Developers Planet

Peter Czanik: Syslog-ng hardening using Tor

Wed, 29 Jul 2026 11:37:05 +0000

For many years, I didn’t think that Tor could be useful for me. However, I’ve recently found a Gist on GitHub that describes how you can use it to harden your central syslog-ng server. And while I have yet to try it, at least now I have a reason to actually test Tor. The Tor website describes the project as follows: “Protect yourself against tracking, surveillance, and censorship.” I live in a country where thankfully I do not need these, nor do I perform any activities for which Tor would be useful.

Marcin Juszkiewicz: New keyboard: Alicja v2

Wed, 29 Jul 2026 09:26:00 +0000

After over a year of using Alicja, my prototype keyboard, it is time to build a new one: Alicja v2.

Experiments

Since building Alicja v1, I have been trying out a few design ideas. Some were intended to make the board sturdier, such as 3D printing a far better plate for another handwired build.

I tried different layouts. 3D printed a case for Redox keyboard, built one half and tried to use it. Not my style as it is too far from typical pc105 layout.

Created the H261 keyboard as some kind of orthogonal Alicja but it was too awful.

KLE NG to the rescue

I used Keyboard Layout Editor (KLE) with several of my keyboard experiments. And one day I got info from Adam Wysocki (adamws) about his KLE NG online tool. Which changed everything…

You see, with previous tools, designing a keyboard was a lot of work. Now, with KLE NG, it is a matter of creating a design and pressing some buttons. The result consists of PCB files for KiCAD and plate files for CAD software.

KiCAD

I loaded files created by KLE NG and it turned out that making a PCB for a new keyboard is quite simple:

add MCU (I used RP2040 Stamp from Solder Party)
add encoder
add whatever else
route everything
define PCB edge
generate gerber files
order PCB

During the whole process I learnt a lot, mostly from my friends in the retro community.

PCB in KiCAD

I ordered PCB in China, the process and shiping took about two weeks and I had five PCBs ready for soldering:

The physical PCB

Changes since the first Alicja keyboard

As you may see the main change is the PCB. Handwired keyboard had its own value but in the long run was a source of problems and frustration.

I changed the MCU board, as RP2040 Stamp allowed me to put USB signals on a connector instead of having it on MCU board. It will help when I add USB hub to the keyboard.

The whole keyboard uses Kailh MX hotswap sockets to make it easier to play with different switches. At the moment I am using some brown ones I got for free at the Mechanicon 2025 event.

I kept only one encoder — the one for media control. By default it changes volume level (and mutes on press). With the Fn key I can change to next/prev song and play/pause it.

There are some more keys — I added right Control key as I missed it several times. The whole Home/End/Ins/Del/PgUp/PgDn block is present. In a different setup than usual so adapting to it will take some time. And I have now F13 and F14 keys (not decided yet what to define on them).

The space in the middle got one of those funny 5-way switches. I have not decided how to use it yet. Maybe it will be some kind of silly mouse.

There is a connector with some free GPIO lines and power. Who knows, maybe one day I will decide to make a hole and add a trackpoint from some old Lenovo laptop.

I also have stabilisers for all 2u+ keycaps. Finally ;D

And the last change: a simple, 3D-printed case. Mounted on a few M2 screws (I used M2 threaded inserts). Will be replaced with a better design one day.

Temporary case

Mistakes

Of course, I had to make a few mistakes.

The main one, visible in the picture above, is the left space key. I used a 2u size for it instead of a 2.25u one. As a result, I had to choose some non-blank keycap from the Akko WOB MDA set instead of using a 2.25u blank one.

The other, not visible one, is the footprint of the 5-way switch. It does not work as expected. However, I might just need to re-solder the diodes the other way round, and it will work.

The connectors on the bottom side (both for the USB+buttons and the expansion port) are a bit bulky — I used JST XH 2.54 ones here. They were supposed to be used as THT rather than as SMD, so they take a lot of space. Anyway, those are inside the case, so no one can see them.

Plans for changes

I need to design a proper case. With space for USB ports (two at the back, one on the left) and an internal USB hub.

I also need a way to attach feet so the keyboard angle can be adjusted (now I have 4 rubber feet attached).

And I plan to use it for quite a while. Which will not stop me from working on some other designs.

Peter Czanik: Syslog-ng journald source: how to avoid log bombs on errors?

Wed, 22 Jul 2026 11:56:05 +0000

Choose your poison: Up until version 4.12, when syslog-ng ran into an error jumping to a saved systemd journal position, it read the journal from the beginning. With the latest syslog-ng version, you can configure what happens in case of such an error. Read more at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-journald-source-how-to-avoid-log-bombs-on-errors syslog-ng logo

Marcin Juszkiewicz: Half my life ago

Sun, 19 Jul 2026 10:04:00 +0000

Half my life ago, I graduated with a “magister inżynier” degree after 5 years of studies.

EN/US terminology

How to translate this “magister inżynier” into English? Well, it depends where you ask. In some places, it would be “Master of Science”, others will say that it was “Master of Engineering”. But does it matter? Not for me.

I studied “automation and robotics” at the Faculty of Mechanical Engineering at the Białystok University of Technology. And specialised in the “Information Systems”:

entry in “the index” document

After studies

After graduating, I worked as:

PHP programmer
Linux/Windows C++ programmer
Build Engineer
Software Engineer

Different jobs used different titles.

PHP programmer

In retrospect, those were weird years. The salary was low, the job was mostly boring, but the co-workers were nice. I learned that I did not want to deal with clients, that SCM (Source Code Management) matters and how to make people angry (and how to deal with it).

On 1st February 2007 I officially forgot all my PHP knowledge. The day after my last day at work as a PHP programmer.

Linux/Windows C++ programmer

This was a short job. The company specialised in set-top boxes and digital broadcast software. The team I joined was writing software for both the server side (Linux) and the client side (MS Windows). I worked there for four months. And learnt that Windows programming is definitely not my skill. And that up-to-date documentation matters — my first few days were spent reading the official documentation and crossing out or marking every single outdated part.

I also learnt that “fuchsia” is a colour (it was one of the basic colours in MS Windows). For the curious ones: Fuchsia is their name for Magenta.

Build/Software Engineer

In September 2006 I created my own, one-person company called “HaeRWu”. It is the Polish pronunciation of my “Hrw” nickname. IPA: /hʌ eə vʊ/ or /xa ɛə vuː/.

At first, it was a side job. But it also showed that there is far better money to be made in the Embedded Linux area. So a few months later, I became Build Engineer — a contractor. To OpenedHand, Intel, Vernier, BugLabs, ST Ericsson, Canonical, and several others.

The irony of it all

During all those years, I used to say that I do not work at things related to what I studied. But in reality, I did.

It was not “automation” (unless we count Buildbot, Jenkins, and other CI/CD systems I worked with).

It was not “robotics” but several robots use OpenEmbedded/Yocto derived operating systems. And for quite a while, I was one of top contributors to those projects.

But it was definitely “information systems”. As this name is so generic that almost everything I did fits.

Peter Czanik: Syslog-ng 4.12.0 available for Ubuntu 26.04 (Resolute)

Tue, 14 Jul 2026 12:41:41 +0000

Recently I was asked if syslog-ng supports Ubuntu 26.04 (Ubuntu Resolute). Yes, and with the arrival of the syslog-ng 4.12.0 release we also provide ready-to-use packages for it. The release notes mention it, and info is in the Readme on GitHub. I tend to mention FreeBSD and openSUSE more often in my blogs (personal preference), so today I installed Ubuntu 26.04 and tested syslog-ng myself. Read more at https://www.syslog-ng.com/community/b/blog/posts/syslog-ng-4-12-0-available-for-ubuntu-26-04-resolute syslog-ng logo

Peter Czanik: Syslog-ng Java destination disabled

Thu, 09 Jul 2026 13:19:41 +0000

For many years, syslog-ng used Java, where C libraries were unavailable. However, over the years native C libraries became available for Elasticsearch and Kafka, and HDFS practically disappeared. As a “scream test”, I am going to disable Java support in all of my syslog-ng packages. Once upon a time, Java support was added to syslog-ng to be able to load Elasticsearch Java drivers. Later, Kafka, HDFS, and a generic HTTP destination were also added.

Steve McIntyre: It's dead, Jim!

Sat, 27 Jun 2026 21:33:00 +0000

I previously wrote about the upcoming UEFI CA rollover. Well, it's happened now - the old Microsoft UEFI CA from 2011 expired yesterday:

Third Party Marketplace Root (used for signing option ROMs and other software)

  Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
  Validity
    Not Before: Jun 27 21:22:45 2011 GMT
    Not After : Jun 27 21:32:45 2026 GMT

It's dead - it's not coming back...

The world doesn't seem to have ended yesterday, so I guess we did ok? :-)

How did we do?

After a lot of prodding behind the scenes, Debian and many other distributions managed to get new shim binaries dual-signed with both the old and new CAs. The members of the shim-review team did a sterling job with reviews in the last few weeks. Since I started pushing people in May, we've had 21 reviews accepted successfully - see here for the list. Great stuff! Microsoft have also been working quickly - many of those shim submissions were accepted and signed by Microsoft very quickly too, with a turnaround time of less than 1 day in some cases.

Not all of those signed shims have been published and used by the distros involved yet, but expect to see them in the wild in the coming weeks and months.

These binaries should be good for people to use for the foreseeable future, until either we need to do another CA rollover or (sadly, more likely) we find an issue in shim that necessitates a new release.

What's next?

We already have one of our new dual-signed shim binaries in place in Debian, in unstable and testing (Forky) right now. In a couple of weeks from now, we'll be rolling out very similar new dual-signed shim binaries in the next point releases for Debian 12 (bookworm) and Debian 13 (trixie). We'll also be upgrading fwupd in both those point releases, to make DB and KEK updates work better.

For more information about these updates, see https://wiki.debian.org/SecureBoot/CAChanges. For your own safety, validate that your systems are updated when possible. If you don't, they may fail to boot in future.

Marcin Juszkiewicz: The end of the AArch64 desktop experiment

Fri, 26 Jun 2026 11:18:00 +0000

After about eleven months of using an AArch64 desktop, I decided to end that experiment.

Hardware used

About a year ago, I bought myself an Ampere Altra system. After moving some hardware around and making a few extra orders, the final setup was:


CPU	Ampere Altra Q80-30 processor (80 cores at 3.0GHz)
RAM	128 GB (8x 16GB HMA82GR7CJR8N-XN)
GPU	AMD Radeon RX6700XT
NVME	Lexar LM970 2TB ADATA SX8200 Pro 1TB
Motherboard	ASRock Rack ALTRAD8UD-1L2T
PSU	MSI MPG A850G (850W)
Case	Endorfy 700 Air
USB3	no-name USB 3.2/10Gbps controller (PCIe x4)

To be fair, I should mention that this is a server motherboard, not a desktop one, and Altra systems were never meant to be desktops (despite companies selling them as such). Naturally, the list of tested/approved devices (Qualified Vendor List (QVL for TLA fans)) is quite short and for Ampere Altra systems, it does not contain AMD Radeon GPU cards. They can be made to work, but this often requires additional effort.

The extra USB 3.2 controller allowed me to have more USB devices than the motherboard alone supported, and gave me some 10Gbps ports for connecting external NVMe drives.

The whole system was running just fine^* under Fedora 42–44.

The first issue

Have you noticed the small “*” at the end of the previous paragraph? The system I used was not quite Fedora — I had to use my own, self-built kernel.

You see, the PCI Express controller in the Ampere Altra has some issues. Let me quote the description of the Ampere Altra erratum 82288 patches:

Per Altra family erratum, PCIE_65 may cause invalid addresses to be generated on PCIe mmio writes, impacting certain device types, notably AMD GPUs, and thus the Altra family is not generally compatible with those device types.

And longer description from patch itself:

PCIe device drivers may map MMIO space as Normal, non-cacheable memory attribute (e.g. Linux kernel drivers mapping MMIO using ioremap_wc). This may be for the purpose of enabling write combining or unaligned accesses. This can result in data corruption on the PCIe interface’s outbound MMIO writes due to issues with the write-combining operation.

The workaround modifies software that maps PCIe MMIO space as Normal, non-cacheable memory (e.g. ioremap_wc) to instead Device, non-gathering memory (e.g. ioremap). And all memory operations on PCIe MMIO space must be strictly aligned.

So, to have a working Linux system, I had to rebuild the kernel on every package update. Which usually meant “weekly”. Each Monday or Tuesday, I would update the local copy of the Fedora kernel package repository and build it using my own versioning scheme, like “7.0.2-200.fc44.pcie65.6”. The “pcie65” part reminded me which patches I had applied, and the “6” was a counter for the patch rebases.

I cloned the repository from GitHub and then rebased patches, adapting them whenever they needed work. The side effect was that I often used a newer kernel than the official Fedora release — there is a “stabilisation” branch in the Fedora kernel package repo where the soon-to-be-pushed version is present. So, when Fedora had 6.19.y kernel, I had 7.0.z one.

So many cores, not enough speed

As I wrote in my previous post, having eighty CPU cores does not mean that the system is a good, fast desktop machine.

AMD GPU started failing

As I mentioned above, to get my AMD Radeon RX6700XT running properly I had to alter kernel with the out-of-tree patches. It worked, I could play some games, watch videos with hardware-assisted video decode acceleration.

Until one day, around the Linux 7.0 release, when it started to fail. Running a game ended with:

kernel: amdgpu 0000:03:00.0: Fence fallback timer expired on ring vcn_dec_0
kernel: amdgpu 0000:03:00.0: Fence fallback timer expired on ring vcn_dec_0
kernel: amdgpu 0000:03:00.0: Fence fallback timer expired on ring vcn_dec_0

Over and over again. Watching YouTube videos became impossible due to 720 out of 750 frames being dropped, etc.

Normally I would start to bisect the kernel to find out where the problem is. But I was running a tainted kernel due to PCIE65 patches so who knew where the problem actually was…

Let’s get Nvidia

I bought an Nvidia RTX 2060 graphics card and put it in place of the AMD Radeon. It turned out that if I wanted to use it with the nouveau kernel driver I still needed PCIE65 patches applied…

So I tried default Fedora kernel with Nvidia binary driver. And it worked fine. Video decoding was accelerated, some games under Wine worked as well.

But then I started FreeCAD. And OrcaSlicer. And in both cases I got crash and exit…

It turned out that there was no org.freedesktop.Platform.GL.nvidia in Flatpak repositories for AArch64. And I used both of those tools quite often.

Powering up the old x86-64…

At that point, I gave up. And booted my x86-64 system, which had been powered off all that time. There were a lot of cables to move, some new ones to arrange, and now I have both “wooster” (Ampere Altra) and “puchatek” (Ryzen 5 3600) systems running under my desk.

Moving from 80 cores to 6 cores (12 threads) was a weird experience. A much smaller number, yet things work fine. I can load all threads and the music still plays. All games from my Steam library are playable. A working FreeCAD allows me to finish designing cases for my home projects and I can 3D print prototypes straight from OrcaSlicer.

The “wooster” system stays powered on, churning through RISC-V package builds. It may be weak in single-thread, but it flies when it comes to multi-core load.

Conclusion

As for the Ampere Altra, I am not planning to repeat this experiment. Another AArch64 desktop attempt would require a completely new hardware platform. And I have no plans to spend over twenty thousand PLN to buy an Nvidia DGX Spark system.

Peter Czanik: syslog-ng 4.12.0, syslog-ng PE 8.2.0 and SSB 7.8.0 are now available

Tue, 16 Jun 2026 14:50:23 +0000

Today, the syslog-ng team released three different syslog-ng versions, which provided a good opportunity to wear my “Release is coming” t-shirt. This coordinated release is due to an SQL injection security bug fix, even if most likely it affects less than a handful of people (I mean, is there anyone who still uses SQL to store logs in 2026…?) Release is coming What’s new? syslog-ng OSE 4.12.0 arrives with performance optimizations, making syslog-ng more scalable in several situations.

Steve McIntyre: Secure Boot and Microsoft CA Rollover - user-facing documentation

Fri, 05 Jun 2026 17:20:00 +0000

I previously wrote some advice for developers and distributions about the upcoming Microsoft CA Rollover, and I hope that was useful for people.

I've now also added some user-facing documentation about the CA rollover in the Debian wiki at https://wiki.debian.org/SecureBoot/CAChanges. I've added guidance on managing certificate updates on Debian systems: how to check if a system needs those updates and various ways to make them happen. If you're running Secure Boot systems, this may be important for you.

While the same event is the primary cause for these docs, they're designed for different people. Again, I hope this new doc is helpful!

Peter Czanik: The status of OpenSSL 4.0 support in syslog-ng

Thu, 04 Jun 2026 12:01:40 +0000

OpenSSL 4.0 was released just over a month ago. So, how is its support progressing in syslog-ng? Well, Git master already supports it, and the patch is easy to backport to earlier releases. At the same time, version 4.12 will support OpenSSL 4.0 out of the box. A month ago, someone from Gentoo Linux reached out to the syslog-ng team about OpenSSL 4.0 support. I asked the community about their expectations, knowing that version 4.

Marcin Juszkiewicz: Arm desktop: so many cores, not enough speed

Mon, 01 Jun 2026 13:06:00 +0000

Using a system with 80 AArch64 cores can be a pleasure. Or a pain…

Multicore heaven?

Having 80 cores sounds nice, doesn’t it? But not so much during actual use…

You see, building Fedora packages was flying by. With all cores in use, ccache buffers filling up (in case of rebuilds), and 128 GB of RAM in constant use, etc.

But at the same time, 100% load on all cores means you cannot listen to music on Spotify or watch online videos, etc. All that because the CPU cores are occupied by the build processes.

I tried to use cgroups to limit cpu.max for each fedpkg mockbuild call. It did not help much: the audio was still jerky.

To compare: I wrote this post on a system powered by a Ryzen 5 3600 CPU while a package build was running in the background. All twelve CPU threads were 100% busy, yet the music did not skip.

All of this shows that cores-heavy CPUs are perhaps not a good choice for a desktop machine. Latencies, the scheduler and context switching — all of this introduces enough noise to make a desktop user suffer.

The lack of single-thread speed

Arm processors are good in many cases, as long as you do not need pure, single-thread, CPU power.

It is very noticeable in a web browser. For example, Bitwarden unlocks with a noticeable delay, while on a Ryzen 5 3600, it is nearly instant. And it feels even worse when you watch some YouTube videos like “who will make faster PC on a €100 budget”, and then you run the same browser benchmark and get worse results…

Many software builds also highlight this problem. I have a feeling that developers have grown used to a small number of fast CPU cores, which is the norm on the x86-64 architecture, and their code is written to take it for granted.

And then you look at your machine, where 70 cores do nothing, waiting for some code to finally compile or link. I have seen one software package where the bootstrap was composed of TWO source files. Both were over two megabytes in size and full of machine-generated C code. Two cores were kept busy for quite a while, while the other 78 had to wait.

Not much has changed since my the “From the diary of AArch64 porter — parallel builds” blog post from eight years ago.

Of course, there are also packages which will take all cores, whole memory and as much swap as possible, and do magic in nearly no time. When I started build of the PrusaSlicer package, I had to add some swap because Firefox was gone due to OOM. Having less than 2 GB of RAM per CPU core really sucks ;D

Summary

To use a desktop system you do not need many cores. As long as they are fast.

Peter Czanik: Nightly syslog-ng containers based on Alma Linux

Tue, 26 May 2026 12:02:31 +0000

For many years, the syslog-ng project provided container images based on Debian. Most of our users run syslog-ng on RHEL & compatibles, and have asked for an RPM-based container. So, nightly containers based on Alma Linux are now also available. A while ago, I prepared a small test project to run syslog-ng in an Alma Linux container: https://www.syslog-ng.com/community/b/blog/posts/experimental-syslog-ng-container-image-based-on-alma-linux However, that was only an experiment which I never updated. Fast forward to today: nightly syslog-ng containers based on the latest syslog-ng git snapshot package builds are now available on the Docker Hub!

Marcin Juszkiewicz: 3D printing at home

Fri, 22 May 2026 07:17:00 +0000

After ten years of thinking about buying a 3D printer, I finally bought one.

First time: Anet A6

Around 2016 I was playing with some 3D printer at my friend’s company office. But no one there knew how to run it and I felt weird sitting at their place.

So started checking the market and found Anet A6 printer. Reviews were mixed. I got the impression that once you build the printer you need to print half of it again and repeat until it gets acceptable quality. I decided to skip it.

Some months later, at some local event, I saw Anet A6/A8 printers. Ouch, they were terrible!

Second moment: Ender 3

A few years passed, Creality launched Ender 3 line of 3D printers. Reviews were quite positive, printers looked more like a product than DIY hobby.

And then I got a message from brother-in-law that he bought one. So I did not have to.

Over the years, I printed countless items with his help.

Third case

A few months ago I started thinking about buying a 3D printer to have one at home, eliminating the need to go ~30km each way to collect prints.

Checked the market options and started watching reviews. Some models started to appear on a list of considered ones:

Anycubic Kobra S1
Bambu Lab P1S
Creality K2
Elegoo Centauri Carbon

Crossing out models

The more reviews I watched/read, the more I started to cross out.

Bambu Lab P1S

Bambu Lab P1S went out due to lack of communication between OrcaSlicer running on AArch64 desktop system — their networking plugin is a closed binary available only for x86-64 architecture.

Also there was a lot of noise about license violations.

And sorry, but Bambu Lab users give off a vibe similar to the Apple users. You know, “there is only one god” kind.

Elegoo Centauri Carbon 1/2

Carbon 1 has enclosure but, at the time I looked, it lacked any multimaterial solution. Instead they produced Centauri Carbon 2 (CC2) printer. Which looks weird.

The Carbon 2 requires its own slicer as it looks like more and more things done by other printers are being moved to slicing software. Anyone remember the HP 710c “winprinter”?

Creality K2

This printer did not vanish from the list — I decided to buy Anycubic Kobra S1.

First day

It took almost two weeks from order to delivery but yesterday I got Anycubic Kobra S1 Combo at home. I unpacked it, set it up, and played a bit with printing some basic stuff.

Rinkhals

I would not be myself without modifying the software of a device I just bought. And a 3D printer is no different.

So I took USB thumbdrive and installed Rinkhals to gain more control over my new device.

I do not care much about what exactly this project installs on my printer. Do not have to know what Klipper, Mainsail or Moonraker are. What matters to me is the ability to print directly from the OrcaSlicer running on my AArch64 desktop.

What to print?

My list of things to print has about twenty entries. Ranging from some small home improvements or replacing missing/broken pieces, to cases for my DIY keyboards and devices.

In the beginning, it gives instant gratification. I printed a piece in 3 minutes and one thing at home works better. Another piece, and my Lenovo thin terminal no longer moves because it is secured in three places.

Trivia

As one of things I got was ability to log in via SSH I had to check what hardware is used:

root@kobra-ks1-02ab:/root# cat /proc/cpuinfo 
processor       : 0
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 48.00
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

Yes, this is single Cortex-A7 core. Rockchip RV1106G SoC.

I was hoping to never see 32-bit Arm hardware again…

Steve McIntyre: Secure Boot and Microsoft CA Rollover - a heads-up for distributions

Thu, 21 May 2026 23:43:00 +0000

Background

I'm a member of the EFI team in Debian, and I've done much of the work for Debian to support UEFI Secure Boot (SB) in recent years. We have included that support for a number of releases now, starting back with Debian 10 (aka Buster).

I'm also a long-time accredited member of the shim-review team, the group that checks and approves shim binaries before Microsoft will sign them.

See the Debian wiki for lots of background details about Secure Boot and how we do things in Debian.

Secure Boot depends on signatures, which are verified during boot using a chain of X.509 certificates. The root certificate(s) in the chain are embedded in computer firmware, then later software such as shim can add more certificates to extend the trust. Easy, right?

The problem - certificates expire...

Microsoft administer the most widespread Secure Boot root certificates, and have been doing so since the very beginning of UEFI Secure Boot as a concept. The Microsoft UEFI CA certificates are included in just about every x86 and x86-64 computer shipped, and also in quite a lot of arm64 machines too.

(The fact that Microsoft is therefore a gatekeeper for Linux running under Secure Boot on most machines is very unpopular in some quarters, but this is just a fact of life in the world we live in. None of the following will affect you if you're using Secure Boot with your own keys only.)

The current certificates have been around since 2011:

1. Windows Production PCA 2011 (used for signing Windows components)

  Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Production PCA 2011
  Validity
    Not Before: Oct 19 18:41:42 2011 GMT
    Not After : Oct 19 18:51:42 2026 GMT

This expires in October this year, ~5 months from now.

2. Third Party Marketplace Root (used for signing option ROMs and other software)

  Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
  Validity
    Not Before: Jun 27 21:22:45 2011 GMT
    Not After : Jun 27 21:32:45 2026 GMT

For Linux folks, this second certificate is more interesting - it is the root of the certificate chain that Microsoft use when signing shim for Linux distributions

This CA expires 5 weeks from today.

OMG!!! Will all my existing Secure Boot machines stop booting?

Almost definitely not, no.

The specification for UEFI Secure Boot expects that valid dates on certificates should not be enforced for signatures here. All that matters here is the signatures themselves. Modulo buggy firmware, existing signed binaries should continue just fine.

New CAs to be aware of

Microsoft have published three new CAs:

1. A new CA used for signing device option ROMs

  Subject: C=US, O=Microsoft Corporation, CN=Microsoft Option ROM UEFI CA 2023
  Validity
    Not Before: Oct 26 19:02:20 2023 GMT
    Not After : Oct 26 19:12:20 2038 GMT

2. A new CA used for signing Windows components

  Subject: C=US, O=Microsoft Corporation, CN=Windows UEFI CA 2023
  Validity
    Not Before: Jun 13 18:58:29 2023 GMT
    Not After : Jun 13 19:08:29 2035 GMT

3. A new CA used for signing other software (e.g. shim)

  Subject: C=US, O=Microsoft Corporation, CN=Microsoft UEFI CA 2023
  Validity
    Not Before: Jun 13 19:21:47 2023 GMT
    Not After : Jun 13 19:31:47 2038 GMT

New machines and updated older machines will most likely have all of these new CAs installed. New machines are already shipping that only include the new CAs; they will not trust older software and this has already started causing problems for some users.

Isn't this is all a bit short notice?

Yes it is. :-(

A common rule of thumb when deploying CA certificates is to start the process of replacement ("rollover") when a certificate reaches half of its lifetime. Unfortunately, Microsoft have done this very late. They generated new keys in 2023, but didn't start signing shim and other third-party software with the UEFI CA until October 2025.

If I'm a distro developer, what should I do?

If you already have an old shim signed by Microsoft for your distribution from before October 2025, then it will only be signed using the older CA that expires soon. On newer machines, your users will already not be able to boot your distro with Secure Boot enabled.

If you want your users to be able to use Secure Boot in future, you will need to get a new shim build submitted, reviewed and signed using the new CA. However, that signed build will not work on older machines unless they have had the new CAs installed. This is also likely to cause problems for some users. You should encourage your users to update their systems NOW before things break for them.

There is an interim solution which will work, but only if you're quick! Microsoft are currently returning shim binaries signed using both the old CA and the new CA. More specifically, for every binary that is submitted they will return two: one signed with each CA. If you use these directly, you'll need to plan to publish:

2 signed shim binaries
2 installers
2 sets of live/installer images
etc.

and explain to your users how they'll need to pick one. Good luck with that!

However, it is possible to extract signatures from those signed shim binaries and attach them all onto one shim, giving you the Holy Grail here - a single shim that will boot on the vast majority of machines. Indeed, this is what I'm planning on doing in Debian. So-called "dual-signed" shims may provoke issues with buggy firmware, so be aware that you may have to deal with this too. But take heart: early testing by various distro folks with a dual-signed Fedora shim did not show any problems.

You have 5 weeks and counting...

Microsoft have promised to continue signing with the old CA as long as possible, right up to the last day. They understand how awkward things are going to be otherwise, and are trying to help here as much as possible.

In the shim-review team, we have been expecting to see a surge of shim submissions before the old CA expires, to make the most of the "Holy Grail" dual-signed shims described above. But we've been really surprised that this has not been happening.

So, this blog is a wake-up call for people doing Secure Boot with shim. Even if you're not going to be ready to ship a new shim binary to your users, you should really try to get a new build prepared and signed NOW so that you have it available to tide you over through the coming CA transition. Don't leave it too late.

If you're not sure what to do, ask me and the other shim-review folks. We're happy to give advice. But don't delay.

You have 5 weeks and counting.

How to make a dual-signed shim binary

Microsoft only ship binaries with a single signature included. To make things work, extract those signatures using sbattach --detach (from the sbsigntools source package, available in most distributions. Then apply those signatures one at a time to your shim binary, using sbattach --attach. Simple, really. There's one strong recommendation here: order the signatures on your shim oldest first - that way, old buggy firmware implementations that potentially don't look for more than one signature will find the old signature first.

pesign can also handle moving signatures around, but I chose sbsigntools when doing this work myself.

If you're looking to see how others handle multiple signed shim binaries, feel free to look at the Debian shim-signed package for examples. The repo is https://salsa.debian.org/efi-team/shim-signed.git.

References

Microsoft ship all their CA certificates and binaries you can use to update computers at https://github.com/microsoft/secureboot_objects
The Debian wiki has a lot more information about UEFI and Secure Boot already, and I'm going to be adding more user-focused documentation about the CA rollover at SecureBoot/CAChanges shortly.

I'll add more links here in the coming weeks.

Peter Czanik: Learning syslog-ng

Tue, 19 May 2026 11:15:16 +0000

How can you learn syslog-ng? There are many possibilities, depending on your time and budget. Possibilities range from tutorial series through reading the documentation to instructor-led training. Find out which one is for you! Read more at https://www.syslog-ng.com/community/b/blog/posts/learning-syslog-ng syslog-ng logo

Marcin Juszkiewicz: New Fedora package: fedora-active-user

Mon, 04 May 2026 06:37:00 +0000

During my work on the RISC-V 64-bit architecture port of Fedora, I created several pull requests to Fedora packages. And some were stalled…

Non-responsive maintainer process

Fedora project has a process called ‘non-responsive maintainer’. You check is maintainer on vacation, check latest activity and open a bug asking for action.

The problem was that it linked to fedora_active_user.py script which does not work since Fedora 41. During cycle of that release the python-fedora package got retired and no one updated the script.

Let me look

As my actions brought some complains (and some discussions) I decided to take a look at the script and make it work with current Fedora releases. Created pull request, mailed original author etc.

There was no answer of any kind so I decided to take over maintaining the script. Rewrote it to be Python 3 only, moved from urllib to requests, refactored some repeated code into functions etc.

Then started checking service by service how to get things working better. Turned out that script had several assumptions which not always apply.

FAS has separate email for Bugzilla

Fedora Accounts Service (FAS) has a separate field for the Bugzilla email. I did not had to look for testing accounts for this because that’s my case — I use ‘short’ Red Hat email in Bugzilla due to Single Sign-On (SSO) service we use and my ‘long’ one for the rest. So fedora-active-user script grabs user information from FAS and checks for separate Bugzilla email and use it if present.

FAS query requires Kerberos

To query FAS you need Kerberos ticket. Both urllib and requests packages have a way to use it for authentication — one extra package is needed to make it work.

Lack of valid ticket is caught and info is provided to the user.

Bugzilla is tricky

Querying Bugzilla service is the trickiest part. You can request data but there is no warranty that you get the latest one. Sure, there is the ‘order’ field for a query but it feels like a mere suggestion. It is nothing strange to get 2008 entries next to 2023 ones.

Wanna help?

For now, I am hosting fedora-active-user on GitHub. Will move it to Fedora Forge later this year. Feel free to open issues, send pull requests if you have suggestions or changes.

Current version is not the best one. It is a bit better than it was two weeks ago.

At the moment package is present in Fedora rawhide. I am waiting for branches for stable releases and updates will follow.

Example output

$ fedora-active-user --user hrw

Last action on koji:
   2026-05-04 built fedora-active-user-26.05.04-1.fc45
   2024-09-12 built python-system-calls-6.11.0-1.fc42
   2024-01-08 built python-system-calls-6.7.0-1.fc40
   2023-09-18 built python-system-calls-6.6.0-1.fc40
   2023-05-08 built python-system-calls-6.4.0-2.fc39
   2022-08-06 built python-system-calls-5.19.0-2.fc37
   2022-07-25 built python-system-calls-5.19.0-1.fc36
   2022-07-25 built python-system-calls-5.19.0-1.fc37
   2022-01-10 built python-system-calls-5.16.2-1.fc36
   2021-11-15 built python-system-calls-5.16.0-1.fc35

Last package updates on bodhi:
   2026-05-04 fedora-active-user-26.05.04-1.fc45
   2024-09-12 python-system-calls-6.11.0-1.fc42
   2024-01-08 python-system-calls-6.7.0-1.fc40
   2023-09-18 python-system-calls-6.6.0-1.fc40
   2023-05-08 python-system-calls-6.4.0-2.fc39
   2022-08-06 python-system-calls-5.19.0-2.fc37
   2022-07-25 python-system-calls-5.19.0-1.fc36
   2022-07-25 python-system-calls-5.19.0-1.fc37
   2022-01-10 python-system-calls-5.16.2-1.fc36
   2021-11-15 python-system-calls-5.16.0-1.fc35
   2021-11-15 python-system-calls-5.16.0-1.fc36
   2021-09-21 python-system-calls-5.15.5-1.fc36

Last actions performed according to fedmsg:
   2026-05-04 hrw commented on the pull-request rpms/prusa-slicer#67
   2026-05-04 hrw's Badges rank changed from 272 to 260
   2026-05-04 hrw was awarded the badge `Missed the Train`
   2026-05-04 hrw commented on update fedora-active-user-26.05.04-1.fc45 (karma: 0)
   2026-05-04 fedora-active-user-26.05.04-1.fc45 was tagged into f45 by bodhi
   2026-05-04 fedora-active-user-26.05.04-1.fc45 was untagged from f45-updates-candid
   2026-05-04 hrw's fedora-active-user-26.05.04-1.fc45 bodhi update has met stable te
   2026-05-04 fedora-active-user-26.05.04-1.fc45 was untagged from f45-updates-testin
   2026-05-04 fedora-active-user-26.05.04-1.fc45 was tagged into f45-updates-testing-
   2026-05-04 fedora-active-user-26.05.04-1.fc45 was untagged from f45-signing-pendin

Last emails on Fedora mailing lists:
   2026-04-29 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora
   2026-04-17 mjuszkiewicz@redhat.com as Marcin Juszkiewicz mailed devel@lists.fedora

Bugzilla activity (may not be the latest):
   No activity found on Bugzilla

Looks like I still need to work on querying Bugzilla ;D

Marcin Juszkiewicz: Twenty-one years of blogging

Wed, 01 Apr 2026 08:13:00 +0000

Twenty-one years ago I wrote:

This is 3th (or 4th) version of my website and I hope that this time it will stay for much longer and that I will use it more often to publish some OpenEmbedded related articles and informations.

And here we are, 21 years later. With the same website.

Time flows

For sure I managed to keep it running “for much longer” than any earlier version of my website. The previous one existed for about two years. Older ones were more Lynx bookmarks split into several files rather than a website.

Engines

When I started this website in 2005, WordPress was something new. Easy to use, no HTML knowledge needed etc.

In 2006, I created my own consulting company and moved to WordPress MU (MultiUser). I had two separate websites then — one for my company and my personal blog. Merged them into one a few years later.

In the meantime WPMU got integrated into WordPress. And one day I recreated the whole website on a fresh install of WP to cut more than half of the database size — there was a lot of unused data left from several plugins I used through all those years.

And then, in 2019, I said “good bye” to WordPress and moved to Pelican, static page generator. It was a good move. It cost me a day or two of handling WP export, cleaning posts, sorting out tags, images etc. It was worth it — I still use Pelican to generate this website.

Grammar and language

Reading old posts (especially pre-2010 ones) shows how awful my English grammar and vocabulary were. In 2010, when I signed contract with Canonical to work at Linaro, I went to language school to work on improving both grammar and vocabulary. And it paid off.

I am not going to edit language of my old posts. I may alter tags, formatting or fix/remove links in them. But not how they were written. I keep them as a reminder how my English looked in the past. Not that it is fluent and nice nowadays :D

Markdown all the time

I have never been a fan of using HTML to edit blog posts. So when I discovered Markdown I started using it. With PHP Markdown Extra extensions.

My current Pelican configuration for Markdown is simple:

MARKDOWN = {
    'extension_configs': {
        'markdown.extensions.extra': {},
        'markdown.extensions.meta': {},
        'markdown_del_ins': {},
        'yafg': {},
    },
    'output_format': 'html5',
}

It gives me abbreviations, attribute lists, definition lists, fenced code blocks, footnotes, markdown in html, tables, meta-data, delete and insert tags and the ‘yafg’ extension wraps images into the <figure> tag with a caption. In other words: all stuff I ever used in any post.

Social Media

Around 2009 - 2011 I started using social media and blog slowly started getting fewer short entries as those went to twitter, facebook and google+ services.

Still kept the rule of posting long texts on my website with links shared rather than posting only on social media.

Article	Hacker News	Lobster	points	comments
RISC-V Is Sloooow	thread	thread	317	379 + 111
64-bit ARM desktop hardware?	thread		243	169
Bought myself an Ampere Altra system	thread	thread	206	97 + 9
Arm desktop: emulation	thread	thread	98	50 + 7
Twenty years of my work with Arm architecture	thread		94	54
What is wrong with all those AArch64 desktops?	thread		90	141
AArch64 Boards and Perception	thread	thread	67	31
How to Survive FOSDEM	thread	thread	42	15 + 5

Popular tags

It is easier to check which tags were the most popular during all those 21 years:

tag name	number of articles
Linaro	177
Ubuntu	170
AArch64	154
OpenEmbedded	129
Fedora	114
Nokia	90
development	84
Debian	82
Openmoko	70
conferences	64
life	64
phone	58
travels	52
Linux	51
Maemo	47
OpenZaurus	45
Arm	44
website	41
Poky	40
Zaurus	40
Red Hat	31

The high position of the Ubuntu tag suggests a need for review as for some posts it was used to get them placed on the Planet Ubuntu aggregator.

With the Nokia-related posts comes a story. Each post bumped ‘karma’ on Maemo.org website. And I mostly complained in them. But ‘karma is a beach’, right? I got it high enough to get invitation to the Nokia N900 developer program. It was a nice phone with software written to gather complaints.

Requested edits

During all those years there were some requests to edit some of my posts. I rejected some and fulfilled others.

No camera, please

In 2009 I received NHK15 developer board from ST-Ericsson. As I had not signed any NDA, I decided to show them the post before publishing to make sure I do not mention too much.

Can you remove the camera module from it? It will not be in a boxes we give out during the event.

I took one photo again, removed mentions of a camera module and published.

Move forward two months to the ST-Ericsson Community Workshop 2009 event. A day before it, decision was made to include that camera module. One guy was going through each box to add it…

Pre-announced SBC

Most of Linaro Connect events had a ‘Demo day’ event where companies, projects and developers presented some interesting things related to our work. I was there walking, looking and asking questions.

And one year I asked a company (sorry, no names this time) will they have an SBC similar to the Beagleboard. And the answer was “yes, it will be called A_NAME”. I asked was this information public and can I write about it on my blog. Got confirmation, so an hour later I mentioned it in a blog post.

A few minutes later, when I was going to the hotel bar for an evening event, I was asked by my manager where I got that info from. And then got a request to remove it “because they plan to announce it next week on some BIG trade show”.

I took my phone from my pocket, edited and we went for a beer.

Lessons learnt

Whenever non-public information is shared, wait until it is properly announced publicly. Then, check how much information was released. My work is related to many non-disclosure agreements (NDAs). So, if I know something, it needs to be checked against public information before I can disclose any of it. You may also want to confirm with an official source that the public disclosure was not due to a leak or other incorrect source of information.

Fewer technical posts

If you look into archives page you may notice that there are fewer technical posts than there were in previous years. There is a simple explanation for it:

Well, you are some kind of influencer, get over it. People do pay attention to what you write.

Writing a technical post nowadays means:

asking a few people who know stuff to check whether I was right or wrong
asking a few people who do not know stuff to check what I missed
doing some technical review and correction

This changes writing a post for a personal blog into writing a technical article.

And then publishing still means a lot of online comments where maybe 25% of them make any sense.

Plans for the future

I do not have any special plans for the future of this website. Will keep it operational and add posts from time to time. I still have some ideas for the content and have some drafts which wait for my retirement.

Marcin Juszkiewicz: Upgraded to OpenWRT 25.12

Tue, 24 Mar 2026 07:18:00 +0000

I upgraded my router to OpenWRT 25.12. Nothing strange right?

And then I realized that I use OpenWRT for over twenty years…

All started with Linksys WRT54GS

Long, long time, when I worked from an office, I got Linksys WRT54GS as a donation. IIRC I got money to buy it as this was simpler than sending device from abroad.

Having Wi-Fi at home allowed me to test more stuff on Sharp Zaurus devices. Or install/upgrade packages in an easy way.

It was running OpenWRT WhiteRussian for quite a while as device upgrades were quite problematic at that time.

Other devices

During next years I used a mix of devices running OpenWRT. Routers, access points or devices which served both those functions at the same time.

Netgear WNDR4300 N750 brought 5GHz Wi-Fi network to my flat. Running MiniPC + Belkin BT3200 (aka Linksys E8450) combo brought network separation as I started using VLANs. Etc. etc.

Why OpenWRT?

Having a unified way of doing network setup was a key for me when I was choosing next router/AP device. Or ability to install additional packages which brings more functions. Especially since 512 MB RAM became popular in a router.

Why it matters to me? I am not a network admin. Never planned to be. So being able to switch to a new device and restore configuration from a previous one saves my time.

There are no limitations on how I name my Wi-Fi networks (national characters, emojis, spaces), how many of them will be, what kind of firewall zones I want and which devices/networks are in which zone. Etc…

Gema Gomez: Overview of 2025

Fri, 02 Jan 2026 00:00:00 +0000