Distributions and plumbing digest for 2026-10-03

Fedora and NixOS threads dominated with packaging policy and store design debates, while Canonical posted experimental Snapdragon images and OpenWrt advanced UI and wireless work. Security tracking for pnpm and a Hydra anti-bot quirk completed the day.

Fedora escalates Showtime default-app dispute

A Fedora developer escalated a bug report policy dispute after Showtime was observed running as a hidden process and blocking video playback. The developer asked the GNOME release team to consider dropping Showtime as a core or default application. Desktop maintainers and downstream packagers should watch the governance outcome for default media player choices.

Casita content-addressed store announced for Nix

Domenkozar introduced Casita, an Apache2 content-addressed store layer aimed at a Nix rewrite, and supplied design comparisons to Snix. The proposal outlines a new store approach for source and build artifacts. Nix contributors tracking store architecture and rewrite efforts gain a concrete design point to evaluate.

Ubuntu Concept 26.10 Snapdragon beta posted

Canonical announced an experimental 26.10 Beta ISO for Snapdragon X2 hardware together with a 2027 official partnership with Qualcomm. The Concept edition targets early bring-up on the platform. Developers and OEMs working on Qualcomm laptops receive a public timeline and test image.

OpenWrt LuCI dashboard rewrite submitted

A developer submitted a pull request for luci-mod-dashboard, a modernized UI rewrite featuring charts and cards. Users reported bugs and offered refinement suggestions across a long thread. OpenWrt administrators assessing the web interface should review the feedback before adoption.

pnpm path traversal CVE tracked in Nixpkgs

The Nixpkgs security tracker opened an issue for CVE-2026-82392, a 7.1 path traversal via unvalidated depPath names in pnpm lockfile parsing that affects the virtual store linker. The entry records the lockfileToDepGraph weakness. Maintainers shipping pnpm need to follow the remediation status.

Hydra.nixos.org returns anti-bot Markov text

Users observed hydra.nixos.org serving Markov-generated text produced by an iocaine anti-bot filter instead of a normal 403 response, prompting compromise suspicions. Discussion clarified the filter behavior. Operators of public Nix infrastructure benefit from understanding the current anti-bot configuration.

Fedora debates version-specific dependency branches

Fedora packagers examined a prototype that would let builds select specific dependency releases so complex applications can be decoupled from distro versions. The proposal met pushback over long-term maintenance burden. Packagers handling tightly versioned stacks should weigh the trade-offs raised in the thread.

OpenWrt ath11k AQL and ATF design discussion

Participants discussed ath11k AQL and ATF patches along with offload TBF design, receiving feedback from Toke Høiland-Jørgensen. The thread also referenced positive experience with the ath10k path. Wireless stack contributors on OpenWrt obtain design input on airtime fairness and queueing.