Language Selection

English French German Italian Portuguese Spanish

Gentoo 2005.0 All About Security

Filed under
Gentoo
Reviews

The Gentoo Linux "meta distribution" has released its first snapshot release of the year, version 2005.0.

Gentoo considers itself to be a "meta distribution," which means it allows users to pull packages that will provide a customized distribution. The Gentoo Portage system has a tree of over 6,000 packages that are used to build a user's Gentoo Linux OS.

A Gentoo release is essentially a "snapshot" of the stable packages that exist at a particular time in the stable Portage tree. The 2005.0 release updates most packages to the latest available stable version, though there was a particular impetus to make this release due to a number of security issues.

"It is really just a culmination of all the work put into Gentoo since November, when 2004.3 was released," Chris Gianelloni, Gentoo Linux Release Engineering Strategic Lead, told internetnews.com.

"We decided to postpone the release to do a security rebuild mostly because there were several remotely exploitable security flaws in several high-profile packages, like kdelibs and mozilla-firefox."

Red Monk Analyst Stephen O'Grady said the security updates in Gentoo 2005.0 are a key improvement.

"The most important facet of the 2005.0 release to me is the attention that has been paid to securing the release out of the box; this emphasis on security is time well-invested," O'Grady told internetnews.com.

However, the latest version of GNOME 2.10 (define) and KDE 3.4 desktop (define) environments are not included in 2005.0.
"We do not include any packages that are not marked stable in the tree. Both Gnome 2.10 and KDE 3.4 were released after we made our snapshot," Gianelloni explained.

The 2005.0 release also marks the beginning of a new six month release cycle for the Gentoo snapshots, up from the previous marker of three months.

"We found that releasing every three months gave us little gain for quite a large amount of work," Gianelloni said. "Also, with the longer release cycle, it allows us to do more inventive things that would otherwise be impossible to test in the limited amount of time. We typically release on a set cycle since we aren't bound by package releases in the tree."

Six months is also a release target for a number of other open source applications. For example, Novell's SUSE Linux Professional currently releases every six months, as is the aim for GNOME. MandrakeLinux also tends to issue its releases around a six-month time frame as well. Red Hat's Fedora Core releases more often and is likely set for three releases in 2005.

"The stable release cycle simply makes things more predictable, for some people. This is enough to increase adoption," Gianelloni said. "However, I really feel that it will take more than that. We currently have a server project [that is] working at creating a special 'stable' version of the portage tree, designed for server usage. This tree will have stable package versions and will only be updated for security fixes."

Gianelloni said in his view, the "stable" version of the portage tree will be more in line with what other distributions are doing and will make it easier to certify software against a particular version of "stable" or "enterprise" Gentoo.
Currently though, Red Monk's O'Grady feels that Gentoo is already doing a good job at keeping pace with commercial distros.

"As far as keeping pace with commercial distros, my feeling is that the Gentoo team does an excellent job keeping up with the crushing volume of new projects and packages; you can find nearly everything you need in Portage, usually for multiple architectures," O'Grady said. "There are instances where it's a bit behind in some specific areas but for the most part the Gentoo team does an excellent job of keeping pace and even being out in front."

"I think you'll see us branching out into many areas," Gianelloni said, including the embedded space. "I know that there is increased effort on both servers and the embedded space, more effort has been going into moving more of the hardened packages into gentoo as defaults, plus there's the installer project and the work they're doing on building a true mass-deployment tool for Gentoo."

Mr. Kerner's story.

More in Tux Machines

Firefly COM dual boots Android and Ubuntu on hexa-core RK3399

GNOME developer Bastien Nocera talks in his latest blog post about the enhancements he managed to implement in the past few weeks to the Bluetooth stack of the Fedora Linux operating system. Read more

Games: Morphite, Mooseman, Arma, and PlayStation 4 DualShock Controller

  • Stylish FPS 'Morphite' released without Linux support, but it's coming
    Sadly, Morphite [Steam] has seen a delay with the Linux version. Thankfully, the developer was quick to respond and it's still coming.
  • The Mooseman, a short side-scrolling adventure just released for Linux
    In the mood for something a little out there? Well, The Mooseman [Steam] a short side-scroller might just hit the spot.
  • Arma 3 1.76 for Linux is planned, work on it to start "soon"
    Bohemia Interactive have announced in their latest "SITREP" that the Linux version of Arma 3 will be updated to the latest version of 1.76, work is set to start on it "soon".
  • Sony's PlayStation 4 DualShock Controller Now Supported in Fedora Linux, GNOME
    GNOME developer Bastien Nocera talks in his latest blog post about the enhancements he managed to implement in the past few weeks to the Bluetooth stack of the Fedora Linux operating system. The patches submitted by the developer to the Bluetooth packages in the latest Fedora Linux release promise to bring improvements to the way PlayStation 3 DualShock controllers are set up in the environment if you're using the GNOME desktop environment. Until now, to set up a DualShock 3 controller, users had to plug it in via USB, then disconnect it, and then press the "P" button on the joypad, which would have popped-up a dialog to confirm the Bluetooth connection. But this method had some quirks though.

Debian Development Reports

  • Free software log (July and August 2017)
    August was DebConf, which included a ton of Policy work thanks to Sean Whitton's energy and encouragement. During DebConf, we incorporated work from Hideki Yamane to convert Policy to reStructuredText, which has already made it far easier to maintain. (Thanks also to David Bremner for a lot of proofreading of the result.) We also did a massive bug triage and closed a ton of older bugs on which there had been no forward progress for many years. After DebConf, as expected, we flushed out various bugs in the reStructuredText conversion and build infrastructure. I fixed a variety of build and packaging issues and started doing some more formatting cleanup, including moving some footnotes to make the resulting document more readable.
  • Freexian’s report about Debian Long Term Support, August 2017
    Like each month, here comes a report about the work of paid contributors to Debian LTS.
  • Reproducible Builds: Weekly report #125
    16 package reviews have been added, 99 have been updated and 92 have been removed in this week, adding to our knowledge about identified issues.

The GNOME Foundation Backs Librem 5

  • GNOME Foundation partners with Purism to support its efforts to build the Librem 5 smartphone
    The GNOME Foundation has provided their endorsement and support of Purism’s efforts to build the Librem 5, which if successful will be the world’s first free and open smartphone with end-to-end encryption and enhanced user protections. The Librem 5 is a hardware platform the Foundation is interested in advancing as a GNOME/GTK phone device. The GNOME Foundation is committed to partnering with Purism to create hackfests, tools, emulators, and build awareness that surround moving GNOME/GTK onto the Librem 5 phone. As part of the collaboration, if the campaign is successful the GNOME Foundation plans to enhance GNOME shell and general performance of the system with Purism to enable features on the Librem 5.
  • Now GNOME Foundation Wants to Support Purism's Privacy-Focused Linux Smartphone
    GNOME Foundation, the non-profit organization behind the popular GNOME desktop environment designed for Linux-based operating systems, announced on Wednesday that they plan on supporting Purism's Librem 5 smartphone. The announcement comes only a week after KDE unveiled their plans to work with Purism on an implementation of their Plasma Mobile interface into the security- and privacy-focused Librem 5 Linux smartphone, and now GNOME is interested in advancing the Librem 5 hardware platform as a GNOME/GTK+ phone device. "Having a Free/Libre and Open Source software stack on a mobile device is a dream-come-true for so many people, and Purism has the proven team to make this happen. We are very pleased to see Purism and the Librem 5 hardware be built to support GNOME," said Neil McGovern, Executive Director, GNOME Foundation.
  • GNOME Joins The Librem 5 Party, Still Needs To Raise One Million More Dollars
    One week after announcing KDE cooperation on the proposed Librem 5 smartphone with plans to get Plasma Mobile on the device if successful, the GNOME Foundation has sent out their official endorsement of Purism's smartphone dream. Purism had been planning to use GNOME from the start for their GNU/Linux-powered privacy-minded smartphone while as of today they have the official backing of the GNOME Foundation.