Tuesday, June 11, 2024

Help wanted! Port KDE Frameworks oss-fuzz builds to Qt6/KF6

If you're looking for an isolated and straightforward way to start contributing to KDE, you're in the right place. At KDE, we use fuzzing via oss-fuzz to try to ensure our libraries are robust against broken inputs. Here's how you can help us in this essential task.

What is Fuzzing?

Fuzzing involves feeding "random" [1] data into our code to check its robustness against invalid or unexpected inputs. This is crucial for ensuring the security and stability of applications that process data without direct user control.

Why is Fuzzing Important?

Imagine receiving an image via email, saving it to your disk, and opening it in Dolphin. This will make Dolphin create a thumbnail of the image. If the image is corrupted and our image plugin code isn't robust, the best-case scenario is that Dolphin crashes. In the worst case, it could lead to a security breach. Hence, fuzzing helps prevent such vulnerabilities.

How You Can Help:

We need to update the build of KDE libraries in oss-fuzz to use Qt6. This task could be challenging because it involves static compilation and ensuring the correct flags are passed for all compilation units.

Steps to Contribute:

  1. Start with karchive Project

    • Download oss-fuzz and go into the karchive subfolder.
    • Update the Dockerfile to download Qt from the dev branch and KDE Frameworks from the master branch.
  2. Update build.sh Script:

    • Modify the build.sh script to compile Qt6 (this will be harder since it involves moving from qmake to cmake) and KDE Frameworks 6.
  3. Check karchive_fuzzer.cc:

    • This file might need updates, but they should be relatively easy.
    • At the top of karchive_fuzzer.cc, you'll find a comment with the three commands that oss-fuzz runs. Use these to test the image building, fuzzer building, and running processes.

Need Help?

If you have questions or need assistance, please contact me at aacid@kde.org or ping me on Matrix at @tsdgeos:kde.org

Note:

[1] Smart fuzzing engines don't generate purely random data. They use semi-random and semi-smart techniques to efficiently find issues in the code.

Monday, May 13, 2024

KDE Goals April 2024 sprint

A few weeks ago I attended the KDE Goals April 2024 sprint

I was there as part of the Automation & Systematization sprint given my involvement in the release process, the "not very automatized" weekly emails about the status of CI about KDE Gear and KDE Frameworks, etc. but I think that maybe I was there more as "person that has been around a long time, ask me if you have questions about things that are documented through oral tradition"

I didn't end up doing lots of work on sprint topics themselves (though I participated in various discussions, did a bit of pair-programming with Aleix on QML accessibility issues, inspired DavidR to do the QML-text-missing-i18n check that he describes in his blog); instead I cheated a bit and used the sprint to focus on some of the KDE stuff I had a bit on my backlog, creating the KDE Gear release/24.05 branches and lots of MR reviewing and more!

Group photo

Thanks KDE e.V. for sponsoring the trip, if you would like such events to continue please we need your continued donations

And remember Akademy talk submission period ends in 10 days, send your talk now!

Saturday, May 04, 2024

Send your talks for Akademy NOW!

Akademy 2024 (the annual world summit for KDE) is happening in W├╝rzburg, Saturday 7th – Thursday 12th September. (I hope you knew that)


First of all, if you're reading this and thinking, "Should i go to Akademy?" 


The answer is [most probably] YES! Akademy has something for everyone, be it coders, translators, promoters, designers, enthusiasts, etc.


Now, with this out of the way, one of the many things that makes Akademy is the talks on the weekend, and you know who has something to say? *YOU*


Yes, *YOU*. I'm sure you've been working on something interesting, or have a great idea to share.


*YOU* may think that your idea is not that great or the things you work on are not interesting, but that's seldomly the case when someone explains me their "boring" thing they've been working on, i always think "Wow that's great".


Ok, so now that I've convinced you to send a talk proposal, when better than *TODAY* to send it?


Yes I know the Call for Participation is open until the 24 of May, but by sending it today you make sure you don't forget sending it later and also [more important for me] you help those of us in the Program Committee not to worry when the final date starts approaching and we don't have lots of talks yet because you all prefer sending talks on the very last minute.


So stop reading and send your talk today ;-)

Sunday, April 21, 2024

KDE Gear 24.05 branches created

Make sure you commit anything you want to end up in the KDE Gear 24.05
releases to them

Next Dates
  • April 25 2024: 24.05 Freeze and Beta (24.04.80) tag & release
  • May 9, 2024: 24.05 RC (24.04.90) Tagging and Release
  • May 16, 2024: 24.05 Tagging
  • May 23, 2024: 24.05 Release

https://community.kde.org/Schedules/KDE_Gear_24.05_Schedule

Saturday, February 10, 2024

Plucker/Palm support removed from Okular for 24.05

We recently remove the Plucker/Palm support in Okular, because it was unmaintained and we didn't even find [m]any suitable file to test it.


If you are using it, you have a few months to step up and bring it back, if not, let's have it rest.

Thursday, January 11, 2024

KDE Gear 24.02 branches created

Make sure you commit anything you want to end up in the KDE Gear 24.02 releases to them

Next Dates:

  •    January 31: 24.02 RC 2 (24.01.95) Tagging and Release
  •   February 21: 24.02 Tagging
  •   February 28: 24.02 Release


https://community.kde.org/Schedules/February_2024_MegaRelease