Alpine Linux - User contributions [en]

Release Notes for Alpine 3.17.0

2023-02-19T14:24:57Z

Lmarz: Fill in the changes from the release announcement

== Important changes ==

=== New default OpenSSL version ===
OpenSSL 3.0 is now the default OpenSSL version. OpenSSL 1.1 is available via the {{Pkg|openssl1.1-compat}} package.

=== Rust now works on all architectures ===

== Significant updates ==

* bash 5.2
* GCC 12
* Kea 2.2
* LLVM 15
* OpenSSL 3.0
* Perl 5.36
* PostgreSQL 15
* Node.js (lts) 18.12
* Node.js (current) 19.1
* Ceph 17.2
* GNOME 43
* Go 1.19
* KDE Plasma 5.26
* Rust 1.64
* .NET 7.0.100

== Deprecations / Removals ==

=== PHP 8.0 has been deprecated ===

[[Category:News]]

Release Notes for Alpine 3.17.0

2023-02-19T14:13:31Z

Lmarz: Add to category

== Important changes ==

[[Category:News]]

Release Notes for Alpine 3.16.0

2023-02-19T14:13:10Z

Lmarz: Add to category

== Important changes ==

=== Python 2 has been removed ===

Stable alpine releases do not have python 2 anymore.

=== /tmp mounted as tmpfs ===

Previously <code>/tmp</code> was part of the root filesystem and was cleaned on boot via the bootmisc openrc service script. In v3.16, new installations will mount <code>/tmp</code> as tmpfs.

The bootmisc script no longer wipes /tmp on boot. If you want the previous behaviour, set <code>wipe_tmp</code> to YES in /etc/conf.d/bootmisc

=== ICU data split ===

The icu package has been split into:

* {{pkg|icu-data-en}} (2.6 MiB) - Stripped down ICU data with only en_US/GB locale and no legacy charset converters.
* {{pkg|icu-data-full}} (29 MiB) - Full ICU data.

{{pkg|icu-libs}} only installs icu-data-en. If additional language support is required, {{pkg|icu-data-full}} needs to be installed manually.

{{pkg|nodejs}} is now compiled with system ICU.

=== NetworkManager plugins ===

NetworkManager plugins (e.g. WiFi or ADSL support) have been moved into subpackages and are not installed by default. If you use some of them, install the corresponding packages:

* WiFi: {{pkg|networkmanager-wifi}}
* ADSL: {{pkg|networkmanager-adsl}}
* Mobile broardband: {{pkg|networkmanager-wwan}}
* BlueTooth: {{pkg|networkmanager-bluetooth}}
* PPP: {{pkg|networkmanager-ppp}}
* Open vSwitch: {{pkg|networkmanager-ovs}}

=== xen-qemu split ===

The qemu components of xen were split into a new subpackage, {{pkg|xen-qemu}}. If you were using the qemu- xen binaries or the xenqemu service or firmware such as qemu/bios.bin / edk2-* files, you might need to install this.

=== Nextcloud 24 ===

Nextcloud can only be upgraded one major version at a time. However, in Alpine 3.15 the version was 22, and in 3.16 it is 24. To upgrade between them, make use of the {{pkg|nextcloud23}} package to satisfy this limitation.

== New features and noteworthy new packages ==

=== Fixed not showing boot output using consoles with drivers compiled as modules ===

OpenRC output is now shown on VirtIO serial consoles.

=== SDL 1.2 migrated to SDL 1.2 compat ===

The old sdl package (SDL 1.2) has been moved from community to testing and as such won't be part of Alpine 3.16. Applications that use sdl instead use sdl12-compat, which is based on the much more well-maintained sdl2 (SDL 2.0). This results in various improvements such as support for Wayland, PipeWire, and more gamepads.

=== utmp ===

TODO(jirutka): Write something…

https://skarnet.org/software/utmps/

The following packages are built with utmps:

* busybox
* dropbear
* mingetty
* openssh
* util-linux

=== login-utils ===

{{pkg|util-linux-login}} has been added as a provider of the <code>login</code> command. If <code>cmd:login</code> has been added to world, then the util-linux implementation will be preferred over the shadow implementation. If the shadow implementation is required, then {{pkg|shadow-login}} must be manually selected.

=== Zsh - modular zshrc and plugins support ===

TODO(jirutka): Write description.

=== doas-sudo-shim ===

If you are hesitant to switch to {{pkg|doas}} because you have <code>sudo</code> too deep in your muscle memory, hesitant no more! Just install {{pkg|doas-sudo-shim}} and you can continue to use the <code>sudo</code> command, but without its security issues and bloat.

== Significant updates ==

* GNOME 42
* LLVM 13
* PHP 8.0 and 8.1 both shipped
* Python 3.10
* QEMU 7
* R 4.2
* Ruby 3.1
* Rust 1.60
* Sway 1.7
* Xen 4.16.1

=== KDE ===

Plasma has been upgraded from 5.23 to 5.24.

KDE applications (the release service) have been upgraded from 21.08 to 22.04 and KDE Frameworks have been upgraded from 5.88 to 5.93.

Plasma Mobile Gear have been upgraded from 21.12 to 22.04.

=== Python upgraded to 3.10 ===

Python has been upgraded to version 3.10, and all modules have been rebuilt against python 3.10. Manually-installed Python modules must be recompiled against 3.10.

== Deprecations / Removals ==

=== php7 moved to testing ===

The {{pkg|php7}} package has been moved to testing, as no more packages in community depend on it and php 7.4 will be EOL soon. {{pkg|php8}} has taken it's place, which is php 8.0. Additionally 8.1 is shipped via community

[[Category:News]]

Release Notes for Alpine 3.15.0

2023-02-19T14:12:43Z

Lmarz: Add to category

== Important changes ==

=== New package signing keys ===

New signing keys have been generated for v3.15 ongoing. The key size has been increased from 2048 bits to 4096 bits. Make sure you have <code>alpine-keys-2.4-r0</code> or later before upgrading to 3.15 (or downgrading from edge).

You can run:

<pre>
apk add -X http://dl-cdn.alpinelinux.org/alpine/v3.14/main -u alpine-keys
</pre>

to update the keys to the required version.

=== MIPS64 discontinued ===

The build hardware we use for building the packages is broken and the architecture is EOL, so there is no new hardware available anymore. As a consequence, there will be no v3.15 release for mips64, and existing releases can no longer receive security updates, so continued use of this architecture is not recommended.

=== radvd no longer enables ipv6 forwarding ===

The radvd init script no longer enables ipv6 forwarding. To enable ipv6 forwarding (necessary for most networks), add <code>net.ipv6.conf.all.forwarding=1</code> to {{path|/etc/sysctl.conf}} or to a file in {{path|/etc/sysctl.d}}.

=== Move from sudo to doas ===

doas is the default temporary privilege escalation tool. You are advised to migrate from sudo to doas as 3.15 will be the last release to support sudo throughout its full lifecycle, in 3.16 sudo will be moved from main to community.

=== PipeWire doesn't auto-start a session manager anymore ===

In 3.14 and earlier the PipeWire default config was edited in packaging to auto-start pipewire-media-session as the default session manager. Since we now have wireplumber available as an alternative session manager, this has been changed in favor of a launch wrapper for pipewire at <code>/usr/libexec/pipewire-launcher</code>. When executed this will launch pipewire, pipewire-media-session or wireplumber, and pipewire-pulse, depending on what modules are available. If you were launching <code>/usr/bin/pipewire</code> and the session manager manually before, please use the new launcher wrapper instead. WirePlumber can now also be used as a proper alternative for pipewire-media-session.

== New features and noteworthy new packages ==

=== Compressed kernel modules ===

Kernel modules are now compressed using gzip.

=== UEFI Secure Boot ===

Complete support for [[UEFI Secure Boot]] realized by package {{pkg|secureboot-hook}} and {{pkg|efi-mkkeys}}.

=== Support overlaytmpfs mount options ===

It is now possible to use tmpfs(5) mount options with <code> overlaytmpfsflags</code>, when using <code>overlaytmpfs</code>, see mkinitfs-bootparams(7). Also, <code>rootflags</code> and <code>rootfstype</code> options are now picked up for the underlying rootfs mount.

=== Support for out-of-tree kernel modules built from source ===

Alpine Kernel Module Support ({{pkg|akms}}) – support for building out-of-tree Linux kernel modules from source in an automated and organized fashion. It’s like DKMS, but designed specifically for Alpine Linux.

=== PostgreSQL multiple major versions ===

PostgreSQL packaging has been reworked to allow multiple major versions of PostgreSQL server to be installed side by side. This makes it possible to allow to upgrade PostgreSQL cluster from one major version to the next using <code>pg_upgrade</code> tool, and also to run an older major version of PostgreSQL on the latest version of Alpine Linux. The latest PostgreSQL version can be installed simply with <code>apk add postgresql</code> as before. If you need an older major version, install the specific package, e.g. {{pkg|postgresql13}}. You can switch between installed major versions using command <code>pg_versions</code>.

See [https://gitlab.alpinelinux.org/alpine/aports/-/merge_requests/27275 MR #27275] for more information.

=== Rofi for Wayland ===

Rofi can now be used on Wayland desktops thanks to the fork {{pkg|rofi-wayland}}.

=== Encrypted Data Disk and System Disk modes ===

<code>setup-disk</code> ({{pkg|alpine-conf}}) now supports encrypted Data Disk and System Disk modes.

== Significant updates ==

=== 5.15 LTS kernels ===

linux-lts and linux-virt upgraded to 5.15

'''Note:''' If you are using ''ZFS'' and depend on symlinks under /dev/zvol/ some are sporadically not created during boot, this is known upstream by ''OpenZFS'' and we track the issue [https://gitlab.alpinelinux.org/alpine/aports/-/issues/13198 here].

=== Ruby 3.0.2 ===

Ruby has been upgraded to version 3.0.2.

Packages {{pkg|ruby-minitest}}, {{pkg|ruby-net-telnet}}, {{pkg|ruby-power_assert}}, {{pkg|ruby-sdbm}}, {{pkg|ruby-test-unit}}, {{pkg|ruby-xmlrpc}}, {{pkg|ruby-webrick}} has been moved from ruby aport to separate aports. Please note that since they don’t inherit the version from the ruby aport anymore, their new (real) version is ''lower'' than before!

Subpackages ruby-bigdecimal, ruby-etc, ruby-fiddle, ruby-gdbm, ruby-io-console, ruby-irb, and ruby-json have been merged into ruby-libs.

=== LLVM12 added ===

LLVM12 is now available.

=== KDE ===

KDE Plasma has been upgraded to version 5.23, and KDE Applications have been upgraded to 21.08.
Plasma Mobile Gear has been upgraded to 21.10.

=== Node.js ===

Node.js (LTS) has been upgraded to version 16.13.0. nodejs-current has been upgraded to 17.0.1.

=== PHP ===

PHP 7.4 started to phase out (1 year of security support left).
Transition to 8.0 is not finished yet as some app still require old version.

=== PostgreSQL 14 ===

PostgreSQL has been upgraded to version 14.0. Since this release, multiple major versions are provided, currently: 12, 13, and 14.

Support for Just-in-time compilation (JIT) has been moved into subpackage {{pkg|postgresql-jit}}.

{{pkg|libpq}} is now built without LDAP support which reduces number of installed dependencies. Note that this does ''not'' affect the LDAP support in PostgreSQL server, it’s preserved.

=== Mercurial ===

mercurial has been upgraded to 5.9.3

=== Dlang build tools (DMD, DUB, LDC) have been updated ===

Both compilers have been updated to frontend version v2.098.0 (LDC equivalent: v1.28.0).
Dub has been updated to v1.27.0.
LDC now always uses `--export-dynamic` so that code compiled without debug infos (`-g`) will still have the function name in its stack trace.

=== OpenJDK 17 added ===

The latest OpenJDK LTS version (17) has been added to this release and is available via the community repository.

=== GNOME 41 ===

Most GNOME packages have been upgraded to version 41.

=== Crystal ===

{{pkg|crystal}} has been upgraded to version 1.2.2.

=== Kea ===

{{pkg|kea}} has been upgraded to version 2.0.0.

=== OpenLDAP ===

{{pkg|openldap}} has been upgraded to version 2.6.0.

=== Rust ===

{{pkg|rust}} has been upgraded to version 1.56.1.

== Significant removals ==

=== QtWebKit was removed due to lack of upstream support ===

qt5-qtwebkit, kdewebkit, wkhtmltopdf, and py3-pdfkit have been removed due to known vulnerabilities and lack of upstream support for qtwebkit. Other programs have been adjusted to use qt5-qtwebengine where appropriate. The most direct replacement for wkhtmltopdf is weasyprint, which is available in the Alpine Linux community repository. puppeteer and pandoc are also options, depending on your needs. See [https://gitlab.alpinelinux.org/alpine/aports/-/issues/12888 #12888] for more information.

=== unrar moved to non-free ===

The unrar program from Alexander Roshal is distributed under a non-free license. Therefore, the unrar package has been moved to the non-free repository. Most RAR files can be unpacked using the bsdtar program from libarchive-tools; otherwise, users can compile and install the unrar package separately.

== Development-related changes ==

=== PostgreSQL ===

{{pkg|postgresql-dev}} has been split into {{pkg|libpq-dev}}, {{pkg|libecpg-dev}}, and <code>postgresql-dev</code> (this is ''provided'' by {{pkg|postgresql14-dev}}, {{pkg|postgresql13-dev}} etc.). Basically, only PostgreSQL extensions should use {{pkg|postgresql-dev}} in <code>makedepends</code>; all other aports should use {{pkg|libpq-dev}} and/or {{pkg|libecpg-dev}} (there are some exceptions though).

PostgreSQL extensions (typically packages with <code>postgresql-</code> prefix) should use {{pkg|postgresql-dev}} in <code>makedepends</code> – this will install the latest <code>postgresql<majorver>-dev</code> package, unless there’s a dependency on a specific postgresql version in the dependency graph (which shouldn’t be).

Each aport providing a PostgreSQL extension must explicitly depend on specific <code>postgresql<majorver></code> package, not <code>postgresql</code> provider. This should be solved by adding the following into the <code>package</code> function (!) in each aport that provides PostgreSQL extension:

<pre>
depends="postgresql$(pg_config --major-version)"
</pre>

[[Category:News]]

Release Notes for Alpine 3.14.0

2023-02-19T14:12:23Z

Lmarz: Add to category

== aports ==

=== faccessat2 ===
Use of the faccessat2 syscall has been enabled in musl. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], new system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker with libseccomp predating their release. Therefore, Alpine Linux 3.14 requires '''at least one''' of the following:

# runc v1.0.0-rc93
## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
# Docker 20.10.0 (which contains [https://github.com/moby/moby/commit/a18139111d8a203bd211b0861c281ebe77daccd9 moby commit a181391]) or greater, '''''AND''''' libseccomp 2.4.4 (which contains backported [https://github.com/seccomp/libseccomp/commit/5696c896409c1feb37eb502df33cf36efb2e8e01 libseccomp commit 5696c89]) or greater. In this case, to check if your host libseccomp is faccessat2-compatible, invoke <code>scmp_sys_resolver faccessat2</code>. If 439 is returned, faccessat2 is supported. If -1 is returned, faccessat2 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 20.10.0, regardless of the result of this command.
# As a workaround, in order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to faccessat.

Note also that when using nested Docker, '''every layer''' must meet one of the above requirements, since if '''any layer''' improperly denies the use of faccessat2, Alpine Linux 3.14 will not function correctly.

=== Xorg ===
xf86-input-{mouse,keyboard} have been removed, as upstream maintainers have explicitly declared that they are for non-Linux platforms only. Users should have already switched to xf86-input-evdev or xf86-input-libinput.

Rootless support has been enabled for Xorg. X now requires udev or mdev, and either elogind must be enabled or X users must be in the video and input groups.

The Xorg sysconfdir has been changed from /etc/X11 to /etc. In the unlikely event that you have configuration files in /etc/X11/X11, those must be moved to /etc/X11.

=== Python upgraded to 3.9 ===

Python has been upgraded to version 3.9, and all python modules have been rebuilt against python 3.9. Make sure that all custom python3 modules are built against python3.9

=== ClamAV moved to community ===

The [https://pkgs.alpinelinux.org/package/edge/community/x86_64/clamav clamav] package has been moved from main to community. We cannot support releases for 2 years, which we do for packages in main, and clamav warns that the version is too old. If you need clamav, make sure that you have the community repository enabled in <tt>/etc/apk/repositories</tt>, but do note that packages in community are only supported for one release (6 months).

=== openssh flavors ===

There was already an OpenSSH flavor with PAM support, but now there has been added a new flavor for krb5 (openssh-server-krb5, openssh-client-krb5). Note that this new flavor includes PAM support, in case you need both.

[[Category:News]]

Release Notes for Alpine 3.13.0

2023-02-19T14:12:03Z

Lmarz: Add to category

== aports ==

=== musl 1.2 ===

musl has been upgraded to 1.2. This release changes the definition of <code>time_t</code> on 32-bit systems. See the [https://musl.libc.org/time64.html musl time64 release notes] for more details.

==== time64 requirements ====

The following important information applies for users of x86, armv7, and armhf (currently supported 32-bit architectures), including 32-bit Docker containers on 64-bit hosts.

All self-compiled packages must be manually rebuilt after upgrading, even if relocation/SONAME errors are not encountered.

musl 1.2 uses new time64-compatible system calls. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], these system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker or libseccomp version predating their release. Therefore, Alpine Linux 3.13.0 requires one of the following:

# runc v1.0.0-rc93
## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
# Docker 19.03.9 (which contains backported [https://github.com/moby/moby/commit/89fabf0f241292e929fbb2fbb794d58d8d697ab5 moby commit 89fabf0]) or greater, AND libseccomp 2.4.2 (which contains backported [https://github.com/seccomp/libseccomp/commit/bf747eb21e428c2b3ead6ebcca27951b681963a0 libseccomp commit bf747eb]) or greater. In this case, to check if your host libseccomp is time64-compatible, invoke <code>scmp_sys_resolver -a x86 clock_gettime64</code> for x86 containers, or <code>scmp_sys_resolver -a arm clock_gettime64</code> for armhf or armv7 containers. If 403 is returned, time64 is supported. If -1 is returned, time64 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 19.03.9, regardless of the result of this command.

In order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to 32-bit time system calls. In this case, the container will not be compatible with dates past 2038.

Alternatively, <code>--security-opt=seccomp=unconfined</code> can be passed with no <code>default.json</code> required, but note that this will reduce the security of the host against malicious code in the container.

=== Deprecation of Berkeley DB (BDB) ===

Oracle has changed the license of BDB to AGPL-3.0, making it unsuitable to link to packages with GPL-incompatible licenses. Since the old version is no longer maintained, the <code>db</code> package is now deprecated. Alpine Linux packages are being transitioned to alternatives or, where no alternatives exist, removed entirely.

Support for Postfix <code>hash</code> and <code>btree</code> databases has been removed. <code>lmdb</code> is the recommended replacement. Before upgrading, all tables in <code>/etc/postfix/main.cf</code> using <code>hash</code> and <code>btree</code> must be changed to a supported alternative. See the [http://www.postfix.org/DATABASE_README.html Postfix lookup table documentation] for more information.

cyrus sasldb now uses <code>gdbm</code> instead of <code>db</code>. The database must be created from scratch or manually migrated after upgrading to Alpine Linux 3.13.

=== Switching from busybox ifupdown to ifupdown-ng ===

The default ifupdown implementation has been switched from busybox to [https://github.com/ifupdown-ng/ifupdown-ng/ ifupdown-ng]. ifupdown-ng is intended to be compatible with debian ifupdown and busybox ifupdown, but all users of <code>/etc/network/interfaces</code> should read the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/README.md ifupdown-ng readme] and the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/doc/ADMIN-GUIDE.md ifupdown-ng admin guide] before upgrading.

ifupdown-ng has native vlan support, so the <code>vlan</code> package is no longer required and can be uninstalled. The <code>bridge</code> and <code>bond</code> packages are still required.

=== GCC 10 ===

GCC has been upgraded to version 10. GCC 10 sets the <code>-fno-common</code> option by default. All Alpine Linux packages have been fixed, but users compiling other software on Alpine Linux may need to make changes to their code. For more information, see the [https://gcc.gnu.org/gcc-10/porting_to.html GCC 10 porting guide].

=== PHP 8.0 ===

PHP 8.0 with a common set of extensions is now available as <code>php8</code>. PHP 7.4 (<code>php7</code>) remains the default.

=== xorg-server has moved to community ===

xorg-server and related packages have been moved from main to community. To install it, ensure {{Path|/etc/apk/repositories}} contains the community repository.

Running <code>setup-xorg-base</code> will automatically enable the community repo before installing xorg-server.

=== nextcloud 20 ===

Nextcloud has been updated to version 20. As a direct upgrade from 18 to 20 is [https://docs.nextcloud.com/server/latest/admin_manual/maintenance/upgrade.html not supported by nextcloud], Nextcloud 19 must be temporarily installed.

# Take a note and remove all nextcloud-* aports
# Install corresponding the nextcloud19-* aports
# Run <code>occ upgrade</code> as any regular update
# Verify everything still works
# Remove the nextcloud19-* aports again
# Install the regular nextcloud-* aports again
# Run Steps 3 and 4 again
# The upgrade should now be finished

As the last step you should visit your administrator settings overview page and run any missing db-updates as shown (e.g. <code>db:add-missing-indices db:add-missing-primary-keys db:add-missing-columns db:convert-filecache-bigint</code>)

=== spamassassin ===
<code>/etc/conf.d/spamd</code> has been moved from the <code>spamassassin</code> to the <code>spamassassin-openrc</code> package.

=== WireGuard upstreamed ===

WireGuard is now included in the standard Linux kernel since version 5.6, so the <code>wireguard-lts</code> and <code>wireguard-virt</code> packages have been removed.

=== QEMU packages split ===

Several features previously in the standard qemu package have been split into subpackages, including qemu-audio-*, qemu-block-*, qemu-hw-display-*, and qemu-ui-*.
The metapackage qemu-modules installs all of these.

== busybox ==

=== Removed applets ===

The following applets have been removed:

* '''hdparm''': Missing many features. Use <code>hdparm</code> instead.
* '''fdformat''': Rarely used. Use <code>util-linux</code> instead.
* '''readprofile''': Rarely used. Consider <code>perf</code> or use <code>util-linux</code> instead.
* '''lspci''': Missing many features, such as hwdb support. Use <code>pciutils</code> or <code>grep . /sys/bus/pci/devices/*/*</code> instead.
* '''conspy''': Rarely used.
* '''smemcap''': Rarely used.
* '''dumpleases''': Rarely used.

Alternatives for conspy, smemcap, and dumpleases are not currently packaged due to a lack of interest. If you require these programs, please file an issue at [https://gitlab.alpinelinux.org/alpine/aports/ Alpine GitLab].

=== Changes ===

The following applets now support long options:

* gzip
* install
* ipcalc

== apk-tools ==

=== Man page ===

apk-tools now has an official man-page: <code>apk-tools-docs</code>. If the <code>docs</code> package is installed, man pages will automatically be installed and updated for all installed packages.

== Known issues ==

=== LVM boot scanning ===

Some users are reporting a regression in Alpine Linux 3.13 where nlplug-findfs fails to detect LVM PVs at boot. The current workaround is to temporarily downgrade to Linux 5.4 from Alpine Linux 3.12. This issue is being tracked in [https://gitlab.alpinelinux.org/alpine/aports/-/issues/12325 aports issue 12325].

[[Category:News]]

Release Notes for Alpine 3.12.0

2023-02-19T14:11:43Z

Lmarz: Add to category

== aports ==

===== python2 no longer provides python and python-devel =====

python2 no longer provides python and python-devel, nothing does, it is now required that you explicitly depend on either python2 or python3, any new contributions that depend on python2 will be rejected summarily, and python2 is in the process of being **completely** removed.

You must <code>apk del python</code> and add `python3` or `python2` for the upgrade to work correctly, as a stale `python` in /etc/apk/world will prevent things from upgrading correctly.

===== llvm 10.0.0 =====

llvm 10 is now the default in Alpine Linux.

[https://gitlab.alpinelinux.org/alpine/aports/commit/7a1323c27479fb967749c163f34483bc1196055d commit]

===== Initial support for DLang =====

We've added initial support for the D language with this release. We now have GDC, the D compiler frontend using GCC, available on all arches but ppc64le and LDC, a D compiler using the LLVM backend, on x86, x86_64 and aarch64. Most things are built against LDC, since it offers superior optimization and a vastly newer versions of the D runtime and standard library. These contain many important bug fixes (especially on aarch64) and contain features required by many D applications.

===== py3-setuptools now uses system python3 modules instead of vendored dependencies =====

py3-setuptools now installs py3-packaging, py3-parsing, py3-appdirs, py3-six and py3-ordered-set from the system.

The following commits are the ones responsible for this change:

* [https://git.alpinelinux.org/aports/commit/?id=efca8852f37cb4028f234f92e2d035617f524820 py3-six] (use distutils)
* [https://git.alpinelinux.org/aports/commit/?id=55e3496387ad3f2df387b2cf6bc84e85ef729833 py3-ordered-set] (new aport)
* [https://git.alpinelinux.org/aports/commit/?id=cc1636b08fba58b629501d525d658aed4bcbeab2 py3-ordered-set] (move from testing to main)
* [https://git.alpinelinux.org/aports/commit/?id=da743693eda54b9faf5086746b91506495fc689f py3-appdirs] (move from community to main)
* [https://git.alpinelinux.org/aports/commit/?id=60efe787954008af546a5bde839db09f11682102 py3-appdirs] (use distutils)
* [https://git.alpinelinux.org/aports/commit/?id=a50097b40bcf80a9aec201fef73a722206f43a0d py3-packaging] (use distutils)
* [https://git.alpinelinux.org/aports/commit/?id=52ee5092c510657e9b1e8b4ae0104d405c9eac99 py3-parsing] (install manually)
* [https://git.alpinelinux.org/aports/commit/?id=33ea734e2d28d88a3d545500c96b4c72b3e78432 py3-setuptools] (use system component)

===== ncurses fixes =====

A few fixes trickled in relating exclusively to Alpine Linux that affect ncurses:

With this [https://git.alpinelinux.org/aports/commit/?id=762b9fd601983d8a6e6a60692158f3f22b1b60fe commit] the ncurses-lib package no longer depends on the ncurses-terminfo, which was too big at 7.5 MB, instead ncurses-lib now depends solely on the ncurses-terminfo-base package which weights at around 120 kB.

With this [https://git.alpinelinux.org/aports/commit/?id=56aa7795fecc48561deb095995abd335e16ba515 commit] the ncurses-terminfo-base now includes the most common terminfo databases like tmux, screen, xterm-256color and also databases for packaged terminals like gnome-terminal, vte, konsole, alacritty, kitty, putty. All other terminfo databases are now in ncurses-terminfo.

With this [https://git.alpinelinux.org/aports/commit/?id=1470a6c8e76491a8d059ebd4b7521c4bf20b837c commit] all terminals that have their terminfo databases provided by the ncurses-terminfo-base now depend on it.

===== python3 no longer provides pip3, use py3-pip from community =====

Python3 is now built with --without-ensurepip which removes pip3 and its libraries from it. Instead use the py3-pip pacakge which uses system components.

===== BPF JIT support =====

> TODO: Small preamble about BPF

So it (BPF JIT) has been enabled by default in [https://git.alpinelinux.org/aports/commit/?id=3bf2313adc57fe6b36bf459ddca6d65a392609db 3bf2313adc57fe6b36bf459ddca6d65a392609db], and unprivileged BPF JIT has been disabled in [https://git.alpinelinux.org/aports/commit/?id=4e286992d5ed751f6ca60eb18d77313bb0868513 4e286992d5ed751f6ca60eb18d77313bb0868513].

===== OpenRC now has a sane ordering of directories when configuring kernel parameters =====

Configuring kernel parameters is done by having configuration files in specific locations like <code>/etc/sysctl.conf</code> and files ending with <code>.conf</code> in certain directories like <code>/etc/sysctl.d</code>. Before 3.12.0 the ordering had no logical explanation and
surprised users that expected a hierarchy.

Starting with 3.12.0 the ordering is as follows:

# /lib/sysctl.d/*.conf
# /usr/lib/sysctl.d/*.conf
# /run/sysctl.d/*.conf
# /etc/sysctl.conf
# /etc/sysctl.d/*.conf

<code>/lib/sysctl.d</code> and <code>/usr/lib/sysctl.d</code> are to be used by the distribution and packages. Alpine Linux installs its default configuration file in <code>/lib/sysctl.d/00-alpine.conf</code>. Software installed via our package manager will install to either of those places.

<code>/run/sysctl.d</code> holds configuration that is created at run-time by daemons/services or at very early-boot. Neither the distribution nor the packaged software will install configuration to it, primarily because /run is in temporary memory. Configuration in this location that matches names the locations used by the distribution and packages will cause the latter not to be read and applied by the <code>sysctl</code> service.

<code>/etc/sysctl.d</code> holds configuration that is created and maintained by the local administrator, neither Alpine nor its packaged software will touch it, and configuration in that has the same name as in the location reserved for the distribution and packages, or the location for run-time configuration from daemons/services, will cause the latter to not be read and applied by the <code>sysctl</code> service.

<code>/etc/sysctl.conf</code> is a historical location for this kind of configuration and is kept for the same reasons.

===== OpenRC now has a sane ordering of directories when loading kernel modules =====

Loading kernel modules during boot is done with the <code>modules</code> OpenRC service, which reads configuration files in certain locations and loads kernel modules with the modprobe utility from either busybox or util-linux.

Starting with 3.12.0 a more logical ordering is adopted for which configuration files to read and ignore:

# /lib/modules-load.d/*.conf
# /usr/lib/modules-load.d/*.conf
# /run/modules-load.d/*.conf
# /etc/modules
# /etc/modules-load.d/*.conf

<code>/lib/modules-load.d</code> and <code>/usr/lib/modules-load.d</code> are to be used by the distribution and packages. Software installed via our package manager will install to either of those places.

<code>/run/modules-load.d</code> holds configuration that is created at run-time by daemons/services or at very early-boot. Neither the distribution nor the packaged software will install configuration to it, primarily because /run is in temporary memory. Configuration in this location that matches names in the locations used by the distribution and packages will cause the latter not to be read and applied by the <code>modules</code> service.

<code>/etc/modules-load.d</code> holds configuration that is created and maintained by the local administrator, neither Alpine nor its packaged software will touch it, and configuration in that has the same name as in the location reserved for the distribution and packages, or locations reserved for the run-time configuration of daemons/services, will cause the latter to not be read and applied by the <code>modules</code> service.

<code>/etc/modules</code> is a historical location for this kind of configuration and is kept for the same reasons.

===== Telegram Desktop is now available in the community repo =====

See [https://git.alpinelinux.org/aports/commit/?id=184355fdc44bc2e12976d65518fe029d8a6e459d commit] that moved the package to the community repo for explanation.

===== efitools and sbsigntool are now in main/ =====

Those packages have lived in testing/ for a long time and have been successfully used by one of our developers to implement secure-boot in his system. They have been moved to main/ and will be available for others.

===== Packages which need libsecret's DBus API now depend a provider of its API via dbus:org.freedesktop.Secret =====

Previously it was possible to install a program which required the DBus API of libsecret (e.g. Fractal), but not install a secrets provider (e.g. gnome-keyring), so logins wouldn't be saved. This has been corrected and packages which require this API depend on the provider-package dbus:org.freedesktop:Secret now. It's provided by gnome-keyring, kwallet and keepassxc (in that order of importance, i.e. if none of these is pulled in gnome-keyring will be chosen by default). Right now we manually declared the provider for dbus:org.freedesktop.Secret, but eventually we should have an automatic detection for the DBus API packages provide to make this easier for other packages.

===== Preferring enchant2 over enchant =====

All packages which support enchant2 have been moved over to it instead of using enchant(1). enchant2 now also supports nuspell, which is a faster drop-in replacement for hunspell, which utilizes hunspell's dictionaries.

===== Firefox is now in community =====

Firefox finally left testing and will be in community, supported for 6 months.

===== moonjit is now luajit =====

Our luajit package switched to the alive moonjit fork which has, among other things, s390x support and actual development.

This [https://git.alpinelinux.org/aports/commit/?id=af7f776d08cf7c12c3dd62347829fe33e66dceaa commit] switched luajit over to moonjit, the following [https://git.alpinelinux.org/aports/commit/?id=a7d057d98859940cc3347dba011957f99291b1fa commit] removes our **HUGE** 46k s390x support patch which is now handled by upstream.

===== Support for YubiKeys =====

yubikey-manager and yubikey-manager-qt have been added to the community repos for using and managing your yubikeys. Installing yubikey-manager and enabling the pcscd service should make yubikeys functional.

===== Support for apk in GNOME Software =====

GNOME Software now offers integration with apk, the Alpine Package Keeper, so desktop applications can be installed via a GUI.

===== busybox no longer provider 'patch' builtin =====

The builtin is a prototype which fails the moment any fuzzing needs to be done and as such is not usable too many cases to justify its inclusion, build-base (which provider compilers and other development tools) now depends on patch and others need to install patch by themselves if they plan on using it.

the abuild package already depended on it and it is widely used in Alpine Linux's aports.

== abuild ==

===== Add default functions for subpackages that hold Bash, Zsh and Fish completion =====

abuild now provides default functions for $pkgname-bash-completion, $pkgname-zsh-completion and $pkgname-fish-completion subpackages.

Expected location of the completion files per shell:

* Bash -> <code>/usr/share/bash-completion/completions</code>
* Zsh -> <code>/usr/share/zsh/site-functions</code>
* Fish -> <code>/usr/share/fish/completions</code>

Files must be installed in the expected location in relation to '''$pkgdir''' in '''pacakge()'''.

Introduced in [https://gitlab.alpinelinux.org/alpine/abuild/commit/d5826968b713123a4f51d3dec1adb1225d0e194f d5826968b713123a4f51d3dec1adb1225d0e194f].

===== newapkbuild when called with CMake (-C) does out-of-source builds by default =====

When packaging with newapkbuild and using the -C switch to pre-fill the apkbuild with skeleton functions for CMake now:

* Adds <code>-B build</code> to the <code>cmake</code> call in '''build()'''.
* Adds <code>-C build</code> the <code>make</code> calls.

Doing out-of-source builds are recommended upstream to the point where warnings are printed when calling CMake on a project.

Introduced in [https://gitlab.alpinelinux.org/alpine/abuild/commit/e125a764896d884c69cc409e614b65cb336c15e8 e125a764896d884c69cc409e614b65cb336c15e8].

===== set CARGO_HOME to cache dependencies of rust packages =====

CARGO_HOME is now set to '''$SRCDEST/cargo''' and will cache all dependencies downloaded.

Introduced in [https://gitlab.alpinelinux.org/alpine/abuild/commit/af0c88e6abbb1e49224759f5c51b3068e6eab28b af0c88e6abbb1e49224759f5c51b3068e6eab28b].

===== The "plain" buildtype for Meson and "None" buildtype for CMake are used now =====

We previously used the "release" or "debugoptimized" buildmode for Meson or "Release" or "RelWithDebInfo" for CMake. This caused Meson and CMake to ignore parts of our C{,XX}FLAGS, e.g. by setting -O2 or even -O3 instead of our default of -Os. We've changed to the "plain" buildtype and the "None" buildtype for CMake. This should result in smaller binaries since -Os is respected now. See [https://lists.alpinelinux.org/~alpine/devel/%3C2896c13070c508a49cbaa72c8fb7f34ea947358b.camel%40cogitri.dev%3E the respective mailing list post]

==== abuild-meson introduced ====

abuild-meson is a small wrapper shellscript that wraps meson (directly inspired by Arch Linux's arch-meson and Void Linux's build_style=meson), calling it with the correct options for packaging in Alpine Linux. APKBUILDs should switch to using it to guarantee all APKBUILDs that use meson have the same set of options.

[[Category:News]]

UEFI Secure Boot

2023-02-19T14:09:52Z

Lmarz: Add category

== Mounting ESP ==

Prepare mount point for UEFI partition (ESP) at {{path|/boot/efi}}:
{{cmd|install -d -m 000 /boot/efi}}

Add the following line to {{path|/etc/fstab}}:
UUID=<first-partition-uuid> /boot/efi vfat rw,noatime,fmask=0022,dmask=0022,codepage=437,iocharset=ascii,shortname=mixed,utf8,errors=remount-ro 0 2

Mount it:
{{cmd|mount /boot/efi}}

== Generating own UEFI keys ==

Install package {{pkg|efi-mkkeys}}:
{{cmd|apk add efi-mkkeys}}

Before creating new keys and modifying EFI variables, it is advisable to backup the current variables, so that they may be restored in case of error:
{{cmd|mkdir -p /etc/uefi-keys/vendor
cd /etc/uefi-keys/vendor
for i in PK KEK db dbx; do efi-readvar -v $i -o $i.esl; done }}

Generate your self-signed PK, KEK and db key, including .esl and .auth files:
{{cmd|efi-mkkeys -s "Your Name" -o /etc/uefi-keys}}

Now you can uninstall {{pkg|efi-mkkeys}} if you want:
{{cmd|apk del efi-mkkeys}}

== Generating Unified Kernel Image ==

Install package {{pkg|secureboot-hook}} and {{pkg|efibootmgr}}:
{{cmd|apk add secureboot-hook efibootmgr}}

Adjust parameter <code>cmdline</code> in {{path|/etc/kernel-hooks.d/secureboot.conf}}. It should '''not''' contain an <code>initrd=</code> parameter! Example of a valid <code>cmdline</code>:
cmdline="root=UUID=<uuid-of-your-root-fs> modules=ext4"

Run kernel hooks:
{{cmd|apk fix kernel-hooks}}

Disable {{pkg|mkinitfs}} trigger:
{{cmd|echo 'disable_trigger{{=}}yes' >> /etc/mkinitfs/mkinitfs.conf}}

Add boot entry:
{{cmd|efibootmgr --disk <dev> --part 1 --create --label 'Alpine Linux' --load /Alpine/linux-lts.efi --verbose}}

== Enrolling UEFI keys ==

Copy all *.esl, *.auth files from {{path|/etc/uefi-keys}} to a FAT formatted file system (you can use EFI system partition).

Launch firmware setup utility and enrol db, KEK and PK certificates (in this order!). Firmwares have various different interfaces; the following steps for ThinkPad T14s are just an example.

# Reboot system and enter ThinkPad Setup (F1).
# Go to '''Security''' > '''Secure Boot'''
# Change '''Secure Boot''' to '''Enabled'''
# '''Reset to Setup Mode'''
# Go to '''Key Management'''
# '''Authorized Signature Database (DB)'''
#* '''Enroll DB''' > select your Flash Drive > select '''db.auth'''
#* '''Delete DB''' > delete Microsoft certificates (optional)
# '''Key Exchange Key (KEK)'''
#* '''Enroll KEK''' > select your Flash Drive > select '''KEK.auth'''
#* '''Delete KEK''' > delete Microsoft certificates (optional)
# '''Platform Key (PK)''' > '''Enroll PK''' > select your Flash Drive > select '''PK.auth''' (this MUST be the last!)
# Go to top, '''Restart''' > '''Exit Saving Changes'''

== Resources ==

* https://wiki.gentoo.org/wiki/User:Sakaki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot
* https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot

[[Category:Booting]]

Fluxbox

2023-02-19T14:07:12Z

Lmarz: Add description of fluxbox

[http://fluxbox.org Fluxbox] is an easy and fast X11 window manager based on BlackBox.

= Initial setup =
Start by booting Alpine (see [[Installation|these]] instructions on how to do that) 

= Enable Community Repository =
We need the Community Repository available for access to the packages. Instructions are available on the [[Repositories#Enabling_the_community_repository|Repositories]] page.

= Install packages =
Install fluxbox, xterm, and terminus font. 

{{Cmd|# apk add openbox xterm terminus-font}}

xterm is needed so you have a way to access the terminal in X. There are alternatives but this is the classic.
Terminus is needed because without any fonts, you will not be able to see any text in OpenBox.

= Configure xorg-server =
On most systems, xorg should be able to autodetect all devices. However, you can still configure xorg-server manually by launching:
{{Cmd|# setup-xorg-base}}

== acpid ==
If you installed your Alpine Linux as a VirtualBox or VMWare guest, you might find it handy to be able execute an ACPI shutdown. 
{{Cmd|# rc-update add acpid}}

= Set fluxbox as the default WM =
{{Cmd|$ echo 'exec startfluxbox' >> ~/.xinitrc}}

= Start your X! =
{{Cmd|$ startx}}

'''Note:''' The default menu (right click on desktop) will have a lot of options that won't work because we didnt install anything else! Luckily XTerm will work if you added the package in the first step, and you can use that to add additional packages.

= Edit fluxbox settings =
You can now edit the flux settings for your user by editing the files located in
{{Cmd|~/.fluxbox/}}

This directory is created after your first run of fluxbox. The Fluxbox configuration details can he studied on the [http://fluxbox.org/help/ Fluxbox Help Page].

The default configuration is minimal and most menu options won't work unless you customize and/or install additional packages. More information is available on the [http://fluxbox.org/help/ Fluxbox Help Page].

[[Category:Desktop]]

Fluxbox

2023-02-19T14:03:56Z

Lmarz: Lmarz moved page Fluxbox Minimal Install to Fluxbox: Matches the other pages in the Desktop Category

= Initial setup =
Start by booting Alpine (see [[Installation|these]] instructions on how to do that) 

= Enable Community Repository =
We need the Community Repository available for access to the packages. Instructions are available on the [[Repositories#Enabling_the_community_repository|Repositories]] page.

= Install packages =
Install fluxbox, xterm, and terminus font. 

{{Cmd|# apk add openbox xterm terminus-font}}

xterm is needed so you have a way to access the terminal in X. There are alternatives but this is the classic.
Terminus is needed because without any fonts, you will not be able to see any text in OpenBox.

= Configure xorg-server =
On most systems, xorg should be able to autodetect all devices. However, you can still configure xorg-server manually by launching:
{{Cmd|# setup-xorg-base}}

== acpid ==
If you installed your Alpine Linux as a VirtualBox or VMWare guest, you might find it handy to be able execute an ACPI shutdown. 
{{Cmd|# rc-update add acpid}}

= Set fluxbox as the default WM =
{{Cmd|$ echo 'exec startfluxbox' >> ~/.xinitrc}}

= Start your X! =
{{Cmd|$ startx}}

'''Note:''' The default menu (right click on desktop) will have a lot of options that won't work because we didnt install anything else! Luckily XTerm will work if you added the package in the first step, and you can use that to add additional packages.

= Edit fluxbox settings =
You can now edit the flux settings for your user by editing the files located in
{{Cmd|~/.fluxbox/}}

This directory is created after your first run of fluxbox. The Fluxbox configuration details can he studied on the [http://fluxbox.org/help/ Fluxbox Help Page].

The default configuration is minimal and most menu options won't work unless you customize and/or install additional packages. More information is available on the [http://fluxbox.org/help/ Fluxbox Help Page].

[[Category:Desktop]]

Proton VPN

2023-02-19T10:39:25Z

Lmarz: Add Category

Proton VPN is an open-source VPN service by the non-profit Swiss company Proton AG. It utilizes the OpenVPN protocol. Because Alpine Linux does not currently have a release for Proton VPN, using it requires connecting via either OpenVPN or Wireguard. Using Wireguard is recommended due to Proton AG's own stated preference for the service as well as Wireguard's lighter and more modern build. Setting up for Wireguard is relatively simpler because NetworkManager has native support for it, requiring fewer installations and setups.

 

== Installation ==

{{Cmd|# apk add {{Pkg|wireguard-tools}}}}

 

== Configuring ==

Login to Proton VPN and download the Wireguard config file. More information on this can be found at [https://protonvpn.com/support/wireguard-configurations/ Proton VPN's support page]. Note that the private key will only be available from the site if you download immediately after making the config file, after which the private key is replaced with asterisks. Rename the file "wg0.conf" and move it somewhere safe in your file system.

 

== Running ==

To connect, run the following command. Substitute path_to_file with the full path to wherever you moved the config file.

{{Cmd|# wg-quick up /path_to_file/wg0.conf}}

 

To enable Wireguard connecting to Proton VPN on boot, open your /etc/network/interfaces using a text editor like nano. Add this information after your auto wlan0 section:

<pre>
auto wg0
iface wg0 inet static
pre-up wg-quick up /path_to_file/wg0.conf
</pre>

 

Again, substitute path_to_file with your own relevant information.

[[Category:VPN]]

Fluxbox

2023-02-19T10:33:57Z

Lmarz: Lmarz moved page Alpine Fluxbox Minimal Install to Fluxbox Minimal Install

AppStream

2023-02-19T10:32:35Z

Lmarz: Add link to AppStream, add expand template and categorize

{{Expand}}

AppStream is a collaborative effort between Linux distributions to produce shared metadata for the creation of appstores.

Alpine's appstream data can be found at https://appstream.alpinelinux.org/. It's generated by {{Pkg|appstream-generator}}

For more details about AppStream, see https://www.freedesktop.org/software/appstream/docs/

[[Category:Software]]

AppArmor

2023-02-19T10:19:17Z

Lmarz: Add to Security category

AppArmor is a kernel security module that restricts individual programs' capabilities. This can allow administrators to prevent programs accessing system resources in malicious ways according to per-applications specifications. AppArmor works by following profiles, which dictate what each application is and is not allowed to do.

 

== Installation ==

{{Cmd|# apk add {{Pkg|apparmor}}}}

 

You should also install apparmor-utils if you want to use the aa command to interact with AppArmor.

{{Cmd|# apk add {{Pkg|apparmor-utils}}}}

 

==Setup==

Run the command {{Cmd|# cat /sys/kernel/security/lsm}} to see what linux security modules are currently setup.

 

Use a text editor like nano to edit <pre>/boot/extlinux.conf</pre> such that the APPEND line ends with the following:

<pre>
lsm=landlock,yama,apparmor
</pre>

Note that because you're including lsm in this .conf file you are overriding the default lsm. Thus, you should include any lsm that you saw previously running in the above cat command. Additionally, lsm initializes these modules in order, so their position is important in regards to major/minor modules. Ensure that apparmor is placed first among major modules. Note for convenience that yama, capability, and landlock, which come with Alpine Linux, are not major modules, and apparmor can be placed after them. The module called capability is automatically included and does not need to be written in.

 

Next, start AppArmor and tell openrc to start it on boot.

{{Cmd|# rc-service apparmor start}}
{{Cmd|# rc-update add apparmor boot}}

 

You can check if AppArmor is running with the command aa-enabled

{{Cmd|# aa-enabled}}

 

==Configuration==

AppArmor works using rules established in profiles. A set of pre-made profiles is available for ease of use:

{{Cmd|# apk add {{Pkg|apparmor-profiles}}}}

Reboot.

 

==Use==

View AppArmor's report with the command aa-status

{{Cmd|# aa-status}}

This details how many and what profiles are in use as well as relevant findings, such as how many profiles are in complain mode or in kill mode.

==Troubleshoot==

If you notice a bunch of AppArmor errors on boot, try running aa-status and aa-enabled in the terminal. If the output mentions AppArmor being disabled at boot, re-open your /boot/extlinux.conf file and make sure the APPEND line still ends with lsm=landlock,yama,apparmor

[[Category:Security]]

Fluxbox

2023-02-19T10:12:06Z

Lmarz: Add to Desktop Category