The release of Nextcloud Hub 8 has been announced, providing a self-contained solution for organizing collaboration among employees and teams working on various projects.

The release of Ubuntu 24.04 "Noble Numbat" has taken place, which is classified as a long-term support (LTS) release, with updates provided over 12 years (5 years of public updates, plus an additional 7 years for users of the Ubuntu Pro service). Installation images have been created for Ubuntu Desktop, Ubuntu Server, Lubuntu, Kubuntu, Ubuntu Mate, Ubuntu Budgie, Ubuntu Studio, Xubuntu, Ubuntu Kylin (the edition for China), Ubuntu Unity, Edubuntu, and Ubuntu Cinnamon.

Key Changes:

• The desktop has been updated to GNOME 46, featuring a global search function, improved performance for the file manager and terminal emulators, experimental support for VRR (Variable Refresh Rate), enhanced output quality with fractional scaling, expanded connectivity options to external services, an updated configurator, and improved notification system. A new rendering engine based on the Vulkan API has been implemented in GTK. The Cheese camera application has been replaced with GNOME Snapshot.
• The Linux kernel has been updated to version 6.8.
• Updated versions include GCC 14-pre, LLVM 18, Python 3.12, OpenJDK 21 (with optional OpenJDK 8, 11, and 17), Rust 1.75, Go 1.22, .NET 8, PHP 8.3.3, Ruby 3.2.3, binutils 2.42, and glibc 2.39.
• User applications have been updated: Firefox 124 (built with Wayland support), LibreOffice 24.2, Thunderbird 115, Ardour 8.4.0, OBS Studio 30.0.2, Audacity 3.4.2, Transmission 4.0, digiKam 8.2.0, Kdenlive 23.08.5, Krita 5.2.2, VLC 3.0.20.
• Subsystems have been updated: Mesa 24.0.3, systemd 255.4, BlueZ 5.72, Cairo 1.18, NetworkManager 1.46, Pipewire 1.0.4, Poppler 24.02, xdg-desktop-portal 1.18.
• Server packages have been updated: Nginx 1.24, Apache httpd 2.4.58, Samba 4.19, Exim 4.97, Clamav 1.0.0, Chrony 4.5, containerd 1.7.12, LXD 5.21.0, Django 4.2.11, Docker 24.0.7, Dovecot 2.3.21, GlusterFS 11.1, HAProxy 2.8.5, Kea DHCP 2.4.1, libvirt 10.0.0, NetSNMP 5.9.4, OpenLDAP 2.6.7, open-vm-tools 12.3.5, PostgreSQL 16.2, Runc 1.1.12, QEMU 8.2.1, SpamAssassin 4.0.0, Squid 6.6, SSSD 2.9.4, Pacemaker 2.1.6, OpenStack 2024.1, Ceph 19.2.0, Openvswitch 3.3.0, Open Virtual Network 24.03.
• The Thunderbird email client is now only available in snap format. The DEB package for Thunderbird contains a placeholder for installing the snap package.
• The ubuntu-desktop-installer has been upgraded and is now part of a larger project called ubuntu-desktop-provision, renamed to ubuntu-desktop-bootstrap. The essence of the new project lies in splitting the installer into stages: tasks performed before installation (disk partitioning and package copying) and during the first system boot (initial system setup). The installer is written in Dart, utilizes the Flutter framework for user interface design, and is implemented as an extension over the low-level curtin installer, which is already used in the Subiquity installer for Ubuntu Server.

  Changes in the new installer include an improved interface design, the addition of a page for specifying the URL for downloading the autoinstall.yaml automated installation script, and the ability to modify default behavior and styling through a configuration file. Support for updating the installer itself has been added—if a new version is available, a prompt for updating the installer will now be issued during the early stages of installation.

  The default installation mode for the Ubuntu Desktop installer is minimal. To install additional programs like LibreOffice and Thunderbird, the extended installation mode must be selected. The installer also includes features added in the previous Ubuntu 23.10 release, such as support for the ZFS file system and the ability to encrypt disks without needing to enter a disk unlock password at boot, thanks to storing decryption key information in the TPM (Trusted Platform Module).

  
• The new Ubuntu App Center application manager has been enhanced, written in Dart using the Flutter framework with adaptive layout methods for proper functioning on screens of any size. The Ubuntu Store implements a combined interface for managing packages in both DEB and Snap formats (if a program is available in both deb and snap packages, snap is selected by default), allowing for searching and navigating the catalog of snapcraft.io packages and connected DEB repositories, enabling the management of application installation, uninstallation, and updates, as well as the installation of individual deb packages from local files. The application includes a rating system, where the five-point scale has been replaced with a like/dislike voting format (+1/-1), which generates a virtual five-star rating.

  The Ubuntu App Center has replaced the old Snap Store interface. Compared to Ubuntu 23.10, a new application category has been added — Games (while GNOME games have been removed from the distribution). A separate interface for updating firmware — Firmware Updater, available for amd64 and arm64 architecture-based systems, allows for firmware updates without launching a full application manager in the background.

  
• Similar to the changes in Arch Linux and Fedora Linux, the sysctl param vm.max_map_count, which defines the maximum number of memory mapping areas available to a process, has been increased by default from 65530 to 1048576. This change has improved compatibility with Windows games run through Wine (for instance, with the old value, games like DayZ, Hogwarts Legacy, Counter Strike 2, Star Citizen, and THE FINALS could not be launched) and resolved some performance issues with memory-intensive applications.
• Access for unprivileged users to user namespace identifiers has been restricted, which will enhance the security of systems utilizing container isolation against vulnerabilities that require manipulation of the user namespace for exploitation. Ubuntu has implemented a hybrid blocking scheme that selectively allows certain programs to create user namespaces if they have an AppArmor profile with the rule 'allow userns create' or the CAP_SYS_ADMIN privilege. For example, profiles have been created for Chrome and Discord, where the user namespace is utilized for process sandboxing.
• When building packages, compiler options are enabled by default to complicate the exploitation of vulnerabilities. In gcc and dpkg, the mode "-D_FORTIFY_SOURCE=3" is enabled by default, identifying possible buffer overflows during string functions defined in the header file string.h. The difference from the previously used mode "_FORTIFY_SOURCE=2" comes down to additional checks. Theoretically, these additional checks may lead to a decrease in performance, but in practice, SPEC2000 and SPEC2017 tests showed no differences, and there have been no user complaints about performance degradation during testing.
• In AppArmor, access to configuration files of GnuTLS and OpenSSL libraries is granted to any applications by default. The previously used selective access led to issues that were difficult to diagnose due to the lack of error output when access to configuration files was denied.
• The pptpd and bcrelay packages have been removed due to potential security issues and the cessation of maintenance for their core codebases. The PAM module pam_lastlog.so has also been removed, as the issue from 2038 has not been resolved.
• In dpkg, the flag "-mbranch-protection=standard" has been added to enable execution protection of instruction sets that should not be branched to on ARM64 systems (ARMv8.5-BTI — Branch Target Indicator). Blocking transitions to arbitrary code segments has been implemented to counter the creation of gadgets in exploits using return-oriented programming techniques (ROP — Return-Oriented Programming).
• For applications using gnutls, support for TLS 1.0, TLS 1.1, and DTLS 1.0 protocols has been forcibly disabled, which were officially deprecated three years ago by the IETF (Internet Engineering Task Force). A similar change has been implemented for OpenSSL in Ubuntu 20.04.
• 1024-bit RSA keys, used in APT for verifying repositories by digital signature, have been declared obsolete and disabled. In Ubuntu 24.04, repositories must be signed with RSA keys of at least 2048 bits or with Ed25519 and Ed448 keys. Since 1024-bit RSA keys are still in use in some PPA repositories, such keys are not yet blocked, but a warning is issued for them. After some time, the warning is planned to be replaced with an error message.
• The priority for the ‘proposed pocket’ repository in the APT package manager has been changed, where new package versions are pre-tested before being placed in the main repositories for the general public. The change aims to reduce the likelihood of automated installation of unstable updates when the ‘proposed pocket’ repository is enabled, which could lead to system malfunction. After enabling ‘proposed pocket’, not all updates will be pulled from it, but users will be able to selectively install updates for necessary packages using the command ‘apt install /-proposed’.
• The default service irqbalance, which distributes the handling of hardware interrupts across different CPU cores, has been discontinued. Currently, in most situations, the built-in mechanisms for distributing handlers provided by the Linux kernel are sufficient. The use of irqbalance may be justified in specific situations, but only with proper configuration by an administrator. Additionally, irqbalance can cause issues in certain configurations, such as when used in virtualization systems, and can interfere with manual adjustments of parameters affecting power consumption and latency.
• The network setup uses the release of the Netplan 1.0 toolkit, which allows configuration settings to be stored in YAML format and provides backends that abstract access to configuration for NetworkManager and systemd-networkd. The new version introduces the ability to simultaneously use WPA2 and WPA3, adds support for Mellanox VF-LAG network devices with SR-IOV (Single-Root I/O Virtualization), and implements the command "netplan status --diff" for a visual assessment of differences between the actual state of settings and configuration files. In Ubuntu Desktop, NetworkManager is enabled as the default backend for configuration.
• The Active Directory Certificate Auto Enrollment (ADSys) mechanism has been enabled, allowing automatic retrieval of certificates from Active Directory services when group policies are enabled. Automatic certificate retrieval through Active Directory is also applied when connecting to corporate wireless networks. VPN.
• The Apport package, used in Ubuntu for automating application crash handling, now includes integration with systemd-coredump for processing crashes. The coredumpctl utility can now be used to analyze core dumps.
• The base installation includes applications for performance analysis, process tracing, and system status monitoring. Specifically, packages such as procps, sysstat, iproute2, numactl, bpfcc-tools, bpftrace, perf-tools-unstable, trace-cmd, nicstat, ethtool, tiptop, and sysprof have been added, which are consolidated into a meta-package called performance-tools.
• Active repository settings have been converted to the deb822 format and moved from /etc/apt/sources.list to the file /etc/apt/sources.list.d/ubuntu.sources.
• Services are now restarted after updates to related libraries, even if the updates are installed automatically in unattended-upgrade mode. To prevent a service from automatically restarting after an update, it should be added to the override_rc section in the file /etc/needrestart/needrestart.conf.
• The Power Profiles Manager has improved, with support for new power management hardware features available in AMD processors added, as well as the ability to use different optimization drivers. When operating in offline mode, automatic optimization level increase is provided.
• The fprintd package and the libfprint library have been updated to support additional fingerprint scanning devices.
• A more refined version of the Ubuntu font has been implemented. The old system font can be restored by installing the fonts-ubuntu-classic package.
• Support for Intel's built-in QAT (Quick Assist Technology) accelerator has been added, providing means to accelerate computations used in compression and encryption. Intel QAT includes packages qatlib 24.02.0, qatengine 1.5.0, qatzip 1.2.0, ipp-crypto 2021.10.0, and intel-ipsec-mb 1.5-1.
• Packages for the 32-bit Armhf architecture have been transitioned to using the 64-bit time_t type. This change affected over a thousand packages. The previously used 32-bit time_t type cannot handle time past January 19, 2038, due to the overflow of the seconds counter since January 1, 1970.
• Updated builds for Raspberry Pi 5 (server and user) and StarFive VisionFive 2 (RISC-V).
• In Ubuntu Cinnamon, the Cinnamon 6.0 desktop environment has been implemented with initial support for Wayland.
• The build of Ubuntu for the WSL (Windows Subsystem for Linux) has added support for passing configuration settings using cloud-init.
• Xubuntu continues to ship with the Xfce 4.18 environment.
• Ubuntu Mate continues to provide the MATE 1.26.2 desktop environment (version 1.28 is already available in the MATE repository, but is not yet officially announced). A new installer, similar to the one proposed in Ubuntu Desktop, has been introduced. Instead of the Firmware Updater application for firmware updates, GNOME Firmware has been utilized, and App Center has been added for managing application installations instead of Software Boutique. The MATE Welcome application has been discontinued.
• Ubuntu Budgie has implemented the Budgie 10.9 desktop environment. Many applets and mini-applications have been updated. A new Budgie Control Center configurator has been proposed. App-Center has been used for application management instead of GNOME Software. Pulseaudio has been replaced with Pipewire. Several default applications have been swapped, for example, GNOME-Calculator → Mate Calc, GNOME System Monitor → Mate System Monitor, Evince → Atril, GNOME Font Viewer → font-manager, Cheese → guvcview, Celluloid → Parole, Rhythmbox → Lollypop + Goodvibes + gpodder. GNOME-Calendar, GNOME System Monitor, and GNOME Screenshot have been removed from the base package.
• Kubuntu continues to ship with KDE Plasma 5.27.11, KDE Frameworks 5.115, and KDE Gear 23.08 by default. KDE 6 will be offered in the upcoming Kubuntu 24.10 release. The logo and color scheme have been updated.
• In Lubuntu, the installer based on the Calamares framework has been improved. A page has been added for setting installation parameters, such as installing available updates, codecs and proprietary drivers, and additional programs. Modes for minimal, full, and normal installations have been introduced. A first boot screen allows users to configure the language and connect to a wireless network, as well as choose between starting the installer or entering Live mode. A Bluetooth Manager and settings editor for the SDDM display manager have been added. The desktop environment has been updated to LXQt 1.4.
• In Ubuntu Studio, the Ubuntu Studio Audio Configuration utility has been added for configuring PipeWire settings. A new installer, similar to that offered in Ubuntu Desktop, has been implemented. A meta-package for installing helpful music education software, such as FMIT, GNOME Metronome, Minuet, MuseScore, Piano Booster, and Solfege, has been included.

Source: opennet.ru