View source for Branch P11 Technical Notes

[[Category:Branches]]
[[ru:Branches/p11/TechnicalNotes]]

== What's new in p11 ==

=== General changes ===
* The repository is built against {{pkg|glibc}} version 2.38, which is pinned for
the entire lifetime of the repository.
* Directories {{path|/bin}}, {{path|/sbin}}, and {{path|/lib*}} are [[Usrmerge|merged]] with their counterparts in {{path|/usr}}. The migration occurs when the {{pkg|filesystem}} package is upgraded to the p11 version. When p11 is freshly installed, {{path|/bin}}, {{path|/sbin}}, and {{path|/lib*}} are immediately symlinked to their counterparts in {{path|usr/}}.
** <!-- Это фрагмент для любознательных, "материал со звёздочкой". Вместо small: стоит ли спрятать его под раскрываемый спойлер или серенький admonition? Как это принято делать на mediawiki? --> <small>In the indefinite future it is planned to teach the installer to create a recovery partition when installing on a medium of sufficient size. Its creation can be disabled at the administrator's will. This partition can be used by a PC user or administrator to restore the main system.</small>
* The [https://docs.kernel.org/admin-guide/cgroup-v1/index.html cgroup v1] subsystem is declared obsolete. The Linux kernel we ship still supports cgroup v1, but other components are being phased out or not supported at all. We recommend that application developers use the cgroup version 2 subsystem, and that administrators of applications still dependent on cgroup v1 review the documentation for those application services and work with them at their own risk.

=== Security mechanisms. Software delivery ===
* The uid for user <tt>nobody</tt> has been changed from 99 to a value (65536-2) equal to the value of [https://docs.kernel.org/admin-guide/sysctl/fs.html#overflowgid-overflowuid overflowuid] in our kernels.
* Packages with the symbol <tt>~</tt> in version or release are allowed in the repository. The tilde is recognised as lexicographically less than the end of a string by analogy with <tt>sort -V</tt> and intended to denote release candidate type versions, e.g. <tt>1.2~rc2</tt>. This will not affect the upgrade from p10.
* The {{pkg|openssl}} library as part of the platform has been upgraded to branch 3.1, and the support of branch 1.1 has been discontinued, including by the upstream itself.
** API, ABI and semantics have changed compared to p10. For example, by default the library will refuse to establish TLS 1.0 and TLS 1.1 connections, which will probably look like a communication error to a log-reading user. To regain support, a developer can, for example, call the function [https://www.openssl.org/docs/man3.0/man3/SSL_CTX_set_security_level.html SSL_CTX_set_security_level(3)]
** For details see the [https://www.openssl.org/docs/man3.0/man7/migration_guide.html upstream guide].
* The {{prg|apt-get}} program has learned to output packages to be installed, removed or upgraded in
columns.
** Before:
  The following extra packages will be installed:
    libOpenUSD0 libPtex2 libalembic1.8 libblosc libcudart libdcmtk18 libdraco
    libembree4-4 libgflags libharu2.4 libhdf5-310 liblog4cplus libopenCOLLADA
    libopenexrcore30 libopenimagedenoise2 libopenimageio2.5 libopenpgl0
    libopenshadinglanguage1.13 libopensubdiv3.6.0 libopenvdb10.1 libpartio1 libspnav
    ocl-icd
  The following NEW packages will be installed:
    blender libOpenUSD0 libPtex2 libalembic1.8 libblosc libcudart libdcmtk18 libdraco
    libembree4-4 libgflags libharu2.4 libhdf5-310 liblog4cplus libopenCOLLADA
    libopenexrcore30 libopenimagedenoise2 libopenimageio2.5 libopenpgl0
    libopenshadinglanguage1.13 libopensubdiv3.6.0 libopenvdb10.1 libpartio1 libspnav
    ocl-icd
  0 upgraded, 24 newly installed, 0 removed and 0 not upgraded.
** After:
  The following extra packages will be installed:
    libOpenUSD0    libdraco      libopenCOLLADA              libopensubdiv3.6.0
    libPtex2       libembree4-4  libopenexrcore30            libopenvdb10.1
    libalembic1.8  libgflags     libopenimagedenoise2        libpartio1
    libblosc       libharu2.4    libopenimageio2.5           libspnav
    libcudart      libhdf5-310   libopenpgl0                 ocl-icd
    libdcmtk18     liblog4cplus  libopenshadinglanguage1.13
  The following NEW packages will be installed:
    blender        libdcmtk18    liblog4cplus          libopenshadinglanguage1.13
    libOpenUSD0    libdraco      libopenCOLLADA        libopensubdiv3.6.0
    libPtex2       libembree4-4  libopenexrcore30      libopenvdb10.1
    libalembic1.8  libgflags     libopenimagedenoise2  libpartio1
    libblosc       libharu2.4    libopenimageio2.5     libspnav
    libcudart      libhdf5-310   libopenpgl0           ocl-icd
  0 upgraded, 24 newly installed, 0 removed and 0 not upgraded.

=== System components ===
* The system {{cmd|/bin/sh}} script interpreter is now based on Bash 5.2 instead of Bash 4. We recommend that you read the [https://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?id=74091dd4e8086db518b30df7f222691524469998 list of changes] from the GNU Bash upstream, that may include backwards incompatible changes.
* The {{pkg|systemd}} package has been upgraded to version 255. [https://github.com/systemd/systemd/blob/v255/NEWS List of changes from the upstream]
* The UEFI [[shim]] program has been upgraded. '''On [[UEFI]]-bootable machines with Secure Boot enabled''' and Microsoft-signed UEFI platform keys, the new boot loader will '''stop''' loading kernels from p10 and earlier platforms. {{Note|Don't forget to install the kernel from p11 after upgrading packages! Also, do not spot upgrade packages that are part of the trusted boot chain: {{pkg|shim-signed}}, {{pkg|grub-efi}}, {{pkg|fwupd-efi}}, {{pkg|kernel-image-*}}; they should be upgraded synchronously.
}}

=== User interface. Web browsers. Means of communication  ===
* The GNOME desktop environment and application package have been upgraded to branch 46.
* The Plasma desktop environment and the KDE application package have been upgraded to version 5.115.0. Plasma 6, released in spring 2024, is '''not planned''' in the p11 platform.
* MATE has been upgraded to 1.28.0.
* The default dialog shell {{cmd|/bin/bash}} has been upgraded to Bash 5.2.
* The PipeWire multimedia handling server has been upgraded to 1.0.7.
* Mesa has been upgraded to version 24.0.6.
* Firefox has been upgraded to 125.0.1; a conservative option of Firefox ESR 115.10 is available.
* Chromium has been upgraded to 124.0.6367.118.
* Firefox and Chromium web browsers are actively maintained as part of the repository lifecycle.
* Chromium-gost has been upgraded to 124.0.6367.78.
* The platform contains the official client for the Telegram messenger {{pkg|telegram-desktop}} version 5.0.0. Most likely, it is planned to be updated as part of the platform's life cycle

=== Network connections and services ===
* {{pkg|iproute2}} has been upgraded to version 6.8.
** Support for the rudimentary {{term|tc}} action {{term|ipt}}} has been removed from kernels and {{pkg|iproute2}}.
* {{pkg|mtr}} has been upgraded to version 0.95.
** Now both versions of mtr, with and without the gtk interface, use one separate service program to send trace packages and do not use the set-uid bit. Both programs are affected by the [[control]] switch {{{prg|mtr}}; the separate control for {{prg|xmtr}} has been abolished.
* {{pkg|NetworkManager}} has been upgraded to version 1.46.0.
** NetworkManager now can get hostname from reverse DNS records and tries to use the systemd-resolved API for this purpose. If the latter is not present in the system, NM runs the {{prg|nm-daemon-helper}} program, which will make a query via the NSS module {{term|dns}}.
** Support for configuring IPv4 NAT in distribution mode via {{term|nftables}} has been added. NM by default checks if {{path|/usr/sbin/nft}} and {{path|/usr/sbin/iptables}} are installed, uses whichever tool is on the system, preferring {{term|nftables}}.
** You can now enable a random MAC address selection algorithm for a particular Wi-Fi network connection that depends on the SSID of the Wi-Fi network by setting <code>wifi.cloned-mac-address=stable-ssid</code>.
** Multiple improvements to the DHCPv4 and DHCPv6 clients, including DHCPv6 Prefix Delegation, have been made.
** Multipath TCP support has been added. The parameter <code>connection.mptcp-flags</code> allows IP addresses to be used in MPTCP connections. NetworkManager does not manage MPTCP unless it is enabled in sysctl of the kernel {{path|/proc/sys/net/mptcp/enabled}}; this setting is left to the administrator. The strict {{term|rp_filter}} mode interferes with MPTCP in some cases, so NetworkManager will switch the {{term|rp_filter}} setting to 2 when it manages MPTCP; otherwise it does not apply to {{term|rp_filter}}.
** For details see the [https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.46.0/NEWS upstream guide].
* The DPDK framework has been upgraded to version 23.11.0.
* The dynamic routing server BIRD has been upgraded to 2.15.
* The domain extension server {{pkg|nsd}} has been upgraded to 4.9.1.
* The multifunctional DNS server BIND has been upgraded to 9.18.26.
* ISC DHCP support has been discontinued following upstream in favor of [https://packages.altlinux.org/sisyphus/srpms/kea/ Kea]. DHCP service administrators are encouraged to migrate their systems off the ISC DHCP server if possible.
* {{pkg|nginx}} with modules has been upgraded to version 1.24.0.
* Apache {{term|httpd}} has been upgraded to version 2.4.59.
* postfix has been upgraded to version 3.8.3.

=== Integrated solutions for group work ===

* The stable version of Samba 4.20 contains all upgrades of the [[Samba#Changes_made_to_p10|source]], and additional options:
** Parameter specifying smbd socket read timeout in milliseconds.
** Support (Heimdal only) for the global option “ignore requester SID” has been added to make trust relationships work correctly with older versions of MS AD.
** The "client Force DNS canonicalize Hostname" parameter allows the client library to attempt to resolve the canonical name. This feature allows you to communicate via Kerberos with services using CNAME records without adding an SPN for a specific service on the host.

* Kerberos version 1.21.

=== Virtualization ===
* {{pkg|libvirt}} has been upgraded to version 10.2.0.
* The PVE virtualization system (Proxmox Virtual Environment) has been updated to version 8.1. <!-- сюда бы погуще... -->
** Among other things, it now provides direct import of virtual machines from VMWare.
* The Open VSwitch support package has been upgraded to 3.3.0.
* The OVN virtual network and network services controller has been upgraded to 24.03.1.
* The OCI container launcher tool {{pkg|runc}} has been upgraded to version 1.1.12.
* Support for the following major branches of Kubernetes is available in the platform: 1.28, 1.27, 1.26, 1.25, 1.23.
* The OpenUDS remote access toolkit has been upgraded to version 3.6.0.

=== Multimedia ===
* PipeWire has been upgraded to 1.0.7.
** In p11, the PipeWire package can act not only as a screen capture broker for {{pkg|xdg-desktop-portal}}, but also as an audio I/O server, e.g. instead of PulseAudio.
* The JACK audio I/O server has been '''removed from the repository''' in favor of {{pkg|pipewire-jack}}, the JACK compatibility layer for PipeWire.
* The Ardour digital audio workstation has been upgraded to version 8.6.
* The Audacity sound data editor has been upgraded to version 3.4.2.
* The FFmpeg codec and remuxer package has been upgraded to 6.1.1.

=== Developer tools ===
* The Rust toolchain has been upgraded to version 1.77.
* Two versions of LLVM toolkits are available: 18 and 17. LLVM and Clang version 18 are used by default; including when building firefox, chromium, telegram-desktop and other platform packages for which GCC gives worse results.
** The repository provides support for parallel installation of multiple major branches of the [[LLVM]] project at the same time. Utilities, like the gcc project, are installed with a suffix containing the version number (e.g. <tt>clang-17</tt>). A wrapper with a name without a suffix that invokes the command of the desired version is available. [[LLVM/Packaging|More]]
* The set of GCC compilers, including the system compiler, has been upgraded to 13.2.
* binutils+gdb have been upgraded to 2.41.
* The system version of Python is now 3.12; all modules in the repository run on it.
* The Perl interpreter has been upgraded to branch 5.38.
* JDK branches 21, 17, and 11 are provided.
* The set of popular C++ libraries {{pkg|boost}} has been upgraded to 1.85.
* The toolchain for Golang programming language has been upgraded to 1.22; new versions will be released as the platform is maintained.
* [https://packages.altlinux.org/en/sisyphus/srpms/vulkan/ Vulkan SDK] has been upgraded to 1.3.277.
* {{pkg|docker-engine}} has been upgraded to version 26.1.0.

=== In-house developments ===

During the development of the p10 branch the in-house developments have been actively carried out: the [https://github.com/altlinux/admc ADMC] and GPUI utilities, and the gpupdate group policy application mechanism. At the moment in p10 and p11 application versions are synchronized (we expect to keep synchronizing). We plan to maintain this set of applications for the p10 for a longer period of time.

* The ADMC utility creates a convenient domain management environment. The application's technology stack includes a graphical shell, directory service configuration, client management, error protection, administrator tool invocation, and secure requests via Kerberos. The application retrieves domain information and communicates with controllers. Switching between domain controllers is available. FSMO roles can be reassigned in the application.

* The GPUI application allows you to edit created policies in a Samba domain in the same way as in Windows.

* The gpupdate application tool, starting with version 0.10, uses dconf to store application system data obtained from Group Policy Objects. A general idea of gpupdate's functionality can be obtained from the list of its mechanisms; the developers have created more than 20 types of gpupdate mechanisms for the computer and users. You can customize the desktop environment, system services and scripts, process method access restrictions, environment variables, browsers, and so on.

==== New tools ====

* ALT Diagnostic Tool is a graphical utility for OS diagnosing. ADT 0.1.3 uses the pre-prepared test suite, provides the ability for the user to run tests without additional privileges and a single view of the test report. You can also add a custom test suite to ADT.

* alterator-manager (provided in version 0.1.19) is an ADT component and modular service designed for configuration via D-Bus.

* alterator-module-executor is an ADT component and Alterator module for processing .backend files and running executables.

* libdomain is a versatile C library designed to simplify interactions with various LDAP servers, including FreeIPA, Samba/AD, and OpenLDAP. libdomain 0.9.13 features initial samba support, a test suite for samba, tests for TLS, tests for adding and removing, modifying and renaming computers in OpenLDAP.

* alterator-browser 0.1.3 is a GUI to configure the system via D-Bus. It can display and run installed Alterator modules.



{{Category navigation|title=Eleventh Platform|category=Eleventh Platform}}