-chunkers is open source for the same reason all of Plakar is. Backup is a trust problem before it is a technical one: you hand one system the single copy of your data meant to survive everything else, yet with most products you cannot read the code, review the cryptography, or verify the recovery path until the day you need it. Open source is the only honest answer I know, and it is the one I took from years on OpenSMTPD and OpenBSD: formats outlive vendors, a backup you cannot open in ten years is not a backup, and the community that reads the code is part of the security model.

Try it yourself

To see the deduplication effect directly, you can reproduce the experiment with an open source backup implementation that uses CDC. The following example uses Plakar.”

On macOS, brew install plakarkorp/tap/plakar; on any platform with Go 1.23.3 or newer, go install github.com/PlakarKorp/plakar@latest. Prebuilt binaries, apt and AUR packages for every platform are on the download page.

Create a local store (Plakar calls it a Kloset). It will prompt for a passphrase, since everything is encrypted before it touches disk:

plakar at $HOME/backups create

Now back up a directory:

plakar at $HOME/backups backup $HOME/Documents

The last line of the output tells you what happened:

info: backup: created unsigned snapshot dd62691d of size 6.4 KiB in 125ms (wrote 577 KiB)

Two numbers matter there: the logical size of what you backed up, and the bytes actually written to the store. Now the part that shows CDC working. Change one file, add a paragraph to a document, then run the exact same backup command again. You get a new, self-contained snapshot, but the bytes written the second time are a small fraction of the first, because every chunk that did not change was already in the store and is simply referenced rather than rewritten. Insert a few bytes at the top of a large file and the diagram above becomes concrete: the chunks after the edit resynchronise and deduplicate against the first snapshot instead of being stored again.

You can list snapshots, verify one is intact, then restore it somewhere else:

plakar at $HOME/backups ls

plakar at $HOME/backups check dd62691d

plakar at $HOME/backups restore -to $HOME/restored dd62691d

If you would rather look before installing anything, a public instance of the web UI runs at https://demo.plakar.io with real backups to browse.

Resources

It’s all open source: the chunking library is go-cdc-chunkers and the backup engine is Plakar, with the full v1.1.0 benchmarks published for anyone who wants to reproduce them.

Gilles Chehade is a long-time OpenBSD developer and the co-founding CTO of PlakarKorp. He created Plakar.io as a personal tool in 2015 before turning it into an open backup platform that gives security and infrastructure teams “resilience as code.”

The post Why Your Backups Are Too Big: A Practical Guide to Content-Defined Chunking appeared first on Linux.com.

To celebrate 400 episodes, we look back of the last (almost) ten years of positive Linux and FOSS news.

Plugs

Piss up at The Shipwrights Arms (just next to London Bridge station) on Saturday 5th September from 5pm until late

Support us on patreon and get an ad-free RSS feed with some early episodes

9.5 years of good news

Thunderbird Is Thriving: Our 2022 Financial Report (May 2023)

Asking for donations in Plasma (Aug 2024)

I think the donation notification works (Dec 2024)

Ubuntu 25.10 and Fedora 43 to drop X11 in GNOME editions (Jun 2025)

An update on the X11 GNOME Session Removal (Jun 2025)

GNOME Mutter Now “Completely Drops The Whole X11 Backend” (Nov 2025)

KDE Going all-in on a Wayland future (Nov 2025)

Give Fedora Silverblue a test drive (Sept 2018)

KDE Linux Alpha has been released (Sept 2025)

Introducing a new version of Steam Play (Aug 2018)

Steam Deck Launching February 25th 2022

Steam Machine, controller, VR headset incoming from Valve (Nov 2025)

Canonical Builds Steam Snap For Ubuntu ARM64 Leveraging FEX (Jan 2026)

Announcing WSL 2 (May 2019)

How one volunteer stopped a backdoor from exposing Linux systems worldwide (Apr 2024)

Linux has made it to Mars (Feb 2021)

Mars Helicopter Ingenuity will fly no more (Jan 2024)

Macros: are they a superpower, a necessary evil, or a mistake?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Macros: are they a superpower, a necessary evil, or a mistake?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Shane wants to make his homelab less janky so needs to decide on how to split up his compute and storage, plus some of the KVM over IP devices we own and how we use them.

Support us on patreon and get an ad-free RSS feed with some early episodes

Subscribe to the RSS feed.

Microsoft claims that Windows 11 will work well with 8GB of RAM, some of the innovations coming to high end SSDs, the arguments for TP-Link Omada over Ubiquiti UniFi.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

FreeBSD Support: Greatest Hits

Discussion

Microsoft says 8 GB of RAM should be enough for anyone running Windows 11

Windows quality: an update on the commitment we made in March

Free consulting

We were asked about the arguments for TP-Link Omada over Ubiquiti UniFi.

Guest hosts Chris from Linux After Dark and Sean from Hybrid Cloud Show tell Joe and Félim about bootc desktop Linux distros, how they build, deploy, and update them, and why this modern approach is so powerful. Plus another system information tool, cutting edge upscaling on the Steam Deck, and why Chris has switched to the KDE Plasma desktop.

Bootc desktops

bootc

Using Bootc to Manage Ubuntu Hosts

ubuntu-summit-26-demo

ubuntu-bootc 

Mono repository for all bootcrew images

How Steam Play/Proton makes Gaming on Linux Awesome

Discoveries

HWall

ProtonPlus

KDE Plasma desktop

Support us on patreon and get an ad-free RSS feed with some early episodes

I am happy to announce a new major release of GNU poke, version 5.0.

GNU poke 5.0 release is now available at
https://ftp.gnu.o ... e/poke-5.0.tar.gz

The tarball is signed and you can get the PGP signature at
https://ftp.gnu.o ... ke-5.0.tar.gz.sig

  GNU poke (http://www.j ... rch.net/poke) is an interactive, extensible
  editor for binary data.  Not limited to editing basic entities such
  as bits and bytes, it provides a full-fledged procedural,
  interactive programming language designed to describe data
  structures and to operate on them.

I'd like to thank everyone who contributed to this release through code,
documentation, or testing.

What is new in this release:

User interface updates

• Now hyperlink server can bind to a user-specified port for listening to

commands (-p, --hserver-port).

Poke Language updates

• Floating-point arithmetic is now supported on uint<32>/uint<64> types.

  uint<32> will be interpreted as a single-precision floating-point number
  and uint<64> will be interpreted as a double-precision floating-point
  number as defined per the IEEE 754 standard.
  The following expressions are now supported:

    - Addition:       a .+  b
    - Subtraction:    a .-  b
    - Multiplication: a .*  b
    - Division:       a ./  b
    - Ceil-devision:  a ./^ b
    - Exponentiation: a .** b
    - Remainder:      a .%  b
    - Post-increment: a.++
    - Pre-increment:  .++a
    - Post-decrement: a.--
    - Pre-decrement:  .--a
    - Negation:      .-a

    - Less-than:                a .<  b
    - Less-than-or-equal-to:    a .<= b
    - Greater-than:             a .>  b
    - Greater-than-or-equal-to: a .>= b
    - Equal-to:                 a .== b
    - Not-equal-to:             a .!= b

Poke Runtime updates

• Thanks to the great work of David Faust, poke now supports reactive IO

  spaces!  Extent of a PVM value mapped in a given IO space will be tracked
  and values will be re-mapped only if a write happens in their extent; which
  is a big performance win for read-intense programs.

• A bunch of undefined behavior (UB) releated to left-shifts has been fixed.

• Improved human-readable message of E_conv exception when verifying

  length/size of an array with dynamic bound(s) to help the user to
  understand the mistake.

Poke compiler updates

• Now poke can properly handle writes to nested integral struct/unions

  fields.  Previously write to nested fields of integral structs did not
  materialize in IO space.

Standard Poke Library updates

• Closure's pretty printer now adds closure's name (identifier) to output.

• Two new functions to calculate square root of single and double precision

  floating point numbers: sqrtf and sqrtd.
  They accept uint<32> and uint<64> respectively as the IEEE 754 single and
  double precision floating-point numbers.

libpoke updates

• Version of DSO is bumped to 2.0.0, and from this release onward, we try

  to not break the ABI, and bump the version components according to the
  libtool's recommendation (when needed).

• To be able to keep the ABI backward-compatibility promise, all public APIs

  are now accepting either pk_compiler or pk_val.  This is the first step
  toward removing global state from libpoke to be able to have multiple
  instances of libpoke in a single process (and also to be able to accomplish
  thread-safety). We're not there yet, but we'll be there some day (hopefully
  soon)!

IO subsystem updates

• IOS_F_TRUNCATE has been re-introduced (it was removed after release of

  poke 1.0 by the rationale that it's not that useful of a flag.  Turns
  out it's quite useful to start from an empty file when assembling binary
  files from scratch using poke.

Pickles updates

• Improved ustar pickle and add tests.  Method get_last_mod_time has been

  fixed and the following methods has been added:
  get_{file,owner_user,group}_name.

• Improved time pickle to print date and time properly (zero-padded), and

  also add ptime_str function to get date/time information as a string.

Platform supports

• We tried to improve MinGW compilation situation by importing more Gnulib

  modules, but we still cannot have poke executable for MinGW platform.
  Help is very much appreciated in this area!

Documentation updates

• Thanks to people who actually read the reference manual, this release

  includes a bunch of corrections to the documentation! Cheers to them!


Happy poking!
Mohammad-Reza Nabipoor

• Versione: 1.1.1
• Maggiori informazioni qui
• Howto (wiki)
• Manuale

Fail2ban ispeziona i log file (ad es. /var/log/apache/error_log) e banna IPs che mostrano un comportamento sospetto -- troppe password sbagliate, tentativi di  exploits, etc. Generalmente Fail2Ban è quindi usato per aggiornare le regole del  firewall al fine di rigettare gli indirizzi IP durante un intervallo di tempo settabile, benchè ogni altra azione (come l'invio di una mail di notifica) può anche altresì essere impostata. Tra le altre cose Fail2Ban mette a disposizione dei filtri per diversi servizi come apache, courier, ssh, etc.

Mostrerò brevemente come installare e configurare fail2ban per rigettare le connessioni di IP sospetti, specialmente quelli riguardanti la patch qmail-dnsrbl. Ciò evita di essere bannati noi stessi da spamhaus, che è gratuito solo fino a 100.000 query al giorno.

fail2ban richiede che si abbia un firewall come nftables o iptables attivo.

Changelog

• Aug 16, 2026
  - Fail2Ban upgraded to v. 1.1.1 (changelog)
• Nov 8, 2025
  - qmailadmin log file is now /home/vpopmail/log/qmailadmin-auth.log
• Mar 14, 2025
  - dovecot filter updated for dovecot 2.4

It’s a forced positivity episode! We all come up with some positive things to say about Linux and open source.

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

In a world where photos can no longer be trusted, Jim argues that we should move to a default distrust model where images are signed at every stage of the process of creation. We get into some of the potential issues. Plus how to ensure continuity for your clients in the event of your demise, and setting up a system to demonstrate ZFS replication capabilities.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

Piss up at The Shipwrights Arms (just next to London Bridge station) on Saturday 5th September from 5pm until late

Discussion

Google Earth risked ruin with retracted AI tool for making fake satellite pics

Apple is working on a way to authenticate that a photo came from an iPhone camera

Free consulting

We were asked about how to ensure continuity for your clients in the event of your demise, and setting up a system to demonstrate ZFS replication capabilities.

This is to announce wdiff-1.2.3, a stable release.

There have been 29 commits by 2 people in the 637 weeks since 1.2.2.

See the NEWS below for a brief summary.

Thanks to everyone who has contributed!
The following people contributed changes to this release:

  Bob Proulx (6)
  Simon Josefsson (23)

Happy Hacking,
Simon [on behalf of the wdiff maintainers]
==================================================================

Here is the GNU wdiff home page:
  https://www.gnu.org/software/wdiff/

Manual:
  https://www.gnu.org/software/wdiff/manual/
  https://www.gnu.org/software/wdiff/manual/wdiff.html - HTML format
  https://www.gnu.org/software/wdiff/manual/wdiff.pdf  - PDF format

Here are the compressed sources and a GPG detached signature:
  https://ftp.gnu.org/gnu/wdiff/wdiff-1.2.3.tar.gz
  https://ftp.gnu.org/gnu/wdiff/wdiff-1.2.3.tar.gz.sig

Here is minimal source-only "git archive" sources:
  https://ftp.gnu.org/gnu/wdiff/wdiff-v1.2.3-src.tar.gz
  https://ftp.gnu.org/gnu/wdiff/wdiff-v1.2.3-src.tar.gz.sig

Use a mirror for higher download bandwidth:
  https://www.gnu.org/order/ftp.html

Here are the SHA256 and SHA3-256 checksums:

  File: wdiff-1.2.3.tar.gz
  SHA256 sum:   29a4457eb0ed35c902e6732d71f25e1d6c7fe7fa0eda0fb6c371ed6779b49fd6
  SHA3-256 sum: 2f558fe6b7a69524f29d266c4018c80a10135cef2e4a53ae3c2944c1fc12c95d

  File: wdiff-v1.2.3-src.tar.gz
  SHA256 sum:   dc29d8f530471b9a8935413dca32e45848363f6e58888fc7307f5f052b8fb827
  SHA3-256 sum: 4db1f41eda5e1525f3ced491af1fc1ad094cc21c209e789d12a1ea8f611be24e

Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.

Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.

Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  gpg --verify wdiff-1.2.3.tar.gz.sig

The signature should match the fingerprint of the following key:

  pub   ed25519 2019-03-20 [SC]
        B1D2 BD13 75BE CB78 4CF4  F8C4 D73C F638 C53C 06BE
  uid   Simon Josefsson <simon@josefsson.org>

If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.

  gpg --locate-external-key simon@josefsson.org

  gpg --recv-keys 51722B08FE4745A2

  wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=wdiff&download=1' | gpg --import -

As a last resort to find the key, you can try the official GNU
keyring:

  wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
  gpg --keyring gnu-keyring.gpg --verify wdiff-1.2.3.tar.gz.sig

This release is based on the wdiff git repository, available as

  git clone https://https.git.savannah.gnu.org/git/wdiff.git

with commit 31fe62c4a3e2a76e5d68f571b1aa2f10815ca51f tagged as v1.2.3.

For a summary of changes and contributors, see:

  https://gitweb.git.savannah.gnu.org/gitweb/?p=wdiff.git;a=shortlog;h=v1.2.3

or run this command from a git-cloned wdiff directory:

  git shortlog v1.2.2..v1.2.3

This release was bootstrapped with the following tools:
  Gnulib 31fe62c4a3e2a76e5d68f571b1aa2f10815ca51f
  Autoconf 2.72
  Automake 1.17
  Make 4.4.1
  Makeinfo 7.3
  Help2man 1.49.2
  Tar 1.35
  Gzip 1.13

NEWS

* Noteworthy changes in release 1.2.3 (2026-06-30) [stable]

** Modernize build environment.
Several minor fixes including build fixes for modern C23 compilers.
Many generated or obsolete files have been removed from git.

Our favourite emoji, favourite vehicles, and whether we’d prefer to live in an icy or cold climate or an extremely hot one. With Félim, Gary, Jim, Allan, May, Shane from Hybrid Cloud Show, and special guest Shane from Linux Lads.

Reports of desktop Linux adoption numbers are probably exaggerated, the Steam Frame seemingly gets closer, Valve’s European logistics partner leaks people’s data, Proxmox gains Arm64 support, GNOME Boxes makes some changes, and a quick KDE Korner. With guest hosts Chris from Linux After Dark, and Sean from Hybrid Cloud Show.

News

Piss up at The Shipwrights Arms (just next to London Bridge station) on Saturday 5th September from 5pm until late

Linux Desktop Market Share Surpasses 10% in North America

Steam On Linux Use Back Above 4% In July

Valve may be putting the finishing touches to the Steam Frame software stack, because Lepton and FEX are now on Steam

Steam hardware shipper breach leaks customer data, including names and addresses

Proxmox Virtual Environment launches official Arm64 Support

Proxmox ports itself to Arm with help from Nvidia and Supermicro

Getting Started With Libvirt and Saltstack

Felipe Borges: The Future of GNOME Boxes

KDE Korner

This Month in KDE Linux: July 2026

This Quarter in KDE Digital Sovereignty: Q2 2026

Support us on patreon and get an ad-free RSS feed with some early episodes

GNU poke (http://www.j ... rch.net/poke) is an interactive, extensible
editor for binary data.  Not limited to editing basic entities such
as bits and bytes, it provides a full-fledged procedural,
interactive programming language designed to describe data
structures and to operate on them.

GNU poke 4.90 pre-release is now available at
https://alpha.gnu ... /poke-4.90.tar.gz

The tarball is signed and you can get the PGP signature at
https://alpha.gnu ... e-4.90.tar.gz.sig

The planned date for releasing 5.0 is Sunday 15 August 2026, but
this may change depending on the amount of problems found in this
pre-release, and the subsequent needed additional pre-releases.

Please report any problem found with the pre-release, comments or
patches to poke-devel@gnu.org.

In behalf of the poke developers, thank you!

Happy testing!
Mohammad-Reza Nabipoor

How deep should you go with your understanding of systems?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

How deep should you go with your understanding of systems?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

• Info: http://www.fehcom.de/ipnet/ucspi-tcp6.html
• Autore: Erwin Hoffmann. Le funzionalità IPv6 sono state incluse dalla IPv6 patch di Felix von Leitner. Il lavoro originale ucspi-tcp 0.88 da cui è derivato ucspi-tcp6 è di D.J. Bernstein
• Version: 1.13.08

TCP6_VER=1.13.08
cd /var/qmail/ 
wget https://www.fehcom.de/ipnet/ucspi-tcp6/ucspi-tcp6-${TCP6_VER}.tgz 
tar xzf ucspi-tcp6-${TCP6_VER}.tgz 
cd net/ucspi-tcp6-${TCP6_VER}/ 
./package/install

qmailctl reboot

The biggest homelab mistakes we’ve made, and what we learned from them.

Support us on patreon and get an ad-free RSS feed with early episodes sometimes

Subscribe to the RSS feed.

Changelog

• Oct 7, 2026 (v. 4.0.3)
  - sendmail bin determined by 'command -v', instead of using the sendmail shipped by qmail by default a20904b
• 25 luglio 2026 (v. 4.0) Script hook e documentazione sottostante completamente revisionati.
  - Aggiunto un nuovo script wrapper dehydrated-renew per eseguire il rinnovo del certificato e la sincronizzazione del servizio per SNI solo quando uno o più certificati sono effettivamente cambiati.
  - Introdotto un meccanismo di flag di modifica (dehydrated.changed) per evitare ricaricamenti e riavvii non necessari del servizio se un certificato è stato effettivamente distribuito.
  - Consolidate le operazioni post-rinnovo nella nuova funzione cert_sync(), fornendo un unico punto di ingresso per la sincronizzazione della configurazione dei certificati di qmail, Dovecot e Apache dopo i rinnovi riusciti. La stessa funzione cert_sync() può essere chiamata tramite uno script autonomo, che non coinvolge l'esecuzione di dehydrated. Ridotte le interruzioni non necessarie del servizio eseguendo la sincronizzazione una volta per ogni ciclo di rinnovo anziché una volta per ogni certificato rinnovato.
  - Il certificato qmail viene creato solo se è impostato MAKE_MAIL_CERTS=1. Se MAKE_MAIL_CERTS=0, lo script hook distribuisce solo i certificati (da utilizzare per il server web).
  - Le funzionalità Server Name Indication (SNI) per qmail e dovecot possono essere disabilitate impostando ENABLE_SNI=0 (impostazione predefinita).
  - Le voci ServerName e ServerAlias ​​per Apache e i domini SNI possono essere impostate facoltativamente con ENABLE_APACHE_SNI_CONF=1.

To enable HTTPS on your website, you need to get a certificate (a type of file) from a Certificate Authority (CA). Let’s Encrypt is a CA. In order to get a certificate for your website’s domain from Let’s Encrypt, you have to demonstrate control over the domain. With Let’s Encrypt, you do this using software that uses the ACME protocol which typically runs on your web host.

Microsoft restored an account including files that it initially claimed wasn’t possible, Apple might lock down phones if people don’t keep up their lease payments, ZFS scrubs shouldn’t be painful, and accessing another network from a locked-down work machine.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

ZFS vs Ceph: Do You Actually Need Ceph?

News/discussion

Microsoft restores player’s 25-year-old account following widespread backlash

iOS 27 code suggests Apple could restrict leased devices after missed payments

If Scrubs Hurt, Your ZFS Design Is Broken

Free consulting

We were asked about accessing another network from a locked-down work machine.

Teleport Community

Apache Guacamole®

Linux After Dark – Episode 120

The answer to bad AI-assisted contributions is not a purity test. It is better engineering discipline.

Earlier this year, a discussion in the GNUstep community raised a proposal that will sound familiar across the Free Software world: prohibit AI-generated code in core projects and proudly advertise the result as “coded by humans” or “AI-free.” The argument was not frivolous. Generative AI raises real questions about copyright, attribution, security, energy use, labor, trust, and the flood of low-quality patches that maintainers are increasingly being asked to review.

But a blanket refusal to use generative AI is the wrong response. It does not solve the hardest problems. It creates rules that are nearly impossible to define or enforce, confuses the method of production with the quality of the product, and risks turning Free Software into a movement that protects yesterday’s workflow instead of protecting software freedom.

Open Source and Free Software are already operating with too few maintainers, too much technical debt, and too many important projects resting on the unpaid labor of a handful of people. We should be very careful about categorically rejecting tools that might help contributors understand old code, write tests, improve documentation, port software, find defects, or perform mechanical modernization. We should be even more careful when our proposed alternative offers the appearance of trust without the substance of it.

The better principle is straightforward:

Regulate the code, not the development process.

“AI-generated” is not a workable boundary

What exactly counts as AI-generated code?

Is it a complete function produced from a prompt? A line accepted from an AI-powered autocomplete system? A compiler-suggested correction? An automated refactoring? A test generated from an existing implementation? A translation of documentation? A patch written by a human after asking a model to explain an unfamiliar API? What if the developer uses AI to identify the problem but writes every line manually? What if an IDE quietly includes machine-learning features the contributor never explicitly invoked?

The line between “human-written” and “AI-assisted” is already blurred, and it will become less distinct as generative features are embedded in editors, compilers, debuggers, search engines, and operating systems. A ban that cannot draw a stable boundary will be applied inconsistently. Honest contributors will disclose and be penalized; dishonest contributors will simply omit the disclosure. Others may be falsely accused because their code “looks generated.”

An “AI-free” badge therefore risks promising something a project cannot reliably prove. Free Software should be especially suspicious of unverifiable labels.

The risks are real—and they argue for review

None of this means generated code should be trusted.

Research has found substantial security weaknesses in AI-produced code. One empirical study of Copilot snippets found security problems in roughly 30 percent of Python snippets and 24 percent of JavaScript snippets in its later dataset. Other research has demonstrated that code models can memorize portions of their training data, while studies of license compliance have found that models often provide inaccurate licensing information, particularly for copyleft code. Those are serious concerns, not anti-AI superstition. (Security weaknesses study; memorization study; license-compliance study)

The productivity story is also more complicated than the advertising. GitHub reported that developers completed a controlled programming task considerably faster with Copilot, but a later randomized study of experienced Open Source developers working in their own repositories found that the tools available in early 2025 made them 19 percent slower. METR’s 2026 follow-up found suggestive but still statistically uncertain evidence of improvement with newer tools. AI is neither magic nor uniformly useless; its value depends on the person, task, model, and workflow. (GitHub productivity study; METR 2025 study; METR 2026 update)

But human authorship has never guaranteed secure, original, maintainable, or correctly licensed code. That is why healthy projects require tests, review, contributor certification, licensing rules, and maintainers who can reject bad work. The origin of a patch may affect how carefully we inspect it, but it cannot replace inspection.

If a contributor submits code they do not understand, the contribution should be rejected. If the patch fails tests, violates project style, invents APIs, introduces vulnerabilities, obscures provenance, or imposes an unreasonable review burden, it should be rejected. That is true whether the patch was produced by Claude, Copilot, a Stack Overflow answer, a contractor, a junior programmer, or a senior maintainer having a bad afternoon.

The repository contains code, not virtue.

Review capacity is the scarce resource

Maintainers have a legitimate complaint: AI can make producing a patch far cheaper than reviewing one. A person can generate thousands of lines in minutes and then expect a volunteer to spend hours establishing whether any of it is correct. That asymmetry can become a denial-of-service attack on a project even when the submitter means well.

The answer, however, is not necessarily to ban a tool. It is to place the cost and responsibility back on the contributor.

A project can require that contributors:

• disclose material use of generative AI;

• identify the tool and describe how it was used;

• certify that they reviewed and understand every submitted change;

• explain the design and answer maintainer questions without outsourcing the conversation to a model;

• provide focused tests and evidence that the patch solves a real problem;

• comply with the project’s licensing and provenance requirements;

• keep changes small enough to review; and

• accept that unexplained, low-signal, or mass-generated submissions may be closed without detailed triage.

Disclosure is imperfect, but it establishes a community norm and makes an honest contributor accountable. Research into self-declaration practices has already found developers using everything from a simple disclosure to records of prompts, explanations, and quality checks. Projects can choose a level proportionate to their risk. (Study of AI-code self-declaration)

This approach is stricter than either blind enthusiasm or symbolic prohibition. It does not say, “AI wrote it, so it must be acceptable.” It says, “You submitted it, so you are responsible for it.”

Freedom is not a reenactment of an older toolchain

Free Software is founded on the user’s freedom to run, study, modify, and share software. Those principles describe control over technology; they do not require that every developer use the same approved method to create it. The Open Source Initiative’s work on an Open Source AI Definition likewise frames the issue around the practical freedoms to use, study, modify, and share systems—not around preserving a pre-AI development ritual. (Open Source AI Definition 1.0)

There are valid reasons for preferring Free or locally operated AI tools over proprietary cloud services. A project may reasonably prohibit contributors from uploading confidential material or unreleased security fixes to third-party systems. It may impose stricter provenance requirements in sensitive components. Individual maintainers may decline to review bulk-generated reports that have repeatedly produced noise. These are concrete policies tied to concrete harms.

What does not follow is that a project becomes more free merely because no contributor used a generative tool.

An “AI-free” identity may even distract from the qualities that users actually need: portability, stability, compatibility, security, good documentation, responsive maintenance, and code whose behavior can be understood and changed. A badge is not a substitute for those things.

Blanket refusal has an opportunity cost

Mature Free Software projects often contain decades of code and institutional knowledge. They need documentation, regression tests, API audits, build-system repairs, platform ports, translations, issue triage, and repetitive modernization. Generative AI will not perform those jobs reliably on its own. It can still help a knowledgeable contributor perform some of them.

Rejecting that possibility at the policy level has consequences. It may discourage younger contributors whose development environment already includes these tools. It may disadvantage people working in a second language or developers with disabilities who use AI as an accessibility aid. It may prevent experiments that would have failed harmlessly—or succeeded usefully—under ordinary review. Most dangerously, it can encourage a culture in which the declaration “human-written” is treated as evidence of quality.

Free Software has survived previous waves of automation. High-level languages, garbage collection, IDEs, graphical interface builders, code generators, automated formatters, static analyzers, and online code search all changed what it meant to “write” software. Each tool altered the division of labor between programmer and machine. The relevant question was never whether every token originated in a human mind. The question was whether people retained the freedom, knowledge, and responsibility needed to control the resulting system.

That remains the right question now.

A policy that protects projects without freezing them

A sensible policy can fit on one page:

1. Disclosure: Contributors must disclose material AI assistance in the commit message or pull request.

2. Responsibility: The named human contributor is the author of record and must understand, explain, test, and stand behind the entire submission.

3. Quality: AI-assisted contributions receive the same requirements for correctness, security, maintainability, style, documentation, and test coverage as any other contribution.

4. Provenance: Contributors must have a reasonable basis to believe the submission is license-compatible and must identify known sources or generated passages that may reproduce existing code.

5. Data protection: Project secrets, embargoed vulnerabilities, private communications, and other restricted material may not be submitted to unauthorized external services.

6. Reviewability: Maintainers may reject oversized, unexplained, repetitive, or low-signal submissions without performing free forensic work for the submitter.

7. Local discretion: Components with unusual legal, safety, privacy, or reliability risks may adopt additional written restrictions.

This policy does not resolve every ethical question surrounding generative AI. No contribution policy can. It does, however, address the matters a software project can actually evaluate and enforce.

We should not surrender the future of software freedom

The Free Software community should remain one of the sharpest critics of concentrated corporate power, opaque models, exploitative data practices, environmental cost, and systems that deprive users of control. Criticism is part of our job. So is building an alternative.

If we define ourselves by refusing to touch an important new class of technology, proprietary vendors will shape that technology without us. If instead we insist on transparency, modifiability, privacy, local control, licensing clarity, and human accountability, we can bring the values of Free Software into the AI era.

We do not need to pretend that generative AI is trustworthy. We need processes that do not require us to trust it.

Judge the patch. Demand disclosure. Require understanding. Enforce licensing. Protect reviewers. Reject garbage.

But do not hobble Open Source and Free Software with a blanket ban that is difficult to define, impossible to verify, and disconnected from the quality of the code we ultimately ship.

Initial Steam Machine reviews are broadly positive, Jellyfin is losing some key project leaders, Sony deletes more movies that people “bought”, why you probably shouldn’t wipe your phone when the US authorities ask for access, Graham repurposes some discarded crypto hardware to play arcade games, Félim gets that old game working, a great terminal music player, and more.

News

Steam Machine with SteamOS Linux – initial thoughts

Jellyfin Project Leadership Changes

Sony Deletes A Bunch More Movies From The Accounts Of People Who ‘Bought’ Them

US government targets Cop City protester over phone operating system

David Potter, the man who put Psion in the palm of your hand, logs off at 82

Discoveries

AMD BC250 Documentation

Cholo

kew

Screenshot of kew in action

Support us on patreon and get an ad-free RSS feed with some early episodes

We got a lot of feedback about choosing a distro for the friends and family we support, but a lot of suggestions didn’t make sense to us. We get into why we pick boring and safe choices instead of interesting and exciting ones.

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

Google wants you to use a selfie video for account recovery, LG will stop apps turning their smart TVs into residential proxy nodes, we disagree about how serious OpenAI’s agent hacking Hugging Face is, FreeBSD removes the last bits of GPL software and suffers an embarrassing git flub , and backing up to an encrypted NAS without ZFS.

Plug

Support us on patreon and get an ad-free RSS feed with some early episodes

News/discussion

Introducing selfie for sign-in: a new, easy way to access your Google Account

LG to Ban Residential Proxies from Smart TV Apps

OpenAI says its AI agent broke out of testing sandbox to hack Hugging Face

FreeBSD 16 Retires The Last Of Its GPL Code From Its Base System

Ports Repository Freeze

Free consulting

We were asked about backing up to an encrypted NAS without ZFS.

With several open source figures taking a stance on either side of the generative AI debate, we have another argument about it. This time we actually come to something closer to an understanding of each other’s views, even if we still end up disagreeing.

News/discussion

Piss up at The Shipwrights Arms (just next to London Bridge station) on Saturday 5th September from 5pm until late

“Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it”

Protecting our FLOSS commons from LLMs

General Resolution: LLM usage in Debian

Support us on patreon and get an ad-free RSS feed with some early episodes

The GNU C Library
=================

The GNU C Library version 2.44 is now available.

The GNU C Library is used as the C library in the GNU system and
in GNU/Linux systems, as well as many other systems that use Linux
as the kernel.

The GNU C Library is primarily designed to be a portable
and high performance C library.  It follows all relevant
standards including ISO C23 and POSIX.1-2024.  It is also
internationalized and has one of the most complete
internationalization interfaces known.

The GNU C Library website is at http://www.gnu. ... /software/libc/

Packages for the 2.44 release may be downloaded from:
        http://ftpmirr ... .gnu.org/libc/
        http://ftp.gn ... org/gnu/libc/

The mirror list is at http://www.gnu. ... /order/ftp.html

Distributions are encouraged to track the release/* branches
corresponding to the releases they are using.  The release
branches will be updated with conservative bug fixes and new
features while retaining backwards compatibility.

NEWS for version 2.44
=====================

Major new features:

• System-wide tunables can be applied using /etc/tunables.conf and

  running ldconfig.  Specific tunable settings and the
  /etc/tunables.conf file format and path are not part of the stable
  library interfaces and may change between releases.

• A new tunable, glibc.elf.thp, is added to map read-only segments with

  Transparent Huge Pages (THP) if THP is not disabled in the kernel.  When
  glibc.elf.thp is set to 1, malloc uses the actual kernel THP mode
  instead of defaulting to madvise mode and madvise_thp will stop issuing
  MADV_HUGEPAGE if kernel THP mode is always.

• The THP page size in malloc is capped to MAX_THP_PAGESIZE.  If the THP

  page size is above MAX_THP_PAGESIZE, THP in malloc is disabled.

• Additional optimized and correctly rounded mathematical functions have

  been imported from the CORE-MATH project, in particular cosh, sinh, and
  tanh.

• Many additional improvements to existing functions have been synchronized

  from the CORE-MATH project.

• For C++26, the assert macro is now variadic, allowing more complex

  arguments containing commas (which however still must evaluate to a single
  value).

• The SVID error handling for cosh and sinh was moved to compatibility

  symbols, allowing improvements in performance.

• Static PIE is now supported for arm-*-linux-gnueabi.  It requires toolchain

  support to correctly set the expected linker options.

• On AArch64 targets that support the Guarded Control Stack extension all GCS

  operations (including status, write on shadow stack, and push to shadow
  stack) are locked after enabling GCS with ENFORCED or OVERRIDE GCS policy.
  When a GCS operation is locked, a program cannot change this operation
  status via the prctl syscall.  This prevents disabling or corrupting the
  GCS shadow stack during runtime.

• On AArch64 targets, log, exp, sin, cas, sinh, cosh, asinh, acosh, atanh

  single and double precision special cases have been vectorized for SVE and
  AdvSIMD, and vector variants of powr have been added.

• On RISC-V targets, vector extension optimized variants of memcmp, memccpy,

  memchr, memcpy, memmove, stpncpy, strcmp, strchr, strcpy, strncmp, strncpy,
  strlen, and strrchr have been added.

• On PowerPC, memchr optimized for Power10 has been re-added.

• Support for LoongArch32 has been added.

• Pre-built ld.so.cache files can be installed with ldconfig.

• A new locale has been added: hrx_BR (Hunsrik language spoken in Brazil).

Deprecated and removed features, and other changes affecting compatibility:

• Although malloc and related functions currently return pointers

  aligned to alignof (max_align_t), the documentation now says future
  versions of glibc may relax alignment requirements for small allocations.
  For example, a future malloc(1) might return a pointer with odd
  alignment, because no object of size 1 can have a fundamental
  alignment greater than 1.

• The s390-linux-gnu (31bit) configuration is no longer supported.

• The --enable-memory-tagging configure option has been removed.

  The corresponding AArch64-specific functionality that was previously
  activated by this flag has been removed as well.

• The --enable-static-nss configure option has been removed.  It had no

  effect on the build since the NSS reorganization in glibc 2.33; its only
  remaining behavior was to suppress the link-time warnings on the NSS
  interface functions in libc.a, which are now emitted unconditionally.

Security related changes:

The following CVEs were fixed in this release, details of which can be
found in the advisories directory of the release tarball:

  GLIBC-SA-2026-0005:
    gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS
    response (CVE-2026-4437)

  GLIBC-SA-2026-0006:
    gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames
    (CVE-2026-4438)

  GLIBC-SA-2026-0007:
    iconv crash due to assertion failure with untrusted input
    (CVE-2026-4046)

The following bugs were resolved with this release:

  [2363] libc: EOPNOTSUPP and ENOTSUP in errno.h must be different,
    according to SUSv3
  [3794] manual: iconv: TRANSLIT and IGNORE feature not documented
  [15792] dynamic-link: [arm] ARM dynamic linker should save/restore
    coprocessor registers
  [20331] libc: fts ignores errors from readdir()
  [20680] dynamic-link: ifunc resolver cannot access the thread pointer
    with static linking
  [22944] libc: fts cannot traverse paths which have a length longer
    than USHRT_MAX
  [25257] libc: sotruss: fix error message for '--f' argument
  [25770] locale: newlocale memory leak in LOCPATH parsing and on error
    paths
  [27582] libc: x86_64: IFUNC in static user programs may crash when
    built with -fstack-protector-all
  [28218] dynamic-link: ld.so: ifunc resolver calls a lazy PLT. When
    does it work?
  [28817] libc: static-pie ifunc resolver tls failure
  [28940] nss: __nss_database_get doesn't check for allocation failure
  [30136] manual: Please document behaviour of iconv(3) when input is
    untranslatable
  [30304] nptl: nptl/tst-pthread-gdb-attach test fails with new libc
    shared library version
  [30769] malloc: malloc_trim is not working correctly for arenas other
    than arena 0
  [30976] dynamic-link: rtld: resolve ifunc relocations after
    JUMP_SLOT/GLOB_DAT/etc
  [30992] libc: alpha: setrlimit() with negative values besides
    RLIM_INFINITY returns EPERM
  [31901] libc: elf/tst-glibc-hwcaps-prepend-cache fails on i686
  [33226] math: math-vector-fortran.h vs not ffast-math
  [33626] libc: execvpe should skip inaccessible $PATH components
  [33650] build: abilist.awk doesn't handle unversioned defined symbols
  [33785] stdio: New streams are linked into global list before they are
    fully initialized
  [33848] build: Build fails at openat2.h, redefinition of 'struct
    open_how'
  [33882] libc: Recursion in nftw() causes stack overflow(CWE-674)
  [33904] build: error: '__vasprintf_chk' undeclared here
  [33921] build: Building with Linux-7.0-rc1 errors on OPEN_TREE_CLONE
  [33935] stdio: _IO_wfile_doallocate not linked correctly when linking
    glibc statically
  [33980] locale: iconv: ibm139x trigger assertion error when converting
    to internal while lack enough room (CVE-2026-4046)
  [33985] build: ld: cannot find -lgcc_s: No such file or directory
  [33999] stdio: libio: potential dangling _IO_save_base or memory leak
    in wgenops.c
  [34006] stdio: libio: inconsistent fmemopen_write behavior on last \0
  [34008] stdio: stdio-common: scanf %mc pattern will cause heap
    overflow when width > 1024
  [34014] nss: gethostbyaddr and gethostbyaddr_r may incorrectly handle
    DNS response
  [34015] nss: gethostbyaddr and gethostbyaddr_r return invalid DNS
    hostnames
  [34019] stdio: libio: undefined behavior when setbuf on open_memstream
  [34033] network: resolv/ns_print.c: ns_sprintrrf TSIG path bypasses
    buflen and can overflow caller buffer
  [34064] dynamic-link: The unnecessary PT_NOTE check in when loading a
    binary
  [34069] network: Buffer overread in ns_sprintrrf with corrupted RDATA
    field (CVE-2026-6238)
  [34070] hurd: Calling open ("/dev/tty/", O_RDONLY) causes the program
    to segfault
  [34073] regex: regexec can mistakenly match with backrefs and the $
    anchor
  [34079] dynamic-link: THP segment load aligns all PT_LOAD segments to
    THP page size
  [34080] dynamic-link: Support THP segment load with THP enabled with
    madvise
  [34083] dynamic-link: __get_thp_mode and __get_thp_size are called
    twice
  [34090] libc: wordexp WRDE_APPEND rollback restores stale we_wordv,
    leading to invalid free in wordfree
  [34098] libc: Missing SUPPORT_STATIC_PIE in arm32
  [34129] string: x86: Non-temporal memset unreachable on AMD Zen 3/4/5
  [34144] libc: ld.so clobbers VFP registers during runtime linking
  [34154] network: Segfault in sock_eq after res_init() returns -1, due
    to stale _u._ext.nscount in __res_iclose
  [34156] dynamic-link: dlsym(RTLD_DEFAULT, ...) from a constructor
    SIGSEGVs when tail-called
  [34164] dynamic-link: elf: IFUNC resolvers do not see static TLS
    initialization
  [34170] dynamic-link: elf:  IFUNC resolver reading global-
    dynamic/TLSDESC __thread variable crashes inside __tls_get_addr
  [34183] math: fma produces wrong results
  [34192] nptl: pthread_setname_np opens /proc/<tid>/comm with O_RDWR
    instead of O_WRONLY|O_CLOEXEC
  [34196] libc: elf: static dlopen: pointer guard of the loaded
    ld.so/libc.so is left uninitialized
  [34197] dynamic-link: elf: Stack canary and pointer guard are
    recoverable from AT_RANDOM (getauxval)
  [34205] libc: aarch64: SIGSEGV in tunable_strcmp in static-pie
    binaries run with a string tunable
  [34208] stdio: scanf not pushback after matching failure
  [34210] libc: elf/tst-glibc-hwcaps-prepend-cache fails on
    armv7a-unknown-linux-gnueabihf
  [34236] locale: Non-representable transliteration still causes iconv
    to exit with 1 if TRANSLIT is specified
  [34289] network: ns_sprintrrf uses p_class, p_type internally
  [34311] build: THP tests failed to link
  [34347] libc: Incorrect trailing bitfield word of struct tcp_info
  [34348] dynamic-link: FAIL: elf/tst-thp-1 if THP is disabled in kernel
  [34351] build: Random test failures
  [34355] build: [2.44 Regression] "make check -j7 subdirs=stdio-common"
    no longer works
  [34396] libc: sparc64-unknown-linux-gnu , Gentoo: >200 test failures,
    SIGILL in many binaries
  [34398] string: Truncated strncpy on s390x z900 ifunc variant

Release Notes
=============

https://sourcewar ... wiki/Release/2.44

Contributors
============

This release was made possible by the contributions of many people.
The maintainers are grateful to everyone who has contributed
changes or bug reports.  These include:

Adam Yi
Adhemerval Zanella
Alejandro Colomar
Andreas K. Hüttel
Andreas Schwab
Arjun Shankar
Aurelien Jarno
Avinal Kumar
Brian Jorgensen
Carlos O'Donell
Carlos Peón Costa
Charlotte Mcmenamin
Collin Funk
Cosmina Dunca
DJ Delorie
Daan De Meyer
Deng Jianbo
Dev Jain
Diego Nieto Cid
Dmitry Kovalenko
Dylan Fleming
Etienne Brateau
Fabian Rast
Florian Weimer
Frédéric Bérat
Garccez
George Hu
H.J. Lu
Jakub Jelinek
Jiamei Xie
Jiho Lee
Jiri Stransky
John David Anglin
Jonathan Wakely
Josef Johansson
Joseph Myers
Justus Winter
Luca Boccassi
Lucas Chollet
Martin Coufal
Matt Turner
Michael Ford
Michael Jeanson
Michael Kelly
Mike FABIAN
Mike Kelly
Muhammad Kamran
Nicolas Boulenguez
Paul Eggert
Peter Bergner
Peter Collingbourne
Petr Menšík
Pierre Blanchard
Pino Toscano
Pádraig Brady
Richard Wild
Rocket Ma
RyotaSaito
Sachin Monga
Sajan Karumanchi
Sam James
Samuel Balazi
Samuel Thibault
Sana Kazi
Sergey Kolosov
Shamil Abdulaev
Shengwen Cheng
Siddhesh Poyarekar
Stefan Liebler
Thomas Daubney
Tomasz Kamiński
Uros Bizjak
WANG Rui
Weihong Ye
Weixie Cui
Wilco Dijkstra
Xi Ruoyao
Xiang Gao
Yao Zihong
Yunze Zhu
Yury Khrustalev
Zihong Yao
mengqinggang
xiejiamei
zombie12138

We would like to call out the following and thank them for their
tireless patch review:

Adhemerval Zanella
Andreas K. Hüttel
Arjun Shankar
Aurelien Jarno
caiyinyu
Carlos O'Donell
Collin Funk
DJ Delorie
Florian Weimer
Frédéric Bérat
Ganesh Gopalasubramanian
H.J. Lu
JiangNing
Mathieu Desnoyers
Paul Eggert
Paul Zimmermann
Peter Bergner
Sam James
Samuel Thibault
Siddhesh Poyarekar
Stefan Liebler
Sunil K Pandey
Wilco Dijkstra
Yury Khrustalev

Does language choice actually matter?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

Does language choice actually matter?

Support us on Patreon and get an ad-free RSS feed with early episodes sometimes

See our contact page for ways to get in touch.

Subscribe to the RSS feed

It’s another hot questions episode! Tech we’d use if we rebuilt everything from scratch, career advice to our past selves, how much of our jobs we could do from our phone, and the qualities we’ve seen in great managers.

Support us on patreon and get an ad-free RSS feed with early episodes sometimes

Subscribe to the RSS feed.

A new HTTP caching standard looks promising but might struggle to get adopted, a terrible space mirror idea is actually happening, cars will spy on us all, and picking a VPN for use with an IP that doesn’t change very often.

Plug

Support us on patreon and get an ad-free RSS feed with some early episodes

News/discussion

HTTP gets a QUERY method so complex searches can stop pretending to be POST

FCC grants approval for sun-reflecting space mirror that’s been widely criticized by astronomers

Feels like all of us need to pay way more attention to the new rules affecting EU and US folk, requiring all new cars to include a driver monitoring camera aimed at your face

Free consulting

We were asked about picking a VPN for use with an IP that doesn’t change very often.

Los próximos días 5, 6 y 7 de agosto tendrán lugar las XVII Jornadas Nacionales de Debate Interdisciplinario en Salud y Población “Investigar e intervenir en salud en tiempos de negacionismos y retrocesos”, organizadas por el Área de Salud y Población del Instituto de Investigaciones Gino Germani de la Facultad de Ciencias Sociales de la Universidad de Buenos Aires (UBA).

Luis Falcón (GNU Solidario) junto al Dr. Fernando Sassetti (UNER) presentarán en la sección "Desigualdades Sociales de la Salud", con el título "Software Libre como modelo de equidad, privacidad, soberanía tecnológica y sostenibilidad en salud. El caso de GNU Health".

Para la comunidad de GNU Health es un privilegio y un honor ser parte de este tan importante evento que lucha por la dignidad del individuo y de la comunidad, por un sistema sanitario público, de calidad y universal. Un sistema y un derecho hoy seriamente  comprometido y amenazado por las grandes corporaciones financieras y tecnológicas.

Haciendo alusión al título de las jornadas, la comunidad GNU y la filosofía del Software Libre representan el faro moral para Investigar e intervenir en salud en tiempos de negacionismos y retrocesos.

¡Nos vemos en Buenos Aires!

A new security release was published today! A minor Out-of-bounds Read was discovered. And fixed!

No confidential impact is possible.
A very low risk of crash is possible.

Enjoy & update!
Aymeric

GNU Parallel 20260722 ('Chat Control')  has been released. It is available for download at: lbry://@GnuParallel:4

Quote of the month:

  gnu parallelすごい！！！
    -- たらたら@nosennyuu@twitter

New in this release:

• Bug fixes and man page updates.

GNU Parallel - For people who live life in the parallel lane.

If you like GNU Parallel record a video testimonial: Say who you are, what you use GNU Parallel for, how it helps you, and what you like most about it. Include a command that uses GNU Parallel if you feel like it.

About GNU Parallel

GNU Parallel is a shell tool for executing jobs in parallel using one or more computers. A job can be a single command or a small script that has to be run for each of the lines in the input. The typical input is a list of files, a list of hosts, a list of users, a list of URLs, or a list of tables. A job can also be a command that reads from a pipe. GNU Parallel can then split the input and pipe it into commands in parallel.

If you use xargs and tee today you will find GNU Parallel very easy to use as GNU Parallel is written to have the same options as xargs. If you write loops in shell, you will find GNU Parallel may be able to replace most of the loops and make them run faster by running several jobs in parallel. GNU Parallel can even replace nested loops.

GNU Parallel makes sure output from the commands is the same output as you would get had you run the commands sequentially. This makes it possible to use output from GNU Parallel as input for other programs.

For example you can run this to convert all jpeg files into png and gif files and have a progress bar:

  parallel --bar convert {1} {1.}.{2} ::: *.jpg ::: png gif

Or you can generate big, medium, and small thumbnails of all jpeg files in sub dirs:

  find . -name '*.jpg' |
    parallel convert -geometry {2} {1} {1//}/thumb{2}_{1/} :::: - ::: 50 100 200

You can find more about GNU Parallel at: http://www.gnu ... rg/s/parallel/

You can install GNU Parallel in just 10 seconds with:

    $ (wget -O - pi.dk/3 || lynx -source pi.dk/3 || curl pi.dk/3/ || \
       fetch -o - http://pi.dk/3 ) > install.sh
    $ sha1sum install.sh | grep c555f616391c6f7c28bf938044f4ec50
    12345678 c555f616 391c6f7c 28bf9380 44f4ec50
    $ md5sum install.sh | grep 707275363428aa9e9a136b9a7296dfe4
    70727536 3428aa9e 9a136b9a 7296dfe4
    $ sha512sum install.sh | grep b24bfe249695e0236f6bc7de85828fe1f08f4259
    83320d89 f56698ec 77454856 895edc3e aa16feab 2757966e 5092ef2d 661b8b45
    b24bfe24 9695e023 6f6bc7de 85828fe1 f08f4259 6ce5480a 5e1571b2 8b722f21
    $ bash install.sh

Watch the intro video on http://www.youtub ... L284C9FF2488BC6D1

Walk through the tutorial (man parallel_tutorial). Your command line will love you for it.

When using programs that use GNU Parallel to process data for publication please cite:

O. Tange (2018): GNU Parallel 2018, March 2018, https://doi.org/1 ... 81/zenodo.1146014.

If you like GNU Parallel:

• Give a demo at your local user group/team/colleagues
• Post the intro videos on Reddit/Diaspora*/forums/blogs/ Identi.ca/Google+/Twitter/Facebook/Linkedin/mailing lists
• Get the merchandise https://gnuparall ... igns/gnu-parallel
• Request or write a review for your favourite blog or magazine
• Request or build a package for your favourite distribution (if it is not already there)
• Invite me for your next conference

If you use programs that use GNU Parallel for research:

• Please cite GNU Parallel in you publications (use --citation)

If GNU Parallel saves you money:

• (Have your company) donate to FSF https://my.f ... .org/donate/

About GNU SQL

GNU sql aims to give a simple, unified interface for accessing databases through all the different databases' command line clients. So far the focus has been on giving a common way to specify login information (protocol, username, password, hostname, and port number), size (database and table size), and running queries.

The database is addressed using a DBURL. If commands are left out you will get that database's interactive shell.

When using GNU SQL for a publication please cite:

O. Tange (2011): GNU SQL - A Command Line Tool for Accessing Different Databases Using DBURLs, ;login: The USENIX Magazine, April 2011:29-32.

About GNU Niceload

GNU niceload slows down a program when the computer load average (or other system activity) is above a certain limit. When the limit is reached the program will be suspended for some time. If the limit is a soft limit the program will be allowed to run for short amounts of time before being suspended again. If the limit is a hard limit the program will only be allowed to run when the system is below the limit.

Some of the tech from early on in our lives that inspired where we are today. Plus discoveries including and old game that doesn’t work, professional audio hardware that now works on Linux, Arch on easy mode, and an old chip that can do a surprising amount.

Discoveries

Celebrating 55 years of the 555 timer chip (flashing alert)

open-apollo

Ovine

EndeavourOS

Support us on patreon and get an ad-free RSS feed with some early episodes

Hello and welcome to another Qoth! Here's what's been happening in Q2 of 2026!

Joshua Branson added a pretty cool svg logo for our ethernet multiplexor. He built that image with Inkscape whilst using a Hurd laptop (Thinkpad 420) running on real iron! The Hurd wiki could certainly use more artwork. Perhaps you have a favorite Hurd translator that you believes needs some artwork!

Sergey Bugaev announced his WIP 9pfs (source code), and it has a wiki page! He writes:

Some years ago, I experimented with implementing a 9P translator for
the Hurd. Hopefully there is no need to tell this list what 9P is :)

Besides just browsing files on the few existing servers out there, a
potential use case is virtio-9p, to enable shared directory trees
between VMs and the host. But that would need someone to implement
virtio support in the Hurd.

I wanted to complete 9pfs before publishing, but that ultimately
didn't happen, so now it's time to turn it over to the community. I
now went and made the repository public on GitHub:
https://github.com/bugaevc/9pfs

What's implemented is basic browsing (readdir, stat), path resolution
(dir_lookup), and reading files (io_read). And below that, the whole
tracking for nodes, peropens, protids, fids, tags, and 9p RPCs.

Improvements are welcome, send patches to this list with [PATCH 9pfs]
in the subject. A good starting point would be to continue porting
things that I had implemented in the old netfs-based version (see
netfs.c) but didn't yet port to the new one.

He then got a little more motivated, and he added some write support!

Etienne Brateau added validation to msync, so that the Hurd better follows POSIX.

Diego Nieto Cid worked on allowing privileged users to set their task priority (nice value). His patches landed in glibc and GNU Mach. He also fixed a tiny bug in our test suite. He fixed an adjtime bug, which is helpful to the OpenNTPD port, and he fixed two more bugs.

Paulo Duarte sent a RFC patch series trying to commit Sergey’s previous AArch64 work. He writes:

This series adds the gnumach kernel-side implementation for the
aarch64 ABI Sergey landed in April 2024, plus the test-suite arms.
Patch 01 brings in the aarch64-only sources from bugaevc/wip-aarch64
verbatim, with Sergey as Author; the rest is mine.

The meaningful divergence from wip-aarch64 is what I left out:
roughly 150 files of cross-arch refactoring across kern/, ipc/, vm/,
device/intr.{c,h}, and the i386 tree. Each got replaced with a
smaller per-arch shim under aarch64/ so kern/bootstrap.c,
device/intr.{c,h}, kern/lock.h, and the i386 trees all stay
bit-identical to current master. The shared-file footprint outside
aarch64/ is four files: a new ELF constant, two missing decls plus
their include, and a linker-symbol filter extension...

Tested: 12/12 pass on x86_64, i686, and aarch64 under qemu. No
bare-metal validation yet. I plan to build bootable images and boot
the kernel on Apple M1 / Raspberry Pi (aarch64) and an x86_64 box
(x86_64 + i686). Help on any of these welcome.

He also fixed a tiny cross compilation issue.

gfleury fixed some tmpfs typos. He also fixed a kernel crash on a null pointer deference.

Almudena Garcia is developing a WIP trivfs implementation in rust. The work is not complete yet, but it is possible to write Hurd translators in Rust!

Mikhail Karpov added some checks for mmap in several places. He also worked on adding storeio to the bootstrap chain. This is actually quite interesting. Currently the Hurd sets device entries in /dev/ statically. For example, I am writing this qoth on a Hurd machine that is using two /dev/ entries for my filesystem: /dev/wd0s1 for swap and /dev/wd0s5 for my root filesystem. However, /dev/wd0s1 through /dev/wd0s16 exist on my computer! Once Mikhail's project is done, then the Hurd will dynamically populate SATA devices at boot time! No more need for static translators! He writes:

I've expanded the functionality of the partfs translator to work
with multiple disks and their partitions. Thus, by running the
command:
settrans -c partfs /hurd/partfs /root/disk1.img /root/disk2.img /root/disk3.img


The translator directory will have the following directory tree:
partfs
├── 0
│ ├── 1
│ ├── 2
│ └── ...
├── 1
│ ├── 1
│ ├── 2
│ └── ...
├── 2
│ ├── 1
│ ├── 2
│ └── ...
Since the disks are directories, the cd and ls commands work in the translator node.

I also tested mounting, reading, and writing using the commands:
`settrans -c ext01 /hurd/ext2fs -w -T typed file:/root/partfs/0/1`
and
`settrans -c ext1_1 /hurd/ext2fs -w -T typed part:1:file:/root/partfs/1`

It actually is even cooler! Samuel (our fearless leader) is seeking feedback for how to name these newer /dev entries. Samuel writes:

One thing that would be really needed for efficiency is to implement
netfs_file_get_storage_info, so that libstore would be able to get the
underlying storage information, and directly get data from there rather
than partfs having to pass data with io_read/write.

I'm then wondering how this would fit in the "grand scheme". Our current
approach, /dev/hd0s* being always there, is indeed not really good
because it doesn't easily tell the user which partitions are actually
there. We used to have to have this because partitions used to be
handled by the kernel, and then we have moved to
storerio+parted-supported partitions, which brings much more
flexibility.

Perhaps we could use

settrans -c /dev/hd0s /hurd/partfs /dev/hd0

and then we'd have /dev/hd0s/1, which is almost like before, but allows
the entries to be dynamic. Actually, we could even have some

settrans -c /dev/hd /hurd/probedisk hd

and then we'd have /dev/hd/0, and we could have /dev/hd/0s being partfs,
so we'd eventually have

/dev/hd/0s/1

But I'm also thinking that perhaps it could be integrated more with
storeio, i.e. /dev/hd0 can as well also act as a directory with partfs
behavior, so you could have

/dev/hd0/1

and with the probedisk translator, you could have

/dev/hd/0/1

What do people think about it?

Mike Kelly has been hard at work porting OpenBSD’s OpenNTPD, which required some glibc work. The Hurd doesn't currently have a NTP daemon, so thanks Mike!

He also debugged a weird memory error with rump, and he provided a "brown-tape" solution for it. Hopefully, he (or you dear reader), can reach out to the NetBSD people to fix this bug. This just goes to show that when two projects use the same code, both projects benefit!

He also got a glibc patch committed. Essentially SIGSTOP/SIGCONT was duplicating portions of files, which is now fixed. However, there are still some other issues with building some haskell packages.

Joan Lledó continued his work on porting dhcpcd. Also Roy Maples, the dhcpcd maintainer did a lot of helpful work to help us out. Thanks Roy!

Bradley Morgan fixed a tiny implementation bug with cat. He also tweaked procfs to show hidden files, and he allowed passing “-s” to init. Previously, passing "-s" to init was silently ignored.

Johannes Schauer Marin Rodrigues has been working on getting s-build to run on amd64 Hurd. It is a rather long email thread, so grab some popcorn and dig in!

Milos Nikic ported Neovim. He also worked on bug fixes to libdiskfs, and he fixed a deadlock bug in the “ext3/ext4” filesystem journal.

In the last qoth we had talked about how the Milos was working on adding an ext3/ext4 binary compatible journal. Samuel has committed it! Samuel wrote:

There is a couple things that I fixed on the fly:

- We want to use pthread_cond_clockwait rather than
  pthread_cond_timedwait, to be able to use CLOCK_MONOTONIC instead of
  CLOCK_REALTIME, to avoid being hit by ntpdate and such.

- In diskfs_S_dir_rename, there was an addition of:

  pthread_mutex_unlock (&fnp->lock);

  which was clearly bogus: we were unlocking it again below.

There are a couple things that we'd want to fix now:

- when calling diskfs_file_update, don't we have to be inside a
  transaction? Otherwise if we pass wait=1 and use a journal, we won't
  be waiting AIUI? Notably, in diskfs_S_dir_rmdir we don't use a
  transaction. And ideally we'd have an assertion that makes sure we
  respect this.

- we should define some helper for this recurring pattern:

  if ((docommit) && (diskfs_synchronous || diskfs_journal_needs_sync (txn)))
    diskfs_journal_commit_transaction (txn);
  else
    diskfs_journal_stop_transaction (txn);

- journal_drain_deferred_blocks should document what it does, not just
  its call conditions :), and more generally the functions that are
  not already documented in a .h and not just a _locked variant of a
  documented function.

Leonardo Lopes Pereira did some spring cleaning to remove some dead code.

Samuel Thibault mentioned in an email that the Hurd can support nvmes with rump, but that the work was just not done yet. Perhaps you, dear reader, would like to help us accomplish this task?

The mysterious user yelini worked on porting the D language compiler.

Damien Zammit worked on tweaking the Hurd’s WIP CI. He also fixed several bugs to make it possible to run the Hurd’s test suite from GNU/Linux running on an AArch64 computer. He also is working on integrating qemu’s Hurd support into upstream qemu’s CI, so that the support does not bitrot.

Sophiel Zhou fixed a tiny pfinet permission checking issue and taught pfinet to not fail under memory pressure:

This series fixes two latent crash bugs in pfinet where mmap
return values go unchecked, may causing crash when memory is tight.

Both bugs follow the same pattern: mmap is called to grow a buffer,
but the returned pointer is dereferenced before (or without) checking
for MAP_FAILED.  Under normal operation mmap rarely fails, so these
have gone unnoticed, but under address-space pressure pfinet would
crash.

Having seen some technologies come to a definite end, Chris wonders if we should be willing to draw a line under open source software sometimes.

Support us on Patreon and get an ad-free RSS feed with some early episodes

See our contact page for ways to get in touch.

Subscribe to the RSS feed.

Microsoft really wants your Windows settings data, secure boot has been useless for a decade, our thoughts on (the idea of) Incus and IncusOS, and configuring ZFS for a Lightning Memory Mapped Database.

Plugs

Support us on patreon and get an ad-free RSS feed with some early episodes

Jails, Not Containers: FreeBSD Isolation Done Right

News/discussion

Microsoft flips Windows Backup to on by default unless you’re in the EU

Microsoft’s Secure Boot has been broken for a decade and no one noticed until now

IncusOS

Incus

Free consulting

We were asked about configuring ZFS for a Lightning Memory Mapped Database.

Libtoolers!

The Libtool Team is pleased to announce the release of libtool 2.6.2.

GNU Libtool hides the complexity of using shared libraries behind a
consistent, portable interface. GNU Libtool ships with GNU libltdl, which
hides the complexity of loading dynamic runtime libraries (modules)
behind a consistent, portable interface.

See the NEWS below for a brief summary.

Thanks to everyone who has contributed!
The following people contributed changes to this release:

libtool 2.6.2 [stable]:
  Ileana Dumitrescu (4)

libtool 2.6.1 [beta]:
  Alexandre Janniaux (4)
  Alexey Samsonov (1)
  Anthony Mallet (1)
  Arnold (1)
  Dima Pasechnik (1)
  Frederic Berat (1)
  Ileana Dumitrescu (15)
  KO Myung-Hun (4)
  Kirill Makurin (1)
  Mintsuki (1)
  Nicolas Boulenguez (1)
  Olly Betts (1)
  Patrice Dumas (1)
  Richard J. Mathar (1)

libtool 2.6.0 [alpha]:
  Anthony Mallet (1)
  Bruno Haible (2)
  Christian Feld (1)
  Collin Funk (1)
  Elizabeth Figura (1)
  Evgeny Grin (1)
  Frédéric Bérat (1)
  Gleb Popov (1)
  Ileana Dumitrescu (47)
  Julien ÉLIE (1)
  Karl Berry (1)
  Kirill Makurin (1)
  Manoj Gupta (1)
  Martin Storsjö (1)
  Michael Haubenwallner (2)
  Mintsuki (1)
  Mitch (1)
  Pierre Ossman (2)
  Takashi Yano (1)


Ileana
 [on behalf of the libtool maintainers]
==================================================================

Here is the GNU libtool home page:
    https://gnu. ... g/s/libtool/

Here are the compressed sources:
  https://ftpmirror ... tool-2.6.2.tar.gz   (2.1MB)
  https://ftpmirror ... tool-2.6.2.tar.xz   (1.1MB)

Here are the GPG detached signatures:
  https://ftpmirror ... -2.6.2.tar.gz.sig
  https://ftpmirror ... -2.6.2.tar.xz.sig

Use a mirror for higher download bandwidth:
  https://www.gnu.o ... rg/order/ftp.html

Here are the SHA256 and SHA3-256 checksums:

  File: libtool-2.6.2.tar.gz
  SHA256 sum:   24adb3aa9ae035c70faba344af57d73215eb89281045af6c7ccd307751f8b0bf
  SHA3-256 sum: b0e77c0dc9a082830c95d182da77747d1f5435a06132feefd5054bfde2c9da81

  File: libtool-2.6.2.tar.xz
  SHA256 sum:   2ef1067c16c97db930fd740cc9bc3d3ba9a583804ae5ac42cc3e8719e49e191e
  SHA3-256 sum: c24b9995af8391a310a258dcb98897f92d86f47acca235f3d2859ca0ed1d9dd0

Verify the SHA256 checksum with either sha256sum, sha256, or
'shasum -a 256'.

Verify the SHA3-256 checksum with 'cksum -a sha3 -l 256 --base64'
from coreutils-9.8.

Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact.  First, be sure to download both the .sig file
and the corresponding tarball.  Then, run a command like this:

  gpg --verify libtool-2.6.2.tar.gz.sig

The signature should match the fingerprint of the following key:

  pub   rsa4096 2021-09-23 [SC]
        FA26 CA78 4BE1 8892 7F22  B99F 6570 EA01 146F 7354
  uid   Ileana Dumitrescu <ileanadumitrescu95@gmail.com>
  uid   Ileana Dumitrescu <ileanadumi95@protonmail.com>

If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.

  gpg --locate-external-key ileanadumitrescu95@gmail.com

  gpg --recv-keys 6570EA01146F7354

  wget -q -O- 'https://savannah. ... ol&download=1' | gpg --import -

As a last resort to find the key, you can try the official GNU
keyring:

  wget -q https://ftp.gnu.o ... u/gnu-keyring.gpg
  gpg --keyring gnu-keyring.gpg --verify libtool-2.6.2.tar.gz.sig

This release is based on the libtool git repository, available as

  git clone https://https.git ... g/git/libtool.git

with commit 309bb53a8adfb22c6e5869cc8da049bf123e5438 tagged as v2.6.2.

For a summary of changes and contributors, see:

  https://gitweb.gi ... shortlog;h=v2.6.2

or run this command from a git-cloned libtool directory:

  git shortlog v2.6.1..v2.6.2

This release was bootstrapped with the following tools:
  Autoconf 2.73
  Automake 1.18.1
  Gnulib 2026-07-03 491f1bb7d3049f3ab7825f3ee665c209658e9965

NEWS