Release Notes for Alpine 3.13.0: Difference between revisions

From Alpine Linux
No edit summary
(use https)
 
(27 intermediate revisions by 5 users not shown)
Line 1: Line 1:
== aports ==
== aports ==


=== musl upgraded to 1.2 ===
=== musl 1.2 ===


musl has been upgraded to 1.2. This release changes the definition of <code>time_t</code> on 32-bit systems. See the [https://musl.libc.org/time64.html musl time64 release notes] for more details. All x86, armv7 and armhf packages have been rebuilt for this change. For users of these architectures, '''all''' self-compiled packages must be manually rebuilt after upgrading, even if relocation/SONAME errors are not encountered.
musl has been upgraded to 1.2. This release changes the definition of <code>time_t</code> on 32-bit systems. See the [https://musl.libc.org/time64.html musl time64 release notes] for more details.


In order to support dates past 2038, musl 1.2 uses new time64-compatible system calls. Due to [https://github.com/opencontainers/runc/issues/2151 a long-standing Docker issue], these system calls incorrectly return EPERM when running under a Docker version predating their release. Therefore, when running under Docker, Alpine Linux 3.13.0 requires the host Docker version to be at least 20.10.0. This issue particularly affects 32-bit ARM systems due to an unrelated kernel bug, but can manifest as strange errors on all architectures. If you encounter any unusual errors, such as "error getting time" when running apk, or if the date command returns a nonsensical date, then the host Docker must be updated to at least 20.10.0, which contains [https://github.com/moby/moby/commit/89fabf0f241292e929fbb2fbb794d58d8d697ab5 moby commit 89fabf0]. As a temporary workaround, [an up-to-date https://raw.githubusercontent.com/moby/moby/master/profiles/seccomp/default.json seccomp profile] can be manually downloaded and applied by passing <code>--seccomp-profile=</path/to/profile.json></code> to the host <code>dockerd</code>.
==== time64 requirements ====
 
The following important information applies for users of x86, armv7, and armhf (currently supported 32-bit architectures), including 32-bit Docker containers on 64-bit hosts.
 
All self-compiled packages must be manually rebuilt after upgrading, even if relocation/SONAME errors are not encountered.
 
musl 1.2 uses new time64-compatible system calls. Due to [https://github.com/opencontainers/runc/issues/2151 runc issue 2151], these system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker or libseccomp version predating their release. Therefore, Alpine Linux 3.13.0 requires one of the following:
 
# runc v1.0.0-rc93
## if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
## if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
# Docker 19.03.9 (which contains backported [https://github.com/moby/moby/commit/89fabf0f241292e929fbb2fbb794d58d8d697ab5 moby commit 89fabf0]) or greater, AND libseccomp 2.4.2 (which contains backported [https://github.com/seccomp/libseccomp/commit/bf747eb21e428c2b3ead6ebcca27951b681963a0 libseccomp commit bf747eb]) or greater. In this case, to check if your host libseccomp is time64-compatible, invoke <code>scmp_sys_resolver -a x86 clock_gettime64</code> for x86 containers, or <code>scmp_sys_resolver -a arm clock_gettime64</code> for armhf or armv7 containers. If 403 is returned, time64 is supported. If -1 is returned, time64 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 19.03.9, regardless of the result of this command.
 
In order to run under old Docker or libseccomp versions, [https://github.com/moby/moby/blob/master/profiles/seccomp/default.json the moby default seccomp profile] should be downloaded and on line 2, <code>defaultAction</code> changed to <code>SCMP_ACT_TRACE</code>, then <code>--seccomp-profile=default.json</code> can be passed to dockerd, or <code>--security-opt=seccomp=default.json</code> passed to <code>docker create</code> or <code>docker run</code>. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to 32-bit time system calls. In this case, the container will not be compatible with dates past 2038.
 
Alternatively, <code>--security-opt=seccomp=unconfined</code> can be passed with no <code>default.json</code> required, but note that this will reduce the security of the host against malicious code in the container.


=== Deprecation of Berkeley DB (BDB) ===
=== Deprecation of Berkeley DB (BDB) ===
Line 11: Line 26:
Oracle has changed the license of BDB to AGPL-3.0, making it unsuitable to link to packages with GPL-incompatible licenses. Since the old version is no longer maintained, the <code>db</code> package is now deprecated. Alpine Linux packages are being transitioned to alternatives or, where no alternatives exist, removed entirely.
Oracle has changed the license of BDB to AGPL-3.0, making it unsuitable to link to packages with GPL-incompatible licenses. Since the old version is no longer maintained, the <code>db</code> package is now deprecated. Alpine Linux packages are being transitioned to alternatives or, where no alternatives exist, removed entirely.


For postfix, support for <code>hash</code> and <code>btree</code> databases has been removed. <code>lmdb</code> is the recommended replacement. Before upgrading, all tables in <code>/etc/postfix/main.cf</code> using <code>hash</code> and <code>btree</code> must be changed to a supported alternative. See the [http://www.postfix.org/DATABASE_README.html Postfix lookup table documentation] for more information.
Support for Postfix <code>hash</code> and <code>btree</code> databases has been removed. <code>lmdb</code> is the recommended replacement. Before upgrading, all tables in <code>/etc/postfix/main.cf</code> using <code>hash</code> and <code>btree</code> must be changed to a supported alternative. See the [https://www.postfix.org/DATABASE_README.html Postfix lookup table documentation] for more information.
 
cyrus sasldb now uses <code>gdbm</code> instead of <code>db</code>. The database must be created from scratch or manually migrated after upgrading to Alpine Linux 3.13.


=== Switching from busybox ifupdown to ifupdown-ng ===
=== Switching from busybox ifupdown to ifupdown-ng ===


The default ifupdown implementation has been switched from busybox to [https://github.com/ifupdown-ng/ifupdown-ng/ ifupdown-ng]. This version is intended to be compatible with debian ifupdown and busybox ifupdown, but all users of <code>/etc/network/interfaces</code> should read the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/README.md ifupdown-ng readme] and the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/doc/ADMIN-GUIDE.md ifupdown-ng admin guide] before upgrading.
The default ifupdown implementation has been switched from busybox to [https://github.com/ifupdown-ng/ifupdown-ng/ ifupdown-ng]. ifupdown-ng is intended to be compatible with debian ifupdown and busybox ifupdown, but all users of <code>/etc/network/interfaces</code> should read the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/README.md ifupdown-ng readme] and the [https://github.com/ifupdown-ng/ifupdown-ng/blob/master/doc/ADMIN-GUIDE.md ifupdown-ng admin guide] before upgrading.


ifupdown-ng has native vlan support, so the <code>vlan</code> package is no longer required and can be uninstalled. The <code>bridge</code> and <code>bond</code> packages are still required.
ifupdown-ng has native vlan support, so the <code>vlan</code> package is no longer required and can be uninstalled. The <code>bridge</code> and <code>bond</code> packages are still required.
Line 21: Line 38:
=== GCC 10 ===
=== GCC 10 ===


GCC has been updated to version 10. GCC 10 sets the <code>-fno-common</code> option by default. All Alpine Linux packages have been fixed, but users compiling other software on Alpine Linux may need to make changes to their code. For more information, see the [https://gcc.gnu.org/gcc-10/porting_to.html GCC 10 porting guide].
GCC has been upgraded to version 10. GCC 10 sets the <code>-fno-common</code> option by default. All Alpine Linux packages have been fixed, but users compiling other software on Alpine Linux may need to make changes to their code. For more information, see the [https://gcc.gnu.org/gcc-10/porting_to.html GCC 10 porting guide].


=== PHP 8.0 ===
=== PHP 8.0 ===
Line 31: Line 48:
xorg-server and related packages have been moved from main to community. To install it, ensure {{Path|/etc/apk/repositories}} contains the community repository.
xorg-server and related packages have been moved from main to community. To install it, ensure {{Path|/etc/apk/repositories}} contains the community repository.


Running <code>setup-xorg-base</code> will automatically enable the community repo and install xorg-server.
Running <code>setup-xorg-base</code> will automatically enable the community repo before installing xorg-server.
 
=== nextcloud 20 ===
 
Nextcloud has been updated to version 20. As a direct upgrade from 18 to 20 is [https://docs.nextcloud.com/server/latest/admin_manual/maintenance/upgrade.html not supported by nextcloud], Nextcloud 19 must be temporarily installed.
 
# Take a note and remove all nextcloud-* aports
# Install corresponding the nextcloud19-* aports
# Run <code>occ upgrade</code> as any regular update
# Verify everything still works
# Remove the nextcloud19-* aports again
# Install the regular nextcloud-* aports again
# Run Steps 3 and 4 again
# The upgrade should now be finished
 
As the last step you should visit your administrator settings overview page and run any missing db-updates as shown (e.g. <code>db:add-missing-indices db:add-missing-primary-keys db:add-missing-columns db:convert-filecache-bigint</code>)
 
=== spamassassin ===
<code>/etc/conf.d/spamd</code> has been moved from the <code>spamassassin</code> to the <code>spamassassin-openrc</code> package.
 
=== WireGuard upstreamed ===
 
WireGuard is now included in the standard Linux kernel since version 5.6, so the <code>wireguard-lts</code> and <code>wireguard-virt</code> packages have been removed.
 
=== QEMU packages split ===
 
Several features previously in the standard qemu package have been split into subpackages, including qemu-audio-*, qemu-block-*, qemu-hw-display-*, and qemu-ui-*.
The metapackage qemu-modules installs all of these.


== busybox ==
== busybox ==
Line 62: Line 106:


apk-tools now has an official man-page: <code>apk-tools-docs</code>. If the <code>docs</code> package is installed, man pages will automatically be installed and updated for all installed packages.
apk-tools now has an official man-page: <code>apk-tools-docs</code>. If the <code>docs</code> package is installed, man pages will automatically be installed and updated for all installed packages.
== Known issues ==
=== LVM boot scanning ===
Some users are reporting a regression in Alpine Linux 3.13 where nlplug-findfs fails to detect LVM PVs at boot. The current workaround is to temporarily downgrade to Linux 5.4 from Alpine Linux 3.12. This issue is being tracked in [https://gitlab.alpinelinux.org/alpine/aports/-/issues/12325 aports issue 12325].
[[Category:News]]

Latest revision as of 21:54, 25 August 2023

aports

musl 1.2

musl has been upgraded to 1.2. This release changes the definition of time_t on 32-bit systems. See the musl time64 release notes for more details.

time64 requirements

The following important information applies for users of x86, armv7, and armhf (currently supported 32-bit architectures), including 32-bit Docker containers on 64-bit hosts.

All self-compiled packages must be manually rebuilt after upgrading, even if relocation/SONAME errors are not encountered.

musl 1.2 uses new time64-compatible system calls. Due to runc issue 2151, these system calls incorrectly returned EPERM instead of ENOSYS when invoked under a Docker or libseccomp version predating their release. Therefore, Alpine Linux 3.13.0 requires one of the following:

  1. runc v1.0.0-rc93
    1. if using Docker's Debian repositories, this is part of containerd.io 1.4.3-2
    2. if using Docker Desktop for Windows or Mac, this is part of Docker Desktop 3.3.0
  2. Docker 19.03.9 (which contains backported moby commit 89fabf0) or greater, AND libseccomp 2.4.2 (which contains backported libseccomp commit bf747eb) or greater. In this case, to check if your host libseccomp is time64-compatible, invoke scmp_sys_resolver -a x86 clock_gettime64 for x86 containers, or scmp_sys_resolver -a arm clock_gettime64 for armhf or armv7 containers. If 403 is returned, time64 is supported. If -1 is returned, time64 is not supported. Note that if runc is older than v1.0.0-rc93, Docker must still be at least version 19.03.9, regardless of the result of this command.

In order to run under old Docker or libseccomp versions, the moby default seccomp profile should be downloaded and on line 2, defaultAction changed to SCMP_ACT_TRACE, then --seccomp-profile=default.json can be passed to dockerd, or --security-opt=seccomp=default.json passed to docker create or docker run. This will cause the system calls to return ENOSYS instead of EPERM, allowing the container to fall back to 32-bit time system calls. In this case, the container will not be compatible with dates past 2038.

Alternatively, --security-opt=seccomp=unconfined can be passed with no default.json required, but note that this will reduce the security of the host against malicious code in the container.

Deprecation of Berkeley DB (BDB)

Oracle has changed the license of BDB to AGPL-3.0, making it unsuitable to link to packages with GPL-incompatible licenses. Since the old version is no longer maintained, the db package is now deprecated. Alpine Linux packages are being transitioned to alternatives or, where no alternatives exist, removed entirely.

Support for Postfix hash and btree databases has been removed. lmdb is the recommended replacement. Before upgrading, all tables in /etc/postfix/main.cf using hash and btree must be changed to a supported alternative. See the Postfix lookup table documentation for more information.

cyrus sasldb now uses gdbm instead of db. The database must be created from scratch or manually migrated after upgrading to Alpine Linux 3.13.

Switching from busybox ifupdown to ifupdown-ng

The default ifupdown implementation has been switched from busybox to ifupdown-ng. ifupdown-ng is intended to be compatible with debian ifupdown and busybox ifupdown, but all users of /etc/network/interfaces should read the ifupdown-ng readme and the ifupdown-ng admin guide before upgrading.

ifupdown-ng has native vlan support, so the vlan package is no longer required and can be uninstalled. The bridge and bond packages are still required.

GCC 10

GCC has been upgraded to version 10. GCC 10 sets the -fno-common option by default. All Alpine Linux packages have been fixed, but users compiling other software on Alpine Linux may need to make changes to their code. For more information, see the GCC 10 porting guide.

PHP 8.0

PHP 8.0 with a common set of extensions is now available as php8. PHP 7.4 (php7) remains the default.

xorg-server has moved to community

xorg-server and related packages have been moved from main to community. To install it, ensure /etc/apk/repositories contains the community repository.

Running setup-xorg-base will automatically enable the community repo before installing xorg-server.

nextcloud 20

Nextcloud has been updated to version 20. As a direct upgrade from 18 to 20 is not supported by nextcloud, Nextcloud 19 must be temporarily installed.

  1. Take a note and remove all nextcloud-* aports
  2. Install corresponding the nextcloud19-* aports
  3. Run occ upgrade as any regular update
  4. Verify everything still works
  5. Remove the nextcloud19-* aports again
  6. Install the regular nextcloud-* aports again
  7. Run Steps 3 and 4 again
  8. The upgrade should now be finished

As the last step you should visit your administrator settings overview page and run any missing db-updates as shown (e.g. db:add-missing-indices db:add-missing-primary-keys db:add-missing-columns db:convert-filecache-bigint)

spamassassin

/etc/conf.d/spamd has been moved from the spamassassin to the spamassassin-openrc package.

WireGuard upstreamed

WireGuard is now included in the standard Linux kernel since version 5.6, so the wireguard-lts and wireguard-virt packages have been removed.

QEMU packages split

Several features previously in the standard qemu package have been split into subpackages, including qemu-audio-*, qemu-block-*, qemu-hw-display-*, and qemu-ui-*. The metapackage qemu-modules installs all of these.

busybox

Removed applets

The following applets have been removed:

  • hdparm: Missing many features. Use hdparm instead.
  • fdformat: Rarely used. Use util-linux instead.
  • readprofile: Rarely used. Consider perf or use util-linux instead.
  • lspci: Missing many features, such as hwdb support. Use pciutils or grep . /sys/bus/pci/devices/*/* instead.
  • conspy: Rarely used.
  • smemcap: Rarely used.
  • dumpleases: Rarely used.

Alternatives for conspy, smemcap, and dumpleases are not currently packaged due to a lack of interest. If you require these programs, please file an issue at Alpine GitLab.

Changes

The following applets now support long options:

  • gzip
  • install
  • ipcalc

apk-tools

Man page

apk-tools now has an official man-page: apk-tools-docs. If the docs package is installed, man pages will automatically be installed and updated for all installed packages.

Known issues

LVM boot scanning

Some users are reporting a regression in Alpine Linux 3.13 where nlplug-findfs fails to detect LVM PVs at boot. The current workaround is to temporarily downgrade to Linux 5.4 from Alpine Linux 3.12. This issue is being tracked in aports issue 12325.

Retrieved from "https://wiki.alpinelinux.org/w/index.php?title=Release_Notes_for_Alpine_3.13.0&oldid=24712"