A new release of the Ubuntu Cloud Images for stable Ubuntu release 21.04 (Hirsute Hippo) is available at [1]. These new images superseded the existing images [2]. Images are available for download or immediate use on EC2 via publish AMI ids. Users who wish to update their existing installations can do so with: 'sudo apt-get update && sudo apt-get dist-upgrade && sudo reboot'. The following packages have been updated. Please see the full changelogs for a complete listing of changes: * apparmor: 3.0.0-0ubuntu7 => 3.0.0-0ubuntu7.1 * apt: 2.2.3 => 2.2.4ubuntu0.1 * libdrm: 2.4.104-1build1 => 2.4.105-3~21.04.1 * libuv1: 1.40.0-1 => 1.40.0-1ubuntu0.1 * linux-base: 4.5ubuntu5 => 4.5ubuntu5.3 * linux-meta: 5.11.0.22.23 => 5.11.0.25.27 * linux-signed: 5.11.0-22.23 => 5.11.0-25.27 * shim-signed: 1.47+15.4-0ubuntu2 => 1.48+15.4-0ubuntu5 * systemd: 247.3-3ubuntu3.1 => 247.3-3ubuntu3.4 * ubuntu-release-upgrader: 1:21.04.13 => 1:21.04.14 The following is a complete changelog for this image. new: {'linux-headers-5.11.0-25': '5.11.0-25.27', 'linux-headers-5.11.0-25-generic': '5.11.0-25.27', 'linux-modules-5.11.0-25-generic': '5.11.0-25.27'} removed: {'linux-modules-5.11.0-22-generic': '5.11.0-22.23', 'linux-headers-5.11.0-22': '5.11.0-22.23', 'linux-headers-5.11.0-22-generic': '5.11.0-22.23'} changed: ['apparmor', 'apt', 'apt-utils', 'libapparmor1:amd64', 'libapt-pkg6.0:amd64', 'libdrm-common', 'libdrm2:amd64', 'libnss-systemd:amd64', 'libpam-systemd:amd64', 'libsystemd0:amd64', 'libudev1:amd64', 'libuv1:amd64', 'linux-base', 'linux-headers-generic', 'linux-headers-virtual', 'linux-image-5.11.0-25-generic', 'linux-image-virtual', 'linux-virtual', 'python3-distupgrade', 'shim-signed', 'systemd', 'systemd-sysv', 'systemd-timesyncd', 'ubuntu-release-upgrader-core', 'udev'] new snaps: {} removed snaps: {} changed snaps: ['lxd', 'snapd'] ==== apparmor: 3.0.0-0ubuntu7 => 3.0.0-0ubuntu7.1 ==== ==== apparmor libapparmor1:amd64 * Make X11 socket writable again (LP: #1934005): - d/p/ubuntu/lp1934005.patch * Fix i18n.sh regression test on arm64 (LP: #1932331): - d/p/ubuntu/lp1932331.patc Thanks to Georgia Garcia for the patch. ==== apt: 2.2.3 => 2.2.4ubuntu0.1 ==== ==== apt apt-utils libapt-pkg6.0:amd64 * Merge 2.2.4 from Debian unstable * Extend the JSON hook fixes with support for version 0.2 (LP: #1926150) - json: Add origins fields to version - upgrade: Add JSON hook support (AptCli::Hooks::Upgrade) - json: Add `package-list` and `statistics` install hooks - json: Hook protocol 0.2 (added upgrade,downgrade,reinstall modes) [ Julian Andres Klode ] * Various bugfixes to the JSON hooks: - encoder fixes: + json: Escape strings using \u escape sequences, add test + json: Actually pop states + json: Encode NULL strings as null - json: Flush standard file descriptors before calling hooks (this avoids output from hooks in middle of apt output) - Non-installed JSON changes: + test/json: Make the test hook more reliable + Fix a typo in json-hooks-protocol.md (thanks to Brian Murray) * Avoid infinite loop on EOF on media change prompt (LP: #1928687) * Turn TLS handshake issues into transient errors (LP: #1928100), this makes behavior consistent with TCP and enables Acquire::Retries * policy: Apply phasing to uninstalled packages too (LP: #1925745), this prevents inconsistencies when installing new binaries that depend on the same version of an already installed binary. [ David Kalnischkies ] * URI encode Filename field of Packages files (again). This fixes a regression introduced in 2.1.15 that causes download failures of packages with an epoch included in their filename (LP: #1931874). ==== libdrm: 2.4.104-1build1 => 2.4.105-3~21.04.1 ==== ==== libdrm-common libdrm2:amd64 * Backport to hirsute. (LP: #1923880) * Revert a commit causing additional dependencies to be added to *.pc.in. Also drop libpciaccess-dev from libdrm-dev Depends. * control: Add libpciaccess-dev to libdrm-dev depends. * revert-set-fb-modifiers-flag.diff: Revert a commit which broke chrome on certain setups. * New upstream release. (LP: #1923880) * symbols: Updated. * New upstream release. * Add signing-key from Simon Ser. * control: Manpages now need python3-docutils instead of docbook-xsl to build, make it so. * hurd-port.diff: Dropped. (Closes: #975658) * New upstream release. (Closes: #970304) * control, rules, hurd-port.diff: Add support for Hurd. (Closes: #909436) * New upstream release. * fix-realpath-vs-firefox.diff: Dropped, upstream. * libdrm-tests.install: Added /usr/bin/drmdevice. * fix-realpath-vs-firefox.diff: Fix webgl on intel with firefox. (Closes: #956665) (LP: #1872586) * New upstream release. * source, watch: Upstream provides only xz tarballs, bump source to 3.0 (quilt). * Add my key to signing-key.asc. * control: Use debhelper-compat, bump to 12. * control: Bump policy to 4.5.0. * local-options: Update extend-diff-ignore. * symbols: Updated. * rules: Override dh_missing. * rules: Include additional test binaries on arm. (Closes: #944752) * Revert dropping libdrm-tests, since the package ended up in NEW anyway. * control, rules: Disable libdrm-tests, 2.4.100 is needed for mesa 19.3 now and not after waiting for the NEW queue to clear. [ Timo Aaltonen ] * New upstream release. (Closes: #943777) * symbols: Updated. [ Rohan Garg ] * Add a libdrm-tests package. (Closes: #868898) * New upstream release. (Closes: #934494) * 02_kfreebsd.diff: Dropped, upstream. * symbols: Updated. [ Andreas Boll ] * New upstream release. * Update libdrm-amdgpu1.symbols and shlibs. * Update libdrm-freedreno1.symbols and shlibs. [ James Clarke ] * Fix build on GNU/kFreeBSD (Closes: #837034, #909249). * Remove no longer needed build-dep libbsd-overlay. [ Timo Aaltonen ] * rules, control: Switch to meson. [ Andreas Boll ] * New upstream release. - Fixes WebGL on Firefox (Closes: #907698). * Update libdrm-amdgpu1.symbols and shlibs. * Drop static libdrm library from libdrm-dev. * Update extend-diff-ignore. [ Guido Gnther ] * Enable etnaviv on arm64 (Closes: #906915) [ Timo Aaltonen ] * New upstream release. (LP: #1789924) * Update libdrm-amdgpu1.symbols and shlibs. * New upstream release. * Update libdrm-freedreno1.symbols and shlibs. * New upstream release. * Update libdrm-freedreno1.symbols and shlibs. * control: Update to my Debian address. * Update Vcs-* URLs to point at salsa.debian.org. * Bump debhelper compat to 11. * Bump standards version to 4.1.4. * Update libdrm-freedreno1.symbols and shlibs (Closes: #892960). * New upstream release. * New upstream release. * Update libdrm-amdgpu1.symbols and shlibs. * Bump standards version to 4.1.3. * Update extend-diff-ignore. * New upstream release. * Update libdrm2.symbols and shlibs. * Update libdrm-amdgpu1.symbols and shlibs. * Update libdrm-etnaviv1.symbols and shlibs. * Update libdrm-freedreno1.symbols and shlibs. * Bump standards version to 4.1.2. * New upstream release. * Update libdrm-amdgpu1.symbols and shlibs. * New upstream release. * Update libdrm-amdgpu1.symbols and shlibs. * Bump standards version to 4.1.1. * libdrm-amdgpu1.symbols: Updated. * New upstream release. * libdrm2.symbols: Updated. * New upstream release. * New upstream release. * debian/upstream/signing-key.asc: add key from Lucas Stach. * Add libdrm-common package for new data files. * debian/*.symbols: add new symbols. * debian/rules: Bump shlibs for the libraries with new symbols. * debian/control: Bump Standards-Version to 4.0.0; no changes needed. * Upload to unstable. * New upstream release. * Bump libdrm2's and libdrm-amdgpu1's symbols and shlibs. * New upstream release. * Bump libdrm-amdgpu1's and libdrm-etnaviv1's symbols and shlibs. * Remove libpthread-stubs0-dev build-dep per configure.ac. * Team upload. * New upstream release. * Bump libdrm-amdgpu1 symbols. * Update debian/upstream/signing-key.asc * New upstream release. * Update extend-diff-ignore. * Cherry-pick 19c4cfc (intel: Add handle to hashtable before freeing along an error path) from upstream (LP: #1671377). * New upstream release. * Bump libdrm2's and libdrm-intel1's symbols and shlibs. * Update extend-diff-ignore. * Add debian/source/format file. [ Andreas Boll ] * Switch to dbgsym packages. * Enable building etnaviv on armhf (Closes: #852685). [ Emilio Pozuelo Monfort ] * Stop passing --disable-silent-rules to configure, debhelper does it now. * Don't override dh_auto_install, it defaults to debian/tmp. * New upstream release. * Update debian/upstream/signing-key.asc. * Bump libdrm2's, libdrm-freedreno1's and libdrm-intel1's symbols and shlibs. * Bump debhelper compat to 10. * New upstream release. * Bump libdrm2's, libdrm-amdgpu1's, libdrm-freedreno1's and libdrm- intel1's symbols and shlibs. * Update a bunch of URLs in packaging to https. * New upstream release. * Update symbols file and bump shlibs for libdrm2. * Update libdrm-intel1.symbols and shlibs. * Remove Hurd from the architecture list. It FTBFS, haven't built in the past and won't be useful without the equivalent of the Linux Direct Rendering Manager (DRM) subsystem. * New upstream release. * Update libdrm-freedreno1.symbols and shlibs. * source/local-options: Add more files to extend-diff-ignore option. Fixes 17 patch-system-but-direct-changes-in-diff lintian warnings. [ Andreas Boll ] * New upstream release. * Update debian/upstream/signing-key.asc. * Bump Standards-Version to 3.9.8, no changes needed. * Update watch url to use https instead of http. [ Julien Cristau ] * Build libdrm-tegra on arm64 (closes: #828023). Thanks, Martin Michlmayr! * New upstream release. (LP: #1577735) * New upstream release. * patches: Refreshed. * libdrm-amdgpu1.symbols: Updated. * Update libdrm-exynos1.symbols and shlibs. * New upstream release. * Update symbols file and bump shlibs for libdrm2. * Update libdrm-intel1.symbols and shlibs. * Update libdrm-nouveau2.symbols and shlibs. * Drop obsolete Replaces from pre-wheezy. * Add myself to Uploaders. * rules: Bump freedreno shlib back to 2.4.65. [ Andreas Boll ] * Update libdrm-freedreno1.symbols and shlibs. * Drop Debian revision from new symbols in libdrm2.symbols. [ Fathi Boudra ] * Enable freedreno build on arm64 architecture. [ Andreas Boll ] * New upstream release. * Update debian/upstream/signing-key.asc. * Update symbols file and bump shlibs for libdrm2. * Enable libdrm-amdgpu1 on kfreebsd-*. * Fix Vcs-* fields. * Add upstream url. [ Robert Hooker ] * New upstream release. * Bump symbols file and shlibs for libdrm-freedreno1. [ Robert Hooker ] * New upstream release. - Drop Fix-headers-inclusion-in-xf86drmMode.c.diff, upstream. * Add new libdrm-amdgpu1 package. [ Sven Joachim ] * New upstream release. - nouveau: restore check that avoids multiple user bos per kernel bo (Closes: #789759). * Update symbols file and bump shlibs for libdrm2. * Refresh the patch from 2.4.60-3 after upstream changes. * Remove duplicate Section fields from debian/control. * Update debian/upstream/signing-key.asc. * Bump Standards-Version to 3.9.6, no changes needed. [ Julien Cristau ] * Update debian/upstream/signing-key.asc. * Fix kfreebsd patch that caused an FTBFS on Linux/x32: only include if configure detects it (closes: #787496). Thanks, Thorsten Glaser. * Add build-dep on xutils-dev for xorg-macros. * Cherry-pick upstream patch to let valgrind auto-detection work. [ Timo Aaltonen ] * control: Add a typo in libdrm-tegra0 description. [ Julien Cristau ] * Fix FTBFS on kfreebsd: include for sysctlbyname, and use -lbsd to make the tests build (they use getopt, and our libbsd-overlay cflags redirect that to bsd_getopt). * Bump shlibs for libraries with new symbols. * Add missing dependency of libdrm-dev on libdrm-tegra0 on arm*. * Let uscan verify tarball signatures. [ Maarten Lankhorst ] * Fix ftbfs on armhf. * New upstream release. * libdrm-intel1.symbols, libdrm2.symbols: Updated. * New upstream release. * Add libdrm-tegra0 on arm. [ Andreas Boll ] * Update libdrm-freedreno1.symbols and shlibs (fixes FTBFS). [ Andreas Boll ] * New upstream release. - 03_hide_symbols.diff dropped, upstream. * Update libdrm-intel1.symbols and shlibs. * New upstream release. * Enable building freedreno and exynos on arm. (Closes: #741509) * Add a squashed patch from upstream to hide all private symbols. - 03_hide_symbols.diff [ Andreas Boll ] * New upstream release. * Add 02_fix_qxl_drm_h.diff (Closes: #746807). [ Timo Aaltonen ] * New upstream release. - 02_kbsd_modeset.diff dropped, upstream [ Julien Cristau ] * Remove Cyril Brulebois from Uploaders. [ Maarten Lankhorst ] * New upstream release. * New upstream release. * New upstream release. * Cherry-pick a commit from upstream to fix a radeonsi regression. - c8a437f4c76: radeon: Update unaligned offset for 2D->1D tiling transition on SI * New upstream release. [ Colin Watson ] * Declare libdrm-dev Multi-Arch: same. [ Maarten Lankhorst ] * Cherry-pick upstream patch to fix relocations for all cards = 2.6.28. * Set libdrm2 shlibs to 2.4.3, libdrm-intel1 shlibs to 2.4.5. Update symbols files. * Remove from the source package a bunch of files that are only used by the kernel drm component. This gets rid of the mga, r128 and radeon microcode, and thus closes: #502675. Thanks, Ben Hutchings! [ Brice Goglin ] * Update upstream URL in debian/copyright. * Bump Standards-Version to 3.7.3 (no changes). * Drop the XS- prefix from Vcs-Git and Vcs-Browser fields in debian/control. * Install the upstream ChangeLog. [ Julien Cristau ] * New upstream release (needed for mesa 7.1 and newer xserver). * Note: this release removes the memory manager (TTM) interface used by the i915tex dri driver. * debian/rules: don't call configure with --host if we're not cross-building, and fix some rules dependencies. [ Timo Aaltonen ] * Bump the shlibs to 2.3.1. [ David Nusinow ] * Add NEWS.Debian explaining the change in the last upload to interested administrators. [ Julien Cristau ] * Upload to unstable. * Add myself to uploaders * Patch libdrm to default to device permission 666 so we don't have to do it in xorg.conf. The only way libdrm can do anything is through the server anyway. This can still be overridden by a user's xorg.conf. This change also requires adding quilt to the build-depends * Update my email address in debian/control. * Add XS-Vcs-Git and XS-Vcs-Browser in debian/control. * Upload to unstable. [ Thierry Reding ] * New upstream release. * Set the Debian X Strike Force as maintainer. * Add myself to uploaders. * Add a debugging symbol package for libdrm2. [ Julien Cristau ] * Bump shlibs to libdrm2 >= 2.3.0. * Add myself to uploaders. * Add build-dep on dpkg-dev >= 1.13.19 to make sure that the binary:Version substvar is available. * libdrm2-dbg depends on libdrm2 (= ${binary:Version}). * Don't install libdrm.la, and use dh_install --list-missing. * Non-maintainer upload. * New upstream release. * Bump Standards-Version to 3.7.2, no changes required. * Bump debhelper compatibility to 5 and adjust build-dependency. * Don't try to install pkgconfig files from usr/share/pkgconfig because there is nothing in that directory. * Non-maintainer upload. * New upstream release (closes: #377166). - Includes a fix for FTBFS on GNU/kFreeBSD (closes: #332994). * Manually force static build. * New upstream release - Fixes a pathological hash table smash discovered by the Coverity scanner - updates the installed header files for various new #defines * First upload to Debian * New upstream release. * Change binary package from libdrm1 to libdrm2, following soversion bump. * New upstream version. * Yay for understandable bug reports! *gmprf* * debian/control:libdrm1 =~ s/development/runtime/ (closes: bug#325515) * libdrm.pc.in: add -ldrm to Libs * New upstream * debian/control: it's "Direct Rendering Infraestructure". I was rather sure it stand for interface... thanks Michel. (closes: bug#324514) * debian/control: forgot to actually write this in the file. Build-Depends on libx11-dev. Thanks Kurt (closes: bug#324560) * Forgot to fix the other broken bit :-P * Initial release. Closes: #324074 ==== libuv1: 1.40.0-1 => 1.40.0-1ubuntu0.1 ==== ==== libuv1:amd64 * SECURITY UPDATE: Out-of-bounds read - debian/patches/CVE-2021-22918.patch: fix OOB read in punycode decoder src/idna.c, test/test-idna.c, test/test-list.h. - CVE-2021-22918 ==== linux-base: 4.5ubuntu5 => 4.5ubuntu5.3 ==== ==== linux-base [ Tim Gardner ] * Add SGX support for Linux >= v5.11 (LP: #1932582) - Added a udev rule for v5.11 SGX device names, [ Tim Gardner & Dimitri John Ledkov ] - Add /etc/profile.d/linux-base-sgx.sh and /usr/lib/systemd/system-environment-generators/linux-base-sgx to export environmental variable for out-of-process attestation by default for: tty login sessions; ssh login sessions; systemd user services; systemd system services. * Rewrite xx-update-initrd-links to use linux-update-symlinks. This will now make installkernel behaviour match the linux-image-*.postinst behaviour exactly with respect to creating & updating vmlinu? and initrd.img symlinks in / or /boot. LP: #1929255 * Make the new posinst hook executable (the correct bits were lost when adding the scripts via debdiff) (LP: #1877088). * Check for update-initramfs being installed before running the postinst hook which updates the softlinks (LP: #1928700). ==== linux-meta: 5.11.0.22.23 => 5.11.0.25.27 ==== ==== linux-headers-generic linux-headers-virtual linux-image-virtual linux-virtual * Bump ABI 5.11.0-25 * Bump ABI 5.11.0-24 * Bump ABI 5.11.0-23 * Packaging resync (LP: #1786013) - [Packaging] resync debian/dkms-versions from main package ==== linux-signed: 5.11.0-22.23 => 5.11.0-25.27 ==== ==== linux-image-5.11.0-25-generic * Master version: 5.11.0-25.27 * Master version: 5.11.0-24.25 * Master version: 5.11.0-23.24 ==== shim-signed: 1.47+15.4-0ubuntu2 => 1.48+15.4-0ubuntu5 ==== ==== shim-signed ==== systemd: 247.3-3ubuntu3.1 => 247.3-3ubuntu3.4 ==== ==== libnss-systemd:amd64 libpam-systemd:amd64 libsystemd0:amd64 libudev1:amd64 systemd systemd-sysv systemd-timesyncd udev * SECURITY UPDATE: DoS via DHCP FORCERENEW - debian/patches/CVE-2020-13529.patch: tentatively ignore FORCERENEW command in src/libsystemd-network/sd-dhcp-client.c. - CVE-2020-13529 * SECURITY UPDATE: denial of service via stack exhaustion - debian/patches/CVE-2021-33910.patch: do not use strdupa() on a path in src/basic/unit-name.c. - CVE-2021-33910 [ Kai-Heng Feng ] * d/p/hwdb-Add-ProBook-to-use-micmute-hotkey.patch: - Add ProBook to use micmute hotkey (LP: #1930910) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=90ffcafda001ca1dd3598078f6f474327d5573c9 [ Zhang Youfu ] * d/p/lp1925827/0001-network-make-routing_policy_rule_remove-take-Manager.patch, d/p/lp1925827/0002-network-introduce-routing_policy_rule_equal.patch, d/p/lp1925827/0003-network-use-netlink_message_read_in_addr_union-where.patch, d/p/lp1925827/0004-network-set-FRA_PROTOCOL-to-RTPROT_STATIC-by-default.patch, d/p/lp1925827/0005-network-adjust-protocol-of-rules-sent-from-kernel-wh.patch, d/p/lp1925827/0006-network-treat-rule-which-has-l3mdev-flag-as-created-.patch, d/p/lp1925827/0007-network-drop-unnecessary-routing-policy-rules.patch, d/p/lp1925827/0008-network-do-not-serialize-deserialize-routing-policy-.patch, d/p/lp1925827/0009-network-constify-several-arguments.patch, d/p/lp1925827/0010-network-drop-unnecessary-checks.patch, d/p/lp1925827/0011-network-always-re-configure-rules-even-if-already-ex.patch, d/p/lp1925827/0012-network-set-RoutingPolicyRule-family-based-on-Family.patch, d/p/lp1925827/0013-network-drop-fib-rules-configured-with-Family-both.patch, d/p/lp1925827/0014-test-network-add-tests-for-fib-rules-with-Family-bot.patch: - backport routing policy rule fix (LP: #1925827) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=40ad9a36c7c68bc6f7456741b2a8d4ac313e88b1 [ Jeremy Szu ] * d/p/lp1932352-hwdb-Add-mic-mute-key-mapping-for-HP-Elite-Dragonfly.patch: - Fix micmute hotkeys on HP Elite Dragonfly (LP: #1932352) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=ff43db882db719e23bd52bf2aa74662865791c4d [ Dan Streetman ] * d/p/lp1931578/0001-network-default-RequiredForOnline-false-if-Activacti.patch, d/p/lp1931578/0002-networkctl-add-field-Required-For-Online.patch, d/p/lp1931578/0003-test-add-test-to-verify-RequiredForOnline-setting-wi.patch: Adjust default for RequiredForOnline when using ActivationPolicy (LP: #1931578) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=f2008e613c8ae5ea58d3171d7446b9772236ba4d * d/p/lp1894622-Add-systemd-resolve-backwards-compatibility-section-.patch: Add man page symlink and deprecation notice for systemd-resolve (LP: #1894622) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=acc7bb952109717777b774ab1e1c162f003048ae * d/p/lp1858210/0001-time-simplify-get_timezones.patch, d/p/lp1858210/0002-time-split-get_timezone-into-main-function-and-zone1.patch, d/p/lp1858210/0003-time-get-timezones-from-tzdata.zi.patch: Parse tzdata.zi so timedatectl list-timezones also lists aliases (LP: #1858210) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=24fb40db173a07559a805b2b61396dba805c8d45 * d/p/lp1891215/0001-fs-util-add-conservative_rename-that-suppresses-unne.patch, d/p/lp1891215/0002-resolved-don-t-update-resolv.conf-snippets-unnecessa.patch, d/p/lp1891215/0003-fs-util-rename-conservative_rename-conservative_rena.patch, d/p/lp1891215/0004-fs-util-make-sure-conservative_renameat-properly-det.patch: Don't rewrite resolv.conf is content unchanged (LP: #1891215) https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=b8f16358b838e8878ac4d669ce9b95e8d015ac86 ==== ubuntu-release-upgrader: 1:21.04.13 => 1:21.04.14 ==== ==== python3-distupgrade ubuntu-release-upgrader-core * Allow upgrades on Apple systems again (LP: #1934650) -- [1] http://cloud-images.ubuntu.com/releases/hirsute/release-20210720/ [2] http://cloud-images.ubuntu.com/releases/hirsute/release-20210623/