Armbian has announced the release of version 24.2, codenamed Kereru, introducing numerous improvements to enhance the user experience. Here are the key highlights of this release:

• Resolved DNS resolution issues on Debian Bookworm
• Optimized HDMI console performance on Khadas VIM1S and VIM4 devices
• Streamlined Rockchip patch maintenance for improved stability
• Expanded hardware compatibility with Xiaomi Mi10, OrangePi Zero 3, and ASUS Tinker Edge R
• Implementation of the latest Amlogic kernel 5.15.y drop for Khadas VIM1S & VIM4 users
• Introduced feature for displaying download links
• Integrated Odroid M1 into the rockchip64 family
• Added support for Ubuntu 24.04 Noble
• Upgraded all current kernels to 6.6 LTS
• Included Home Assistant extensions and security measures like LVM support and CRYPTROOT
• Implemented cloud-init support and added support for Radxa Rock S0
• Fixed network interface card failures on OrangePi One+
• Resolved WiFi and Bluetooth issues on RockPi S devices caused by Edge Kernel
• Addressed package removal and systemd unit enablement errors
• Fixed desktop compatibility issues with Cinnamon desktop on Vim4
• Optimized image loading times on Khadas VIM1S/VIM4 Bookworm

For a full list of actions, visit here.

In the latest monthly update for openSUSE Tumbleweed in January 2024, the distribution unveils a new format to better communicate major changes, improvements, and key issues. This update is now recommended by contributors involved in openSUSE’s marketing efforts.

Kernel and Hardware Support

The Linux Kernel receives updates to versions 6.6.7, 6.6.9, 6.6.10, 6.6.11, and 6.7.1, addressing memory management and security vulnerabilities. Notable enhancements include PCI updates for Zhaoxin Root Ports, contributing to improved compatibility and performance for Zhaoxin’s CPUs and motherboards.

Browser and Graphics Updates

Mozilla Firefox is updated to version 121.0 and 121.0.1, resolving issues such as hanging when loading sites with column-based layouts. The KDE Frameworks update to version 5.114.0 brings significant improvements, including fixes in Extra CMake Modules, holiday additions for Kenya, and adjustments for AVIF in KImageFormats.

The Mesa update to version 23.3.3 introduces a new Vulkan driver for NVIDIA hardware (NVK) in the experimental phase. This marks a step forward in support for NVIDIA GPUs, accompanied by enhancements in graphics performance and compatibility for Asahi and RADV.

System Management and PHP Enhancements

Systemd sees updates to version 254.8, focusing on the cautious resolution of reported bugs and ensuring stability in device management systems. PHP is updated from version 8.2.14 to 8.2.15, bringing fixes for SSA integrity verification, improvements in CLI built-in web server timeouts, and resolving issues with stream wrapper registration.

Multimedia and Networking

GStreamer is updated to version 1.22.8, addressing vulnerabilities in the AV1 video codec parser and making improvements in reverse playback and seeking in qtdemux. Samba sees updates to version 4.19.4, resolving issues related to the machine account password, improving documentation generation, and addressing critical vulnerabilities and bugs.

Security and Bug Fixes

The update includes critical security patches across various packages, with notable improvements in Firefox, systemd, Samba, and PHP. Multiple Common Vulnerabilities and Exposures (CVEs) are addressed in packages like xorg-x11-server, xwayland, gnutls, java-11-openjdk, and samba, enhancing overall security and stability.

Armbian, a popular Linux distribution for single-board computers (SBCs), has recently released a comprehensive update to enhance the user experience. The latest updates include improvements to the Armbian Build Framework, kernel upgrades, merging of Rockchip kernel families, and device-specific updates.

The Armbian Build Framework now includes official Github Action scripts, making it easier for users to re-compile images for their hardware. These scripts allow users to choose different configurations with or without customization. The framework can be accessed through the GitHub Marketplace.

Kernel upgrades have been completed for the current kernel selection, with the default upcoming kernel on most platforms now based on the most recent LTS kernel base 6.6.y. Additionally, EDGE kernels are already distributed with the latest 6.7.y.

Efforts are also underway to merge disassociated Rockchip kernel families, which will streamline maintenance and provide a more cohesive user experience.

In terms of device-specific updates, LicheePi 4A now has current kernel support, although it is still a work in progress (WIP). The old 32-bit Marvell kernel has also been successfully updated, ensuring that the popular NAS, Helios4, will continue to receive updates and maintainer support.

Several bug fixes and improvements have been made, including fixing a significant bug that affected network speed on RockPi S, applying numerous patches to address issues with display, wireless, Bluetooth, and DVFS on H616/H618 Zero2 and Zero3 series, and changing the default CPU governor to schedutil to optimize performance and responsiveness.

NetBSD 10.0, a significant update for the BSD operating system in development since 2019, reaches a milestone with the availability of its second release candidate, NetBSD 10.0-RC2, for testing.

This follows the earlier release of NetBSD 10-RC1 in November. Noteworthy features of NetBSD 10 include WireGuard support, enhancements for Arm hardware (including Apple Silicon and Raspberry Pi), a new Intel Ethernet driver, Realtek 2.5 GbE network adapter support, multi-core performance enhancements, automatic swap encryption, and various hardware support improvements. The release also incorporates numerous performance optimizations. Detailed information about the features is available on the NetBSD 10.0 release page.

Testing enthusiasts can find NetBSD 10.0-RC2 images on iso.netbsd.org, with hopes for a prompt stable release in the near future.

Source: Phoronix.

openSUSE Tumbleweed and MicroOS have made some significant changes to their boot loader and full disk encryption (FDE) capabilities. The new image now uses systemd-boot as the boot loader and implements full disk encryption based on systemd. This update aims to improve the security of the distribution while simplifying the design.

systemd-boot

The previous boot loader used by openSUSE, GRUB2, is feature-rich but complex and slow to develop. The openSUSE package for GRUB2 contains over 200 patches, some of which have been present for many years. While GRUB2 supports various systems and file systems, the introduction of UEFI made many of its features redundant, as the system firmware already provided similar functionalities.

As a result, more straightforward boot loaders focused on UEFI, such as gummiboot, emerged. Eventually, this code was integrated into systemd and renamed systemd-boot. Compared to GRUB2, systemd-boot is much simpler and serves as a small EFI binary that presents a menu with different boot loader entries and delegates the execution to the selected kernel.

systemd-boot can also work with unified kernel images (UKI) that aggregate the kernel, command line, and initrd into a single unit. openSUSE plans to support UKIs in the future.

openSUSE has been planning to provide systemd-boot as an alternative to GRUB2 for some time, and in August 2023, Tumbleweed started supporting systemd-boot. The yast-bootloader tool also gained support for systemd-boot for new installations.

While supporting another boot loader comes with challenges, such as decreased support for different architectures and compatibility issues with btrfs file systems, openSUSE is actively working on addressing these problems.

Full Disk Encryption

openSUSE has also introduced support for full disk encryption based on systemd. While GRUB2 already supported unlocking LUKS volumes, systemd offers some additional features, such as partial support for LUKS2 encryption and integration with TPM2 devices.

The TPM2 (Trusted Platform Module 2) is a cryptographic device that can unlock secrets only when certain conditions related to the system’s state are met. The TPM2 will unlock the secret if the system is in a known good state, ensuring that the firmware, boot loader, kernel, and initrd have not been tampered with.

To take advantage of TPM2 for FDE, openSUSE has developed a policy that instructs the TPM2 to decrypt a secret only if certain platform configuration registers (PCR) contain the expected values. The PCR values are measured during the boot process, and any changes to the system will result in different PCR values, preventing the secret from being decrypted.

openSUSE has also improved the prediction of PCR values using the pcr-oracle tool, which can encrypt a key under a set of PCR values that can change. This allows for flexible unlocking mechanisms and better system integrity checks.

Using systemd for Disk Encryption

While GRUB2 is still functional for FDE, the use of systemd-boot provides an alternative architecture that works with any boot loader that follows the Boot Loader Specification (BLS). With systemd-boot, the kernel and initrd are placed in the unencrypted EFI system partition (ESP), and the unlock of the sysroot (where the system is located) is done from inside the initrd using systemd-cryptsetup options.

To support this new architecture, openSUSE provides a MicroOS image named kvm-and-xen-sdboot that showcases the new FDE capabilities. This image includes systemd-boot, sdbootutil scripts for synchronizing boot entries, pcr-oracle for predicting PCR values, disk-encryption-tool for encrypting the sysroot device, and dracut-pcr-signature, a dracut module that loads predictions into the initrd from the ESP.

The tools work together to ensure a secure and seamless boot process. The VM with a virtual TPM2 device measures the executed code and data, extending the PCR values. systemd-boot then reads the correct boot entry, and the disk-encryption-tool script encrypts the sysroot device. Finally, the jeos-firstboot modules handle the enrollment of FIDO2 keys and provide recovery key information.

Future Improvements

While the current implementation is a sound proof of concept, there are several areas for improvement. The disk-encryption-tool should be integrated into the installer, and the jeos-firstboot modules should also live in the installer or be merged with the functionality provided by the encryption tool. Separating system keys from user keys and enabling the use of TPM2 and FIDO2 keys simultaneously are also potential improvements.

Additionally, openSUSE aims to work with upstream projects, such as systemd and GRUB2, to incorporate the current tools and features. The diagnosis of TPM2 rejection for unlocking the LUKS2 key could be improved, and the integration of multiple encrypted disks should be validated and enhanced.

Ultimately, openSUSE is considering the use of unified kernel images and further standardization to simplify the architecture. The generation and registration of new keys, as well as the selection of PCR values, may be automated or better documented to streamline the process.

The openSUSE community has announced a logo competition for a new openSUSE logo, as well as four openSUSE distributions: Tumbleweed, Leap, Slowroll, and Kalpa. The aim of the competition is to strengthen the visual identity of the openSUSE brand and create a cohesive brand identity for its distributions.

The new logo designs should visualize a unified brand and integrate well with newer project logos like Aeon, MicroOS, and Leap Micro. The logos for the openSUSE distributions are designed with simple shapes and lines, typically as empty outlines. The logos use a 16u square canvas with a 1u stroke width.

The competition is open to the openSUSE community and the deadline for submissions is November 22. The winners will receive a “Geeko Mystery Box” as a reward for their creative designs.

The rules of the contest state that the logo should be licensed under CC-BY-SA 4.0 and allow everyone to use it without attribution if it is used as the logo for the openSUSE Project. The design must be original and not include any third party materials. Both monochrome and color formats are required for submission, and the design should reflect the openSUSE communities.

To submit a design, participants must email their vector file in SVG format to ddemaio@opensuse.org, along with a PNG of the design posted on the openSUSE website. The file size should be less than 512 KB. Participants should also include their name, mail address, and a description of the design’s philosophy.

The submitted designs will be added to a survey where the community can vote on them. The final decision will be made at an openSUSE Community meeting.