by Alexander Bokovoy and Andreas Schneider

FOSDEM 2025 is just behind us and it was a great event as always. Alexander and I had a chance to talk
about the local authentication hub project. Our FOSDEM talk was “localkdc – a general local authentication hub”. You can watch it and come back here for more details.

But before going into details, let us provide a bit of a background. It is 2025 now and we should go almost three decades back (ugh!).

History dive

Authentication on Linux systems is interwoven with the identity of the users. Once a user logged in, a process is running under a certain POSIX account identity. Many applications validate the presence of the account prior to the authentication itself. For example, the OpenSSH server does check the POSIX account and its properties and if the user was not found, will intentionally corrupt the password passed to the PAM authentication stack request. An authentication request will fail but the attempt will be recorded in the system journal.

This joint operation between authentication and identification sources in Linux makes it important to maintain a coherent information state. No wonder that in corporate environments it is often handled centrally: user and group identities stored at a central server and sourced from that one by a local software, such as SSSD. In order to consume these POSIX users and groups, SSSD needs to be registered with the centralized authority or, in other words, enrolled into the domain. Domain enrollment allows not only identity and authentication of users: both the central server and the enrolled client machine can mutually authenticate each other and be sure they talk to the right authority when authenticating the user.

FreeIPA provides a stable mechanism for building a centralized domain management system. Each user account has POSIX attributes associated with it and each user account is represented by the Kerberos principal. Kerberos authentication can be used to transfer the authentication state across multiple services and provides a chance for services to discover user identity information beyond POSIX. It also makes strong linking between the POSIX level identity and authentication structure possible: for example, a Kerberos service may introspect a Kerberos ticket presented by a user’s client application to see how this user was authenticated originally: with a password or some specific passwordless mechanism. Or, perhaps, that a client application performs operations on behalf of the user after claiming it was authenticated using a different (non-Kerberos) authentication.

Local user accounts’ use lacks this experience. Each individual service needs to reauthenticate a user again and again. Local system login: authenticate. Elevating privileges through SUDO? Authenticate again, if not explicitly configured otherwise. Details of the user session state, like how long this particular session is active, is not checked by the applications, making it also harder to limit access. There is no information on how this user was authenticated. Finally, overall user experience between local (standalone) authentication and domain-enrolled one differs, making it harder to adjust and educate users.

Local authentication is also typically password-based. This is not a bad thing in itself but depending on applications and protocols, worse choices could be made, security-wise. For example, contemporary SMB 3.11 protocol is quite secure if authenticated using Kerberos. For non-Kerberos usage, however, it is left to rely on NTLM authentication protocol which requires use of RC4 stream cipher. There are multiple attacks known to break RC4-based encryption, yet it is still used in majority of non-domain joined communications using SMB protocol simply because there was no (so far) alternative. To be correct, there was always an alternative, use of Kerberos protocol, but setting it up for individual isolated systems wasn’t practical.

The Kerberos protocol assumes the use of three different parties: a client, a service, and a key distribution center (KDC). In corporate environments a KDC is part of the domain controller system, a client and a service are both domain members, computers are enrolled in the domain. The client authenticates to KDC and obtains a Kerberos ticket granting ticket (TGT). It then requests a service ticket from the KDC by presenting its TGT and then presents this service ticket to the service. The service application, on its side, is able to decrypt the service ticket presented by the client and authenticate the request.

In the late 2000s Apple realised that for individual computers a number of user accounts is typically small and a KDC can be run as a service on the individual computer itself. When both the client and server are on the same computer, this works beautifully. The only problem is that when a user needs to authenticate to a different computer’s service, the client cannot reach the KDC hosted on the other computer because it is not exposed to the network directly. Luckily, MIT Kerberos folks already thought about this problem a decade prior to that: in 1997 a first idea was published for a Kerberos extension that allowed to tunnel Kerberos requests over a different application protocol. This specification became later known as “Initial and Pass Through Authentication Using Kerberos V5 and the GSS-API” (IAKerb). An initial implementation for MIT Kerberos was done in 2009/2010 while Apple introduced it in 2007 to enable remote access to your own Mac across the internet. It came in MacOS X 10.5 as a “Back to My Mac” feature and even got specified in RFC 6281, only to be retired from MacOS in 2019.

Modern days

In the 2020s Microsoft continued to work on NTLM removal. In 2023 they announced that all Windows systems will have a local KDC as their local authentication source, accessible externally via selected applications through the IAKerb mechanism. By the end of 2024, we have only seen demos published by Microsoft engineers at various events but this is a promising path forward. Presence of the local KDC in Windows raises an interoperability requirement: Linux systems will have to handle access to Windows machines in a standalone environment over SMB protocol. Authentication is currently done with NTLM, it will eventually be removed, thus we need to support the IAKerb protocol extension.

The NTLM removal for Linux systems requires several changes. First, the Samba server will need to learn how to accept authentication with the IAKerb protocol extension. Then, Samba client code needs to be able to establish a client connection and advertise IAKerb protocol extension. For kernel level access, the SMB filesystem driver needs to learn how to use IAKerb as well, this will also need to be implemented in the user space cifs-utils package. Finally, to be able to use the same feature in a pure Linux environment, we need to be able to deploy Kerberos KDC locally and do it in an easy manner on each machine.

This is where we had an idea. If we are going to have a local KDC running on each system, maybe we should use it to handle all authentication and not just for the NTLM removal? This way we can make both the local and domain-enrolled user experience the same and provide access locally to a whole set of authentication methods we support for FreeIPA: passwords, smartcards, one-time passwords and remote RADIUS server authentication, use of FIDO2 tokens, and authentication against an external OAuth2 Identity Provider using a device authorization grant flow.

How “local” a local KDC should be?

On standalone systems it is often not desirable to run daemons continuously. Also, it is not desirable to expose these services to the connected network if they really don’t need to be exposed. A common approach to solve this problem is by providing a local inter-process communication (IPC) mechanism to communicate with the server components. We chose to expose a local KDC via UNIX domain sockets. A UNIX domain socket is a well-known mechanism and has known security properties. With the help of a systemd feature called socket activation, we also can start local KDC on demand, when a Kerberos client connects over the UNIX domain socket. Since on local systems actual authentication requests don’t happen often, this helps to reduce memory and CPU usage in the long run.

If a local KDC is only accessible over a UNIX domain socket, remote applications could not get access to it directly. This means they would need to have help from a server application that can utilize the IAKerb mechanism to pass-through the communication between a client and the KDC. It would enable us to authenticate as a local user remotely from a different machine. Due to how the IAKerb mechanism is designed and integrated into GSS-API, this only allows password-based authentication. Anything that requires passwordless methods cannot obtain initial Kerberos authentication over IAKerb, at least at this point.

Here is a small demo on Fedora, using our localkdc tool to start a local KDC, obtain a Kerberos ticket upon login. The tickets can then be used effortlessly to authenticate to local services such as SUDO or Samba. For remote access we rely on Samba support for IAKerb and authenticate with GSSAPI but local smbclient uses a password first to obtain the initial ticket over IAKerb. This is purely a limitation of the current patches we have to Samba.

Make a pause here and think about the implications. We have an initial Kerberos ticket from the local system. The Kerberos ticket embeds details of how this authentication happened. We might have used a password to authenticate, or a smartcard. Or any other supported pre-authentication methods. We could reuse the same methods FreeIPA already provides in the centralized environment.

The Kerberos ticket also can contain details about the user session, including current group membership. It does not current have that in the local KDC case but we aim to fix that. This ticket can be used to authenticate to any GSS-API or Kerberos-aware service on this machine. If a remote machine accepts Kerberos, it theoretically could accept a ticket presented by a client application running on the local machine as well. Only, to do that it needs to be able to communicate with our local KDC and it couldn’t access it.

Trust management

Luckily, a local KDC deployment is a full-featured Kerberos realm and thus can establish cross-realm agreements with other Kerberos realms. If two “local” KDC realms have trust agreements between each other, they can issue cross-realm Kerberos tickets which applications can present over IAKerb to the remote “local” KDC. Then a Kerberos ticket to a service running on the target system can be requested and issued by the system’s local KDC.

Thus, we can achieve passwordless authentication locally on Linux systems and have the ability to establish peer to peer agreements across multiple systems, to allow authentication requests to flow and operate on commonly agreed credentials. A problem now moves to the management area: how to manage these peer to peer agreements and permissions in an easy way?

Systemd User/Group API support

MIT Kerberos KDC implementation provides a flexible way to handle Kerberos principals’ information. A database backend (KDB) implementation can be dynamically loaded and replaced. This is already used by both FreeIPA and Samba AD to integrate MIT Kerberos KDC with their own database backends based on different LDAP server implementations. For a local KDC use case running a full-featured LDAP server is not required nor intended. However, it would be great if different applications could expose parts of the data needed by the KDB interfaces and cooperate together. Then a single KDB driver implementation could be used to streamline and provide uniform implementation of Kerberos-specific details in a local KDC.

One of the promising interfaces to achieve that is the User/Group record lookup API via varlink from systemd. Varlink allows applications to register themselves and listen on UNIX domain sockets for communication similar to D-Bus but with much less implementation overhead. The User/Group API technically also allows to merge data coming from different sources when an application inquires the information. “Technically”, because io.systemd.Multiplexer API endpoint currently does not support merging non-overlapping data representing the same account from multiple sources. Once it would become possible, we could combine the data dynamically and may interact with users on demand when corresponding requsts come in. Or we can implement our own blending service.

Blending data requests from multiple sources within MIT KDC needs a specialized KDB driver. We certainly don’t want this driver to duplicate the code from other drivers, so making these drivers stackable would be a good option. Support for one level of stacking has been merged to MIT Kerberos through a quickly processed pull request and will be available in the next MIT Kerberos release. This allows us to have a single KDB driver that loads other drivers specialized in storing Kerberos principals and processing additional information like MS-PAC structure or applying additional authorization details.

Establishing trusts

If Alice and Bob are in the same network and want to exchange some files, they could do this using SMB and Samba. But that Alice can authenticate on Bob’s machine, they would need to establish a Kerberos cross realm trust. With the current tooling this is a complex task. For users we need to make this more accessible. We want to allow users to request trust on demand and validate these requests interactively. We also want to allow trust to be present for a limited timeframe, automatically expiring or manually removed.

If we have a Kerberos principal lookup on demand through a curated varlink API endpoint, we also can have a user-facing service to initiate establishing the trust between two machines on demand. Imagine a user trying to access SMB share on one desktop system that triggers a pop-up to establish trust relationship with a corresponding local KDC on the remote desktop system. Both owners of the systems would be able to communicate out of band that provided information is correct and can be trusted. Once it is done, we can return back the details of the specific Kerberos principal that represents this trust relationship. We can limit lifetime of this agreement so that it would disappear automatically in one hour or a day, or a week.

Current state of local authentication hub

We started with two individual implementation paths early in 2024:

• Support IAKerb in MIT Kerberos and Samba
• Enable MIT Kerberos to be used locally without network exposure

MIT Kerberos did have support for IAKerb protocol extension for more than a decade but since Microsoft introduced some changes to the protocol, those changes needed to be integrated as well. This was completed during summer 2024, though no upstream release is available yet. MIT Kerberos typically releases new versions yearly in January so we hope to get some updates early 2025.

Samba integration with IAKerb is currently under implementation. Originally, Microsoft was planning to release Windows 11 and Windows Server 2025 with IAKerb support enabled during autumn 2024. However, the Windows engineering team faced some issues and IAKerb is still not enabled in the Windows Server 2025 and Windows 11 releases. We are looking forward to getting access to Windows builds that enable IAKerb support to ensure interoperability before merging Samba changes upstream. We also need to complete the Samba implementation to properly support locally-issued Kerberos tickets and not only do acquisition of the ticket based on the password.

Meanwhile, our cooperation with MIT Kerberos development team led to advancements in the local KDC support. The MIT Kerberos KDC can now be run over a UNIX domain socket. Also on systemd-enabled systems we allow socket activation, transforming local KDC into an on-demand service. We will continue our work on a dynamic database for a local KDC, to allow on-demand combination of resources from multiple authoritative local sources (Samba, FreeIPA, SSSD, local KDC, future dynamic trust application).

For experiments and ease of deployments, a new configuration tool was developed, localkdc. The tool is available at localkdc and COPR repository can be used to try the whole solution on Fedora.

If you want to get that test tried in a simple setup, you might be interested in a tool that we developed initially for FreeIPA: FreeIPA local tests. This tool allows to provision and run a complex test environment in podman containers. The video of the local KDC usage was actually generated automatically by the scripts from here.

Last weekend I attended this years edition of FOSDEM in Brussels again. Besides meeting old and new friends I focussed on emergency and weather alerting as well as public transport topics.

KDE

KDE had a stand again, this time in the minimally less crowded (on the FOSDEM scale of crowdedness at least) AW building, next to our friends from GNOME.

Besides getting stickers, t-shirts and even the rare handmade amigurumi Konqi mascots you could see KDE software running on a large range of devices, from laptops and phones to embedded boards, drawing tables and handheld gaming consoles.

Emergency & Weather Alerts

Together with Nucleus I had a talk on Saturday about the public alert server we have been working on.

This resulted in numerous interesting conversations:

• There are people looking into getting access to alerts in other countries.
• Learned about the CAP over XMPP standard (XEP 0127), which could be a more efficient way to receive CAP messages compared to the current high frequency CAP feed polling. We yet have to find a alerting authority supporting that though.
• The Netherlands open-sourced their national weather app a few days prior to FOSDEM.
• Possible approaches for integrating alerts with home automation systems, something particularly interesting in an accessibility context.
• Adapting to UnifiedPush’s work on aligning with the WebPush standard.

There was also an interesting and somewhat related discussion on how to test cell broadcast, emergency calls and emergency location services on free mobile platforms. Especially testing emergency location services is tricky and not even the Google-free Android platforms have that at the moment as it’s part of Google Play Services rather than AOSP (ie. the closed source rather than the open source part of Android).

On the way to FOSDEM I managed to port the KDE public alert client to the new server API. It still needs a UI refresh though, as it’s based on a 5 era prototype.

Transitous

On Sunday Felix, Jonah and Marcus presented Transitous in the Railways and Open Transport track.

As this was unfortunately the second to last talk of the event there wasn’t much time for discussions afterwards, but at least for several people involved with Transitous FOSDEM has been the first opportunity to meet in person. It’s great to see how this has grown in just one year.

For more of that, there was also a discussion about organizing a Transitous sprint/hack weekend.

Travel

Spending several hours on various trains to get there and back also provides plenty of opportunity for field-testing KDE Itinerary, which allowed the new and much more comprehensive and efficient realtime update approach using trip queries to be tested and integrated for 25.04.

Welcome to a new issue of "This Week in Plasma"! Every week we cover as much as possible of what's happening in the world of KDE Plasma and its associated apps like Discover, System Monitor, and more.

This week Plasma's contributors spent a lot of time putting the finishing touches on Plasma 6.3 before its final release in three days to make sure it's as good as possible!

Notable new Features

Plasma 6.4.0

There's now an option to make panel pop-ups use the floating style even when the panel itself doesn't use that style. (Niccolò Venerandi, link)

Notable UI Improvements

Plasma 6.4.0

Improved the appearance of the Welcome Center page that shows up after you've finished upgrading to a new Plasma feature release. (Oliver Beard, link)

(Here shown with the appearance it would have had for Plasma 6.2, since 6.4 doesn't exist yet!)

Info Center's energy graph now uses the system's accent color, rather than always being red. (Ismael Asensio, link)

When using software-based screen brightness, the minimum brightness level is now significantly darker. (Xaver Hugl, link)

Improved the Kate Sessions widget's keyboard navigation in multiple ways. (Christoph Wolk, link)

Frameworks 6.11

In the open/save dialogs used throughout KDE software, changes to the text in the filename field are now undo-able and the text field itself shows a little undo button. This is especially useful if you mis-click on a file while saving and accidentally overwrite the filename; now you can quickly undo that by clicking the button or pressing Ctrl+Z! (Marco Martin, Link)

Notable Bug Fixes

Plasma 6.3.0

Fixed a case where KWin could sometimes crash after resuming from sleep on certain hardware. (Xaver Hugl, link)

Fixed a case where System Settings' Firewall pager could crash during normal usage, and also fail to save changed settings properly. (David Edmundson, link l and link 2)

Fixed a performance issue caused by using the "Sidebar" Alt+Tab task switcher visualization that could eventually cause KWin to bog down or hang. (Marco Martin, link)

Fixed two glitches related to scrolling not working properly while System Monitor's "Configure Columns" dialog was open. (David Redondo, link)

When using the Kicker Application Menu widget with a right-to-left language like Arabic or Hebrew, its sub-menus now open to the left if there's space. (Christoph Wolk, link)

Fixed a subtle issue that could cause automatic screen sleep to stop working after apps block and unblock it multiple times. (David Redondo, link)

Uninstalling an app that was made a favorite in the Kickoff Application Launcher now removes it immediately, rather than only after a restart. (Harald Sitter, link)

Fixed the Mouse Click KWin effect so it works again in the X11 session. (Vlad Zahorodnii, link)

Fixed a case where the keyboard language System Tray icon could be missing on login in the X11 session. (Dark Templar, link)

Plasma 6.3.1

Fixed two intermittent crashes in the portal-based screen chooser dialog: one after selecting a virtual output, and another one after an app disconnects from a stream. (David Redondo and Fushan Wen, link 1 and link 2)

Fixed a case where opening a .flatpakref file in Discover could sometimes make it crash after launching. (Aleix Pol Gonzalez, link)

Fixed a case where Discover could sometimes crash while trying to load app reviews without network connectivity. (Fushan Wen, link)

Fixed a weird bug where repeatedly entering text in the Clipboard widget's search field and then deleting it could sometimes cause items in the list view to end up overlapping. (David Edmundson, link)

Improved the reliability with which a trashcan icon on the desktop detects when it should change its appearance based on the presence or absence of files in the trash. (Méven Car, link)

Non-square images used for the Kickoff Application Launcher's panel button are once again presented as expected. (Niccolò Venerandi, Link)

Plasma 6.4.0

Fixed two cases where text wasn't translated in Spectacle's placeholder config UI and Info Center's Energy page graph labels. (Noah Davis and Ismael Asensio, link 1 and link 2)

When a screen edge has multiple panels of different thicknesses, panel-pop-ups on the thinner panels now appear in the right place. (Niccolò Venerandi, link)

Frameworks 6.11

Fixed a case where Plasma could crash while trying to render SVG images, which it does a lot of. (Fushan Wen, link)

Fixed multiple bugs relating to focus and tab-ordering in the open/save dialogs used throughout KDE software. (Marco Martin, Link)

Fixed a visual bug most prominently affecting the System Tray, where icons could sometimes look blurry until hovered while using a fractional screen scale factor. (Marco Martin, link)

In the Properties dialog for symlinks on the desktop, the button to open Dolphin at the target's location now works. (Kamil Kaznowski, link)

Other bug information of note:

• 1 very high priority Plasma bug (1 last week). Current list of bugs
• 25 15-minute Plasma bugs (up from 24 last week). Current list of bugs
• 91 KDE bugs of all kinds fixed over the past week. Full list of bugs

How You Can Help

KDE has become important in the world, and your time and contributions have helped us get there. As we grow, we need your support to keep KDE sustainable.

You can help KDE by becoming an active community member and getting involved somehow. Each contributor makes a huge difference in KDE — you are not a number or a cog in a machine!

You don’t have to be a programmer, either. Many other opportunities exist:

• Triage and confirm bug reports, maybe even identify their root cause
• Contribute designs for wallpapers, icons, and app interfaces
• Design and maintain websites
• Translate user interface text items into your own language
• Promote KDE in your local community
• …And a ton more things!

You can also help us by making a donation! Any monetary contribution — however small — will help us cover operational costs, salaries, travel expenses for contributors, and in general just keep KDE bringing Free Software to the world.

To get a new Plasma feature or a bugfix mentioned here, feel free to push a commit to the relevant merge request on invent.kde.org.

Let’s go for my web review for the week 2025-06.

Chatbot Software Begins to Face Fundamental Limitations | Quanta Magazine

Tags: tech, ai, machine-learning, gpt, mathematics, logic

When you put the marketing claims aside, the limitations of those models become obvious. This is important, only finding the root cause of those limitations can give a chance to find a solution to then.

https://www.quantamagazine.org/chatbot-software-begins-to-face-fundamental-limitations-20250131/

LLMs: harmful to technical innovation?

Tags: tech, ai, machine-learning, gpt, copilot, innovation, learning, vendor-lockin

This will definitely push even more conservatism around the existing platforms. More articles mean more training data… The underdogs will then suffer.

https://evanhahn.com/llms-and-technical-innovation/

Bad idea: “Artificial Intelligence” automatically improves productivity

Tags: tech, ai, machine-learning, gpt, copilot, programming, productivity

Be wary of the unproven claims that using LLMs necessarily leads to productivity gains. The impacts might be negative.

https://jchyip.medium.com/bad-idea-artificial-intelligence-automatically-improves-productivity-0829fcf2146c

The LLM Curve of Impact on Software Engineers

Tags: tech, ai, machine-learning, gpt, copilot, productivity, learning

Again it’s definitely not useful for everyone… it might even be dangerous for learning.

https://serce.me/posts/2025-02-07-the-llm-curve-of-impact-on-software-engineers

SQLite or PostgreSQL? It’s Complicated!

Tags: tech, databases, performance, postgresql, sqlite

It shows unexpected results in its measurements. It also highlights the importance of proper settings for your database system.

https://www.twilio.com/en-us/blog/sqlite-postgresql-complicated

Falsehoods programmers believe about null pointers | purplesyringa’s blog

Tags: tech, memory

If you didn’t realise that null pointers open a maze of different traps, this is a good summary of widespread misconceptions.

https://purplesyringa.moe/blog/falsehoods-programmers-believe-about-null-pointers/

String vs &str

Tags: tech, rust, memory

Another reminder that you don’t want reference to primitive types everywhere in Rust code. There’s actually ways to handle this properly. This post gives a couple of simple guidelines to apply.

https://blog.sulami.xyz/posts/string-vs-str/

py-free-threading

Tags: tech, python, multithreading

Looks like a nice resource to handle the coming move to free threaded Python.

https://py-free-threading.github.io/

Decorator JITs - Python as a DSL

Tags: tech, python, performance, jit

Nice exploration of JIT based techniques in Python.

https://eli.thegreenplace.net/2025/decorator-jits-python-as-a-dsl/

Big Packages or Many Dependencies

Tags: tech, supply-chain, dependencies, complexity

Indeed there is a tension between both approaches in package ecosystems.

https://v5.chriskrycho.com/notes/big-packages-or-many-dependencies/

Developer philosophy

Tags: tech, programming, learning

Definitely a good list of lessons to learn when you’re a junior developer.

https://qntm.org/devphilo

Bye for now!

Model/View Drag and Drop in Qt - Part 1

Moving a row in a tableview, step 1

Moving a row in a tableview, step 2

Moving a row in a tableview, step 3

Reorderable ListView

Reorderable TableView

class CountryModel : public QAbstractTableModel
{
    ~~~
    Qt::ItemFlags flags(const QModelIndex &index) const override
    {
        if (!index.isValid())
            return Qt::ItemIsDropEnabled; // allow dropping between items
        return Qt::ItemIsEnabled | Qt::ItemIsSelectable | Qt::ItemIsDragEnabled;
    }

    // the default is "copy only", change it
    Qt::DropActions supportedDropActions() const override { return Qt::MoveAction; }

    // the default is "return supportedDropActions()", let's be explicit
    Qt::DropActions supportedDragActions() const override { return Qt::MoveAction; }

    QStringList mimeTypes() const override { return {QString::fromLatin1(s_mimeType)}; }

    bool moveRows(const QModelIndex &sourceParent, int sourceRow, int count, const QModelIndex &destinationParent, int destinationChild) override; // see below
};

bool CountryModel::moveRows(const QModelIndex &sourceParent, int sourceRow, int count, const QModelIndex &destinationParent, int destinationChild)
{
    if (!beginMoveRows(sourceParent, sourceRow, sourceRow + count - 1, destinationParent, destinationChild))
        return false; // invalid move, e.g. no-op (move row 2 to row 2 or to row 3)

    for (int i = 0; i < count; ++i) {
        m_data.move(sourceRow + i, destinationChild + (sourceRow > destinationChild ? 0 : -1));
    }

    endMoveRows();
    return true;
}

Reorderable treeview

Reorderable treeview with a tree model

Reorderable QListWidget

Reorderable QTableWidget

Reorderable QTreeWidget

The post Model/View Drag and Drop in Qt - Part 1 appeared first on KDAB.

Glaxnimate 0.6.0 Beta has finally been released for testing!

It has been a while since the last release of Glaxnimate, but in the background we worked hard to make this first release under the KDE umbrella happen!

Please help us testing and report any issue you may encounter on https://bugs.kde.org/enter_bug.cgi?product=glaxnimate

Glaxnimate joins KDE

The Glaxnimate team is proud to announce Glaxnimate is now part of KDE. Glaxnimate benefits from the shared KDE build and distribution infrastructure, the collective knowledge of the community and libraries such as KDE Frameworks. This way the developers can spend more time on the code to fix bugs and develop new features for you!

Changes

Editing

• The rotation handle now preserves rotation direction and multiple full rotations
• Alt + click on keyframes cycles between built-in easing curves
• Alt + click on bezier points cycles between tangent symmetry modes (Ctrl+click still works)
• Changing a bezier point from corner to smooth will add tangents if they are missing
• The import image dialog now allows importing multiple images at once

I/O

• Added support for SVG text-anchor

User Interface

• Middle mouse drag now pans the timeline
• There is an icon on the timeline to quickly toggle keyframes
• Buttons to jump to the next/previous keyframe in the timeline
• Improved LottieFiles import dialog
• Improved autosave recovery process
• Script console now supports basic autocompletion

Scripting

• Exposed method to add new compositions

Misc

• Switched to an even/odd version numbering scheme
• Integration with KDE Frameworks

Bug Fixes

• Fixed keyframe context menu showing the wrong "after" transition
• When drawing bezier points that don't have tangents are correctly marked as corner
• The play button now resumes from the current frame rather than resetting to the start
• Fixed saving custom templates
• Toggling visibility / lock of a layer by clicking on its icon now adds an undo/redo action
• Fixed LottieFiles import
• Fixed dropping file as object
• Fixed closing compositions from the tab bar
• Fixed loading colors from older lotties
• Shape modifiers marked as not visible are now correctly ignored
• Fixed rendering of round corners modifier
• Fixed "New Composition" action creating an invisible layer
• Fixed repeater opacity not being applied correctly
• Improved handling of repeater with stroke
• Fixed SVG animation export
• Fixed animated raster plugin I/O

How to get it

Note that this is a beta release. Most Linux distributions do not package unstable releases.

We recommend to test this release with one of the binaries we provide:

• Linux AppImage: glaxnimate-0.5.80-x86_64.AppImage
• Windows Installer: glaxnimate-0.5.80-x86_64.exe
• macOS DMG
  • ARM: glaxnimate-0.5.80-arm64.dmg
  • Intel: glaxnimate-0.5.80-x86_64.dmg

Packager Section

The source code tarball are available from the KDE servers:

URL: https://download.kde.org/unstable/glaxnimate/0.5.80

Source: glaxnimate-0.5.80.tar.xz

Signed by: 97B71AA02D63EA6C5C44C23B962AC48EF0501F0B Julius Künzel julius.kuenzel@kde.org

Ramon Miranda has published a new video on the Krita channel: Memilio Impasto Brushes! Who doesn't love a nice impasto effect!

The post Kdenlive fundraising final report appeared first on Kdenlive.

Jasem Mutlaq

• Added dome slit visualization on sky map. Specify the Dome Measurement parameters in the INDI Dome driver to see a live dome slit overlay in the Sky Map.

• Implemented generic DBus methods for KStars options
• Added SchedulerSleeping event
• Added mutex protection for multi-threaded resources
• Enhanced scheduler loading and settings management
• Improved filter manager operations
• Fixed video subframing. Up to 50x improvement in subframed video feeds.
• Fixed multiple profile editor issues
• Added VSCode development setup support

Hy Murveit

• Fixed DMS delta angle calculation
• Added mandatory settle to PAA
• Improved imaging planner stability

• Fixed pierside placeholder directory usage
• Added START_AT scheduler test
• Fixed Abell planetary nebula lookup
• Enhanced PAA adjustment estimation

Wolfgang Reissenberger

• Implemented video sequence capture. Preliminary support for capturing Video files as regular sequences in the Capture module. Great news for EAA.

• Fixed focus options
• Improved remote directory handling
• Fixed flats with wall position
• Enhanced filter wheel integration

John Evans

• Enabled focuser controls when camera disconnected
• Improved focus measure framing
• Fixed focus advisor code warnings
• Updated aberration inspector functionality

Toni Schriber

• Fixed overshooting cosine in CachingDms calculation
• Implemented calibration reuse after rotation. Guide calibration data can now be re-used between sessions after rotation.

Ben Cooksley

• Removed CMake trace/debug logs from CI runs

György Balló

• Set window icon

Oliver Kellogg

• Fixed typo in FITS Viewer configuration

Akarsh Simha

• Fixed right-click popup menu on deep stars

Technical Highlights

• Improved capture sequence stability: Set 5-minute timeout for transient operations (dome motion, mount parking/unparking, dust cap operations, focusing, filter wheel changes) to prevent indefinite sequence stalling.
• Improved mount rotation processing
• Enhanced scheduler loading mechanism
• Added mutex protection for multi-threaded resources
• Improved capture operation timeout handling

FreeBSD ports update today:

delete mode 100644 x11/plasma5-plasma/
create mode 100644 x11/plasma6-plasma/

This is work landed by Tobias, with Max, Kenneth, Jason and Gleb doing a lot of heavy lifting in this update. I sat on the sidelines, but I’m here to congratulate the active part of the KDE FreeBSD team with an update long foreseen, long foretold, and long desired.