Language Selection

English French German Italian Portuguese Spanish

Gentoo 2005.0 All About Security

Filed under
Gentoo
Reviews

The Gentoo Linux "meta distribution" has released its first snapshot release of the year, version 2005.0.

Gentoo considers itself to be a "meta distribution," which means it allows users to pull packages that will provide a customized distribution. The Gentoo Portage system has a tree of over 6,000 packages that are used to build a user's Gentoo Linux OS.

A Gentoo release is essentially a "snapshot" of the stable packages that exist at a particular time in the stable Portage tree. The 2005.0 release updates most packages to the latest available stable version, though there was a particular impetus to make this release due to a number of security issues.

"It is really just a culmination of all the work put into Gentoo since November, when 2004.3 was released," Chris Gianelloni, Gentoo Linux Release Engineering Strategic Lead, told internetnews.com.

"We decided to postpone the release to do a security rebuild mostly because there were several remotely exploitable security flaws in several high-profile packages, like kdelibs and mozilla-firefox."

Red Monk Analyst Stephen O'Grady said the security updates in Gentoo 2005.0 are a key improvement.

"The most important facet of the 2005.0 release to me is the attention that has been paid to securing the release out of the box; this emphasis on security is time well-invested," O'Grady told internetnews.com.

However, the latest version of GNOME 2.10 (define) and KDE 3.4 desktop (define) environments are not included in 2005.0.
"We do not include any packages that are not marked stable in the tree. Both Gnome 2.10 and KDE 3.4 were released after we made our snapshot," Gianelloni explained.

The 2005.0 release also marks the beginning of a new six month release cycle for the Gentoo snapshots, up from the previous marker of three months.

"We found that releasing every three months gave us little gain for quite a large amount of work," Gianelloni said. "Also, with the longer release cycle, it allows us to do more inventive things that would otherwise be impossible to test in the limited amount of time. We typically release on a set cycle since we aren't bound by package releases in the tree."

Six months is also a release target for a number of other open source applications. For example, Novell's SUSE Linux Professional currently releases every six months, as is the aim for GNOME. MandrakeLinux also tends to issue its releases around a six-month time frame as well. Red Hat's Fedora Core releases more often and is likely set for three releases in 2005.

"The stable release cycle simply makes things more predictable, for some people. This is enough to increase adoption," Gianelloni said. "However, I really feel that it will take more than that. We currently have a server project [that is] working at creating a special 'stable' version of the portage tree, designed for server usage. This tree will have stable package versions and will only be updated for security fixes."

Gianelloni said in his view, the "stable" version of the portage tree will be more in line with what other distributions are doing and will make it easier to certify software against a particular version of "stable" or "enterprise" Gentoo.
Currently though, Red Monk's O'Grady feels that Gentoo is already doing a good job at keeping pace with commercial distros.

"As far as keeping pace with commercial distros, my feeling is that the Gentoo team does an excellent job keeping up with the crushing volume of new projects and packages; you can find nearly everything you need in Portage, usually for multiple architectures," O'Grady said. "There are instances where it's a bit behind in some specific areas but for the most part the Gentoo team does an excellent job of keeping pace and even being out in front."

"I think you'll see us branching out into many areas," Gianelloni said, including the embedded space. "I know that there is increased effort on both servers and the embedded space, more effort has been going into moving more of the hardened packages into gentoo as defaults, plus there's the installer project and the work they're doing on building a true mass-deployment tool for Gentoo."

Mr. Kerner's story.

More in Tux Machines

OSS Leftovers

  • Sunjun partners with Collabora to offer LibreOffice in the Cloud
  • Tackling the most important issue in a DevOps transformation
    You've been appointed the DevOps champion in your organisation: congratulations. So, what's the most important issue that you need to address?
  • PSBJ Innovator of the Year: Hacking cells at the Allen Institute
  • SUNY math professor makes the case for free and open educational resources
    The open educational resources (OER) movement has been gaining momentum over the past few years, as educators—from kindergarten classes to graduate schools—turn to free and open source educational content to counter the high cost of textbooks. Over the past year, the pace has accelerated. In 2017, OERs were a featured topic at the high-profile SXSW EDU Conference and Festival. Also last year, New York State generated a lot of excitement when it made an $8 million investment in developing OERs, with the goal of lowering the costs of college education in the state. David Usinski, a math and computer science professor and assistant chair of developmental education at the State University of New York's Erie Community College, is an advocate of OER content in the classroom. Before he joined SUNY Erie's staff in 2007, he spent a few years working for the Erie County public school system as a technology staff developer, training teachers how to infuse technology into the classroom.

Mozilla: Wireless Innovation for a Networked Society, New AirMozilla Audience Demo, Firefox Telemetry

  • Net Neutrality, NSF and Mozilla's WINS Challenge Winners, openSUSE Updates and More
    The National Science Foundation and Mozilla recently announced the first round of winners from their Wireless Innovation for a Networked Society (WINS) challenges—$2 million in prizes for "big ideas to connect the unconnected across the US". According to the press release, the winners "are building mesh networks, solar-powered Wi-Fi, and network infrastructure that fits inside a single backpack" and that the common denominator for all of them is "they're affordable, scalable, open-source and secure."
  • New AirMozilla Audience Demo
    The legacy AirMozilla platform will be decommissioned later this year. The reasons for the change are multiple; however, the urgency of the change is driven by deprecated support of both the complex back-end infrastructure by IT and the user interface by Firefox engineering teams in 2016. Additional reasons include a complex user workflow resulting in a poor user experience, no self-service model, poor usability metrics and a lack of integrated, required features.
  • Perplexing Graphs: The Case of the 0KB Virtual Memory Allocations
    Every Monday and Thursday around 3pm I check dev-telemetry-alerts to see if there have been any changes detected in the distribution of any of the 1500-or-so pieces of anonymous usage statistics we record in Firefox using Firefox Telemetry.

Games: All Walls Must Fall, Tales of Maj'Eyal

  • All Walls Must Fall, the quirky tech-noir tactics game, comes out of Early Access
    This isometric tactical RPG blends in sci-fi, a Cold War that never ended and lots of spirited action. It’s powered by Unreal Engine 4 and has good Linux support.
  • Non-Linux FOSS: Tales of Maj'Eyal
    I love gaming, but I have two main problems with being a gamer. First, I'm terrible at video games. Really. Second, I don't have the time to invest in order to increase my skills. So for me, a game that is easy to get started with while also providing an extensive gaming experience is key. It's also fairly rare. All the great games tend to have a horribly steep learning curve, and all the simple games seem to involve crushing candy. Thankfully, there are a few games like Tales of Maj'Eyal that are complex but with a really easy learning curve.

KDE and GNOME: KDE Discover, Okular, Librsvg, and Phone's UI Shell

  • This week in Discover, part 7
    The quest to make Discover the most-loved Linux app store continues at Warp 9 speed! You may laugh, but it’s happening! Mark my words, in a year Discover will be a beloved crown jewel of the KDE experience.
  • Okular gains some more JavaScript support
    With it we support recalculation of some fields based on others. An example that calculates sum, average, product, minimum and maximum of three numbers can be found in this youtube video.
  • Librsvg's continuous integration pipeline
    With the pre-built images, and caching of Rust artifacts, Jordan was able to reduce the time for the "test on every commit" builds from around 20 minutes, to little under 4 minutes in the current iteration. This will get even faster if the builds start using ccache and parallel builds from GNU make. Currently we have a problem in that tests are failing on 32-bit builds, and haven't had a chance to investigate the root cause. Hopefully we can add 32-bit jobs to the CI pipeline to catch this breakage as soon as possible.
  • Design report #3: designing the UI Shell, part 2
    Peter has been quite busy thinking about the most ergonomic mobile gestures and came up with a complete UI shell design. While the last design report was describing the design of the lock screen and the home screen, we will discuss here about navigating within the different features of the shell.