Thomas Moore | Membership Application
About me
I am a self-employed free software developer based in New Zealand, and I also
take contract work for a security firm. I came to Kubuntu during the 25.10
cycle and moved to 26.04 during its development cycle, which is how I ended up
testing development releases rather than just running them. Kubuntu is now my
daily system and my development and test platform, with a Proxmox homelab
behind it.
Most of what I contribute starts as something broken in front of me: a wallet
prompt that froze every application, a machine that would not shut down, a
driver that stopped building. I tend not to let those go until I understand
them, which is where the bug reports come from. Since December 2025 I have
maintained a KDE Plasma application on Kubuntu, and since February 2026 I have
contributed to Ubuntu through development-release testing, regression
analysis, bug confirmation, SRU verification, and upstream fixes that reach
Ubuntu and Kubuntu users.
What I am best at is turning awkward desktop, packaging and kernel failures
into reports someone can act on. I reproduce with archive packages rather than
local builds, narrow the cause, write a test anyone can repeat, check whether
proposed fixes actually work, and keep the report current as evidence arrives.
Contact
- Launchpad: https://launchpad.net/~realstuffie
- GitHub: https://github.com/realstuffie
- Matrix: @realstuffie:matrix.org
- IRC (Libera): realstuffie
Contributions
Bugs I reported
LP #2166636,
openscap-scanner unusable with a noexec /tmp. September 2026, Confirmed. The
SCE engine falls back to oscap-run-sce-script when /tmp is mounted noexec,
but that helper ships in openscap-utils, which the scanner does not depend on,
so SCE rules end in error with nothing at error level explaining why.
Hardening benchmarks require noexec /tmp, so this affects exactly the systems
these scans target. Found while evaluating the CIS profiles on 26.04. Canonical
confirmed it and asked me to file upstream, which I did as
OpenSCAP #2414 with the
mechanism, four possible fixes and the prior issues it relates to. The report
also surfaced a second Ubuntu and Debian bug, a missing
openscap-cpe-dict.xml, already fixed in Debian and still needing to reach
Resolute.
LP #2165214, QtKeychain blocks
applications for 25 seconds with a locked wallet. August 2026, caught in
libqt6keychain1 0.17.0-1 before 26.10 released. A 500 ms heartbeat timer
produced one tick in 24.6 seconds where roughly 49 were expected, proving the
GUI event loop was blocked rather than waiting on a job. Filed with the
upstream issue, my proposed fix and the regressing commit, so Ubuntu could
decide whether to carry the patch.
LP #2148139, NVIDIA 580 packages
violate Multi-Arch: same. April 2026, an upgrade blocker on systems with i386
multiarch. I compared the amd64 and i386 .deb files and showed their shared
changelog.Debian.gz genuinely differed, which established a split-source build
failure rather than local package state. Cross-referenced
LP #2137007 showing the same failure
had happened before, filed three days ahead of final freeze, and documented a
temporary recovery while explaining the real fix is a coordinated rebuild.
LP #2161821, intermittent amdgpu
shutdown deadlock. July 2026, Confirmed, three affected users. Bisected
between Ubuntu kernels 7.0.0-27 and 7.0.0-28, testing in both directions over
repeated shutdown cycles. I then revised the report when further testing
disproved my own S5-only framing: it was a soft-off hang, it took the CPU fan
with it, and it needed a forced power-off. Two other users confirmed
afterwards. Now connected to the upstream amdgpu ISM dc_lock ABBA deadlock,
CVE-2026-68364, with a backport request for Resolute.
SRU verification
LP #2156921, sos 4.11.2.
Verified against 4.10.2-1 on a QEMU/KVM guest and in an LXC container under
Proxmox VE, comparing plugin counts, warnings and zero-size file counts in both
environments, and exercising the tar-only compression option, the new
post-processing message, the expanded lxd collection and the new getent plugin.
Ran a full sos clean cycle and checked MAC obfuscation against the collected
Netplan config. I left the tag at verification-needed, because the plan asks
for hardware I do not have, and wrote down exactly what remained. These were
the only verification comments since it entered proposed in July.
LP #2158366, rpi-eeprom. Tested
28.28-0ubuntu0.26.04.1 and flashrom 1.6.0-2ubuntu1.1 on a Pi 4 Model B rev
d03114, flashing the boot EEPROM and confirming warm and cold boot. My board
has the older SDRAM variant, so this covered the regression case rather than
the new-variant support the SRU exists for. While testing I established that
rpi-eeprom ships no 2711 firmware images at all, and that they come from
linux-firmware-raspi, which had not reached proposed, so nobody could verify
that half. Reported alongside the partial result rather than changing the tag.
Bugs confirmed, fixes tested
LP #2120443, pinentry-kwallet
recursively invoked by gpg-agent. Fix Committed. Confirmed on Kubuntu 26.04
Wayland with a deterministic gpg --clearsign reproducer, logs, and exact
versions. Tested kwalletcli 3.04beta from ppa:mirabilos/exp and confirmed
pinentry-qt as a workaround.
LP #2141298, AppArmor blocks
network-socket writes under Linux 6.19. High, Confirmed. Supplied the denial
from a Plasma widget using Qt Networking, showing QNetworkAccessManager denied
send permission under the plasmashell profile, which demonstrated impact beyond
the applications already named.
LP #2141316, NVIDIA DKMS fails
against kernel 6.19. High, Fix Released. Confirmed, tracked successive driver
updates, and tested the objtool workaround with NVIDIA 580.126.18, helping
establish the fix direction was sound.
Upstream work benefiting Ubuntu
sos, Landscape registration key collected in clear text. Merged 10
September 2026, PR #4467,
issue #4466. The landscape
plugin collects /etc/landscape/client.conf and its obfuscation rule matched
registration_password, but modern landscape-client writes
registration_key, so the rule silently stopped matching and the credential
went into the archive in clear text. Anyone attaching a sosreport to a support
case from a Landscape-managed machine was sending their registration key with
it. The replacement pattern had a second defect that dropped the =
separator. Reproduced on 4.10.2 and 4.11.2 in a VM and a container, filed with
a reproducer, supplied the fix. Approved by arif-ali, merged by pmoravec.
QtKeychain, locked-wallet GUI freeze.
Issue #303,
PR #304, open. Found
the regressing commit and showed why its assumption fails: it expects an
unavailable KWallet to fail fast, which is untrue when kwalletd is sitting at
its unlock dialog. The fix bounds the availability probe and treats a timeout
as available but busy, preserving the earlier fix for genuinely absent
services, and stops passing an empty wallet name to open(), which otherwise
replaces the freeze with a spurious new-wallet wizard. Run on my daily system
for weeks before I filed the Ubuntu bug.
QtKeychain, Mode::Map support. Merged May 2026, commit
7718d0ac.
Added the missing modeToString() case and stringToMode() branch for an enum
value added in 0.16.0 without them.
ComplianceAsCode, CIS Level 1 profiles for Ubuntu 26.04.
PR #15097, approved
by a maintainer, awaiting ubuntu-maintainers code owner review. Ubuntu 26.04
already existed as a product with no CIS profiles, and USG builds its
benchmarks from a ComplianceAsCode tag, so the content has to land here first.
I added cis_level1_server and cis_level1_workstation from a new
274-control file, along with 15 rules the benchmark needs that were not in the
tree, and ubuntu2604 checks for chrony and sshd. Testing on two 26.04 systems
exposed release differences in sudo-rs logging, PAM MOTD, native systemd /tmp
mounts, SSH applicability, time services, AIDE 0.19’s database_in rename and
sysctl paths, and I followed each through to a content fix rather than a local
exception. Review feedback from jan-cerny found that my sudo logging check
inferred configuration from log history, which left a correctly remediated
system failing and let a volatile journal pass. I rewrote it to test the
logging configuration and durable storage directly, with eight test scenarios
including his exact cases. A Canonical contributor testing the profile hit an
SSH lockout, which I traced to 26.04 dropping 24.04’s control 4.2.6, so nothing
adds an allow rule before incoming is set to deny. The build passes SCAP and
OVAL validation, controleval reports 100% assessed for both levels, and all ten
ubuntu2604 CTests pass on the rebased branch.
Software
ProxMon, maintained since
December 2025, GPLv3. A Plasma 6 widget in C++/Qt and QML for monitoring
Proxmox VE and Backup Server from the panel. Developed on Kubuntu, also tested
on Manjaro, openSUSE and Fedora. Tokens live in the system keyring rather than
config files, custom CAs are supported, and the higher-risk features are
optional so it can run as a read-only monitor.
Future goals
I am carrying the 26.04 CIS profiles through review and intend to maintain them
afterwards rather than hand them over. The Ubuntu Security Guide side needs a
release-metadata entry once the content is tagged.
I will keep testing Kubuntu development releases, catching regressions before
release, verifying SRUs, and working with upstream KDE and Qt when a defect
reaches Ubuntu users.
The gap I most want to close is packaging. I have twice had a working upstream
fix and no way to move it into Ubuntu myself, and I would rather be able to do
that than keep filing reports asking someone else to.
