Alpine Linux:Ideas: Difference between revisions

Latest revision as of 02:27, 25 August 2023

Please note that this page is no longer monitored but remains for historical reasons. If you wish to raise ideas or feature requests or bugs please do so at https://gitlab.alpinelinux.org/groups/alpine/-/issues

However, this page could be used for discussion of ideas, or you can use the Alpine-Devel mailing list

Package manager

Ideas for apk-tools.

plugin for curl

A dlopened() download plugin that is linked to curl, which is used for remote repositories. By having it as a plugin we dont need libcurl in the initramfs.

wget (current behaviour) could be used as a fallback.

Booting

Booting from net

Priority: low

Provide ip address and remote hostname as kernel parameter and run directly from network. The only thing needed for this would probably be a special initramfs image.

Not sure how useful it would be, but it would be cool.

Installer

Installer templates

Have some "templates", or presseeds or something similar so you can easily install a lot of alpine boxes.

Installer for headless installs

Installer that would create a bootable iso/usbdrive + a working config. Could be written in wxWidgets so it could be run from either Windows or Linux.

Autorun program/script on CD

Could be nice with an autorun program that will be executed when cd is inserted in a windows computer. It could have a menu with the following options:

create boot floppy for CDROM
create boot floppy for USB
install Alpine on an USB drive

Network installs

This is in-tie with headless installing and (at least for me) it's the big white elephant missing feature: to be able to run a server-based remote install of a system without any manual intervention. It might need an upgrade or the hardware could have been replaced after a failure. Driving there and reinstalling packages is a no-go in some places.

(Look at kickstart + cobbler + koan for RHEL as examples). If such a feature is ever add *please* make it compatible to something existing, i.e. even ubuntu is running with cobbler now).

20:46, 1 January 2012 (UTC)

Infrastructure

Package database

A database with all the packages and their status.

Possibility to rate/vote packages? Some easy way for users to give feedback on what packages they think we should focus on.

Security

Protection against cold boot attacks

This is a subject that pages can be written about and everyone has a different opinion. AFAIK there's no real protection against it if your machine is powered on and unattended. Nonetheless limited protection could be afforded by overwriting RAM with zero's or random data whenever a reboot, halt or poweroff command is issued. Raised under issue #2534

sysctl.conf changes

It seems by default many security features are already enabled, a few not enabled (checked on alpine 2.7.0) that would be a good idea to turn on are:

- magic-sysreq

I've already documented these on the sysctl.conf wiki page. Maybe we could enable these by default in new installs?

@@ Line 1: / Line 1: @@
-'''This is the place to put feature requests and share ideas for Alpine.''' From these we'll update our [[Roadmap]], which in turn populates our [[Todo]] list. Discussions of ideas should probably take place on the Alpine-Devel [[Mailing_lists | mailing list]], but feel free to use the discussion function of the wiki too.
+'''Please note that this page is no longer monitored''' but remains for historical reasons. '''If you wish to raise ideas or feature requests or bugs please do so at https://gitlab.alpinelinux.org/groups/alpine/-/issues '''
-=== User documentation ===
+However, this page could be used for discussion of ideas, or you can use the Alpine-Devel [[Mailing_lists | mailing list]]
-It would be nice with specific howto's. Not only the basics (setting ut a NAT'ing gateway) but some really different, wierd stuff, like setting up encrypted partitions, storing configs on subversion, connect a webcamera to a cgi script, things that you cannot do on the standard SOHO routers.
-=== Signing packages ===
+== Package manager ==
-Make a port of the freebsd pkg_sign, stripping out everything but the x509 part. Using this will allow us to ship a certificate with the distro and make it possible to verify that updates really comes from the same (or authorized) origin.
+Ideas for apk-tools.
+=== plugin for curl ===
+A dlopened() download plugin that is linked to curl, which is used for remote repositories. By having it as a plugin we dont need libcurl in the initramfs.
-It is possible to sign single packages or the INDEX file, or any other file, as long as it is gzipped.
+wget (current behaviour) could be used as a fallback.
+== Booting ==
 === Booting from net ===
+'''Priority:''' low
 Provide ip address and remote hostname as kernel parameter and run directly from network. The only thing needed for this would probably be a special initramfs image.
-=== Local backups of the configs ===
+Not sure how useful it would be, but it would be cool.
-There are lot of ways to do this. We should support a few.
-Things that is really interesting is stoing them on a subversion repository.
-[http://www.gnu.org/software/rcs/rcs.html rcs] might be an alternative.
-=== Webconfig framework ===
-I have no idea how this should be done. But i think we should support and encourage ssl from the very beginning.
-on 16 Aug 2006, Natanael posted to the mailing list:
- Some ideas for the webconf.
-. Log changes.
- Log changes and add a posibility to add user comments. Something like
- blogging. You can add comments.
- Log could look like:
- <id> <when> <who> <what> <where> <comment>
- For example:
- admin changed ip of eth0 from 192.168.0.100 to 192.168.0.1 "Just testing"
- admin added firewall rule <bla bla> "Disallow web traffic thats not proxied"
- admin changd password for root
- ncopa removed static ip from DHCP server "This device is no longer used"
-. User comments on the web pages.
- ncopa <date>
- The static routes are there as a workaroud for ....
- admin <date>
- Note that this is the second DHCP server so don't change the ip range withough checking rtr-02
-Regarding item 1, busybox diff is built into alpine.  The model could run a diff from the previous config file and the current config file; also noting ip addr / timestamp / username for the person making the change.  This has the very interesting possiblity of rollbacks - playing a diff "backwards" (patch -R) could allow for undo/redo within the web framework.
-Item 2 is just another text file for the controller to manage.
-=== Running from read only media ===
-One of the concepts are that the media from where the sytem loads should be readonly. We could have a check in the boot process if media is readonly. If it is not, refuse to start. This is specially good for USB sticks, where a USB stick that is possible to physically write protect would be required.
+== Installer ==
 === Installer templates ===
 Have some "templates", or presseeds or something similar so you can easily install a lot of alpine boxes.
+=== Installer for headless installs ===
+Installer that would create a bootable iso/usbdrive + a working config. Could be written in wxWidgets so it could be run from either Windows or Linux.
 === Autorun program/script on CD ===
@@ Line 66: / Line 32: @@
 * install Alpine on an USB drive
+=== Network installs ===
+This is in-tie with headless installing and (at least for me) it's the big white elephant missing feature:
+to be able to run a server-based remote install of a system without any manual intervention.
+It might need an upgrade or the hardware could have been replaced after a failure. Driving there and reinstalling packages is a no-go in some places.
+(Look at kickstart + cobbler + koan for RHEL as examples). If such a feature is ever add *please* make it compatible to something existing, i.e. even ubuntu is running with cobbler now).
+:46, 1 January 2012 (UTC)
+== Infrastructure ==
 === Package database ===
 A database with all the packages and their status.
@@ Line 71: / Line 47: @@
 Possibility to rate/vote packages? Some easy way for users to give feedback on what packages they think we should focus on.
-=== Version number on floppy ===
+== Security ==
-As Alpine progresses, the data stored no the floppy needs to be converted from version tho the other. It would be nice to be able to see what version of Alpine the data on the floppy belongs to. Then the  conversion script will have to do less magic to upgrade the data.
+=== Protection against cold boot attacks ===
+This is a subject that pages can be written about and everyone has a different opinion.  AFAIK there's no real protection against it if your machine is powered on and unattended.  Nonetheless limited protection could be afforded by overwriting RAM with zero's or random data whenever a reboot, halt or poweroff command is issued.  '''Raised under issue {{issue|2534}}'''
-=== SSL signed floppies ===
-Make it possible to sign/encrypt the data on the floppies. the floppies contain the most valuable data of alpine. It would be nice if setup-alpine would ask if I want to create a new key, or import an existing key and then encrypt or sign the contents of the floppy with it. On a reboot the admin would have to give the password for the system to run. Since mission critical systems have an UPS, this should not really be a problem.
-=== Packages we would like to add or investigate to be added, to alpine ===
+=== sysctl.conf changes ===
+It seems by default many security features are already enabled, a few not enabled (checked on alpine 2.7.0) that would be a good idea to turn on are:
-To be used with Asterisk:
+- magic-sysreq
-* [[http://freshmeat.net/projects/zgsmplay/ zgsmplay]], see also [[http://www.voipplanet.com/backgrounders/article.php/3625916 here]] - This package will give the possibility to listen to the gsm (sound-)files on the server.
-Maybe later:
+I've already documented these on the sysctl.conf [[Sysctl.conf|wiki page]].
-* Cherokee (in unstable Gentoo atm)
+Maybe we could enable these by default in new installs?
-Comment: See [[FAQ]]
-=== Installer for headless installs ===
-Installer that would create a bootable iso/usbdrive + a working config. Could be written in wxWidgets so it could be run from either Windows or Linux.