Today, my fantastic Gentoo system automagically downloaded, configured,
compiled, and installed, all according to my strict specifications, the following
packages.

Note that xv-utils, a downgrade, is at the top of the list. I don't need it because
I don't use that junk systemd, but I decided to accept it nonetheless.

Gentoo never forces anything. _I_ am the one that makes the decisions for
_MY_ system.

Don't you wish that you could do the same?

Ha, ha, ha, ha, ha, ha, ha, ha, ha, ha, ha, ha!

xv-utils
xorg-proto
trove-classifiers
dev-python/hatchling
dev-python/lxml
elt-patches
app-arch/zstd
coreutils
dev-build/libtool
libpciaccess
compose-tables
dev-debug/strace
libX11
net-misc/curl
libxkbcommon
dev-util/maturin
dev-ruby/reline
dev-libs/libgit2
cargo-c
net-libs/libproxy
libavif
qtcore
qtnetwork
qtxml
qtconcurrent
linguist-tools
'=openjdk-bin-8.402_p06'
geeqie
openrc
app-portage/eix
libXmu
mesa
qtgui
'=qtbase-6.6.3'
libva
gptfdisk
qtwidgets
'=qtshadertools-6.6.3'
qtmultimedia
'=qtsvg-6.6.3'
'=qtdeclarative-6.6.3'
qtopengl
qtprintsupport
qtsvg
'=qtquicktimeline-6.6.3'
libreoffice-l10n
libreoffice

Whew! This was a BIG update. The whole QT system plus LibreOffice.

I'm very happy my provider let me see this fantastic jewel.

Le 30-03-2024, Diego Garcia <dg@chaos.rocks> a écrit :
> Today, my fantastic Gentoo system automagically downloaded, configured,
> compiled, and installed, all according to my strict specifications, the following
> packages.

It's a good thing it does it automatically when you don't understand
what it does (yes, this message is the proof you have no idea about what
your system does, see bellow).

And. Here. Is. The. Fabulous. Proof. TaDa:
> Note that xv-utils, a downgrade, is at the top of the list.

Are you really sure it has been downgraded on your system?

I believe you are confused, so I'll explain a little bit. Here, and in a
lot of other places, the actual subject is about a vulnerability on ssh.
The vulnerability is caused by a data compressor named xz (you see, xz
not xv). Xv is an old image viewer, it was useful years ago it's almost
dead now.

So, the xz versions concerned are the version 5.6.0 and 5.6.1, so you
can either downgrade to a prior version, or upgrade to version 5.6.1-2
like done by archlinux.

> I don't need it because I don't use that junk systemd, but I decided
> to accept it nonetheless.

Another confusion, but it's not a funny one, unlike your previous
sentence. You don't need systemd to be concerned, you only need to have
a vulnerable version.

<https://lwn.net/ml/oss-security/20240329155126.kjjfduxw2yrlxgzm@awork3.anarazel.de/>
"Initially starting sshd outside of systemd did not show the slowdown, despite
the backdoor briefly getting invoked. This appears to be part of some
countermeasures to make analysis harder."

"To reproduce outside of systemd, the server can be started with a clear
environment, setting only the required variable:

env -i LANG=en_US.UTF-8 /usr/sbin/sshd -D"

> Gentoo never forces anything. _I_ am the one that makes the decisions for
> _MY_ system.

Your sentence about the downgrade of an unrelated tool show you don't
know what it does.

Or, what is very plausible, you changed the output of your system to
make believe it did something it didn't and made an error with the
letters. Either possibility (you don't understand or you lie) deserves
your claims about the ultimate reference in everything you pretend to be.

> Don't you wish that you could do the same?

My system upgraded the vulnerable tools perfectly well. No need to
downgrade something unrelated for that.

> xv-utils

First line. Either you added it manually misspelling it and you should
hide of shame. Or you don't know what your system do and you should hide
of shame too.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

On 30 Mar 2024 20:12:02 GMT, Stéphane CARPENTIER wrote:

>
> I believe you are confused, so I'll explain a little bit. Here, and in a
> lot of other places, the actual subject is about a vulnerability on ssh.
> The vulnerability is caused by a data compressor named xz (you see, xz
> not xv).
>

No. YOU are confused.

I made a typographical error. The package "xv-utils" should have been
"xz-utils."

So my xz-utils has been downgraded to 5.4.2.

But it is quite unnecessary. Only ssh calling systemd-notify will invoke
the problem, and I use neither ssh or that abominable systemd.

My system is safe but I decided to downgrade anyway. After all, the
actual compression/decompression will be unaffected regardless.

>
> Xv is an old image viewer, it was useful years ago it's almost
> dead now.
>

I still use xloadimage:

http://fr2.rpmfind.net/linux/RPM/fedora/devel/rawhide/x86_64/x/xloadimage-4.1-37.fc40.x86_64.html

Who decides what is dead or alive?

Certainly not you.

On 2024-03-30, Diego Garcia <dg@chaos.rocks> opined as follows:
> Today, my fantastic Gentoo system automagically downloaded, configured,
> compiled, and installed, all according to my strict specifications, the following
> packages.
>
> Note that xv-utils, a downgrade, is at the top of the list. I don't need it because
> I don't use that junk systemd, but I decided to accept it nonetheless.
>
> Gentoo never forces anything. _I_ am the one that makes the decisions for
> _MY_ system.
>
> Don't you wish that you could do the same?
>
> Ha, ha, ha, ha, ha, ha, ha, ha, ha, ha, ha, ha!
>
> xv-utils
> xorg-proto
> trove-classifiers
> dev-python/hatchling
> dev-python/lxml
> elt-patches
> app-arch/zstd
> coreutils
> dev-build/libtool
> libpciaccess
> compose-tables
> dev-debug/strace
> libX11
> net-misc/curl
> libxkbcommon
> dev-util/maturin
> dev-ruby/reline
> dev-libs/libgit2
> cargo-c
> net-libs/libproxy
> libavif
> qtcore
> qtnetwork
> qtxml
> qtconcurrent
> linguist-tools
> '=openjdk-bin-8.402_p06'
> geeqie
> openrc
> app-portage/eix
> libXmu
> mesa
> qtgui
> '=qtbase-6.6.3'
> libva
> gptfdisk
> qtwidgets
> '=qtshadertools-6.6.3'
> qtmultimedia
> '=qtsvg-6.6.3'
> '=qtdeclarative-6.6.3'
> qtopengl
> qtprintsupport
> qtsvg
> '=qtquicktimeline-6.6.3'
> libreoffice-l10n
> libreoffice
>
> Whew! This was a BIG update. The whole QT system plus LibreOffice.
>

I ran gentoo for years. I got tired of replacing hdd's and running my cpu
fan at full for hours at a time. Still a great system with many benefits.
But there's something to be said for the simple maintenance of basic linux.

--
'Many have sought in vain to tell joyously of the Most Joyous. Now at last It declares
Itself to me, now in this misery.' - Holderlin
____
/. \
___________< |___________
\___________ ___________/
\___________ ___________/
\___________ ___________/
| |
^^^ ^^^
_________
| R W |
| (*) |
|____U____|