Red Hat has announced the release of Red Hat Enterprise Linux 10. Ready installation images are prepared for registered users of the Red Hat Customer Portal (for functionality evaluation, publicly available ISO images of CentOS Stream 10 and free RHEL developer builds can be used). The release is tailored for x86_64, s390x (IBM System z), ppc64le (POWER9), and Aarch64 (ARM64) architectures.
The foundation of the RHEL 10 branch is based on the package base of the CentOS Stream 10 project, which is positioned as upstream for RHEL, allowing external participants to control the package preparation for RHEL, propose their changes, and influence the decisions made. In line with the 13-year support cycle, RHEL 10 will be supported until 2035, plus 3 years of extended paid support. Updates for RHEL 9 will continue to be released until the end of May 2032, while RHEL 8 will be supported until 2029.
RHEL packages are not hosted in the public repository git.centos.org and are provided to customers only through a secure section of the website, under a user agreement (EULA) that prohibits data redistribution, preventing the use of these packages for creating derived distributions. The source code for RHEL remains available in the CentOS Stream repository, but it is not fully synchronized with RHEL, and package versions may not always match those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source texts of RPM packages for RHEL releases as part of the OpenELA project.
Key Changes:
- The X.org Server and related components have been removed from the distribution. By default, a graphics stack based on the Wayland protocol is employed. The ability to run X11 applications in a Wayland session is ensured by the XWayland DDX server (only the package 'xorg-x11-server-Xwayland' remains).
- The desktop environment has been updated to GNOME 47. An overview mode has been added for viewing open windows in the classic GNOME session, which was previously only available in the standard GNOME session. Qt libraries have been updated to version 6.7. Qt5 packages have been removed from the distribution (only Qt 6 support remains).
- The supply of RPM packages for Firefox, GIMP, LibreOffice, Inkscape, and Thunderbird has been discontinued. For the installation of Firefox and Thunderbird, automatic downloading and installation of packages in Flatpak format is provided using the external repository flatpaks.redhat.io.
- The PulseAudio sound server has been replaced with the PipeWire package.
- The developer package versions have been updated: GCC 14.2, LLVM 19.1.7, Python 3.12, Ruby 3.3, OpenJDK 21, Rust 1.84.1, Go 1.23, Node.js 22, Perl 5.40, PHP 8.3, Git 2.45, Subversion 1.14, SystemTap 5.1, Valgrind 3.23.0.
- The server packages have been updated: OpenSSH 9.9, nginx 1.26, Apache HTTPD 2.4.62, Varnish Cache 7.4, Squid 6.10, MariaDB 10.11, MySQL 8.4, PostgreSQL 16, PCP 6.3.0, Grafana 10.2.6, libreswan 4.15, Pacemaker 2.1.8, 389-ds-base 3.0.4, Podman 5.0.
- The system packages have been updated: Linux kernel 6.12, glibc 2.39, binutils 2.41, NSS 3.101, gnutls 3.8.9, polkit 125, DNF 4.20, and RPM 4.19.
- New packages added: tuned-ppd (replacing power-profiles-daemon), libcpuid, and dnsconfd (a background process for DNS caching). Due to the transition of the Redis DBMS codebase to a proprietary license, the Valkey fork is recommended instead of Redis. The Kea DHCP server is used instead of ISC DHCP. The zlib-ng-compat package is used instead of zlib.
- In the DNF package manager, downloading file lists metadata (filelist) is disabled by default. Such data is rarely used but is large in size and slows down performance. For PGP handling in DNF and RPM, the rpm-sequoia library is utilized.
- Experimental support for the Composefs file system has been added, implemented as an overlay on OverlayFS and EROFS, optimized for efficient shared storage of multiple mounted disk images.
- In the KVM hypervisor, experimental (Technology Preview) support for AMD SEV, SEV-SNP, and SEV-ES technologies is provided.
- For new users created through the Anaconda installer interface, administrator privileges are provided by default (there's a specific setting available to disable this behavior). The installer also features a new interface for selecting the time zone. The RDP protocol is used for remote access to the installer instead of VNC.
- Support has been added for quantum-resistant encryption algorithms. These algorithms are available in OpenSSL, OpenSSH, and in system cryptographic policies (crypto-policies). OpenSSL now allows the creation of files with certificates and keys in PKCS #12 format that meet FIPS requirements. The openssl-pkcs11 engine has been replaced by pkcs11-provider, which enables the use of hardware keys in apache httpd, libssh, bind, and other applications that utilize OpenSSL. Access permissions for SSH host keys have changed from 0640 to 0600 (accessible only to the owner). In GnuTLS, support for certificate compression using zlib, brotli, and zstd methods has been added.
- In addition to GnuPG, the Sequoia command-line toolkit (utilities sq and sqv) with an implementation of the OpenPGP standard (RFC-4880) in Rust has been included.
- By default, the predictable name selection mode for network interfaces is enabled (net.ifnames=1). In NetworkManager, a mechanism to detect duplicates for IPv4 has been activated. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. DAD (Duplicate Address Detection) has been introduced to prevent the assignment of the same IP on different systems in the local network.
- In disk images (for example, in system images for AWS and KVM), the use of a separate /boot partition has been discontinued.
- The user-space SELinux toolkit (libsepol, libselinux, libsemanage, policycoreutils, checkpolicy, mcstrans) has been updated to version 3.8, which implements the 'audit2allow -C' option for output in CIL (Common Intermediate Language) format. Support for the Wayland protocol has been added to the sandbox utility.
- The Keylime component now supports device identification via IDevID (Initial Device Identity) and IAK (Initial Attestation Key), with TLS 1.3 protocol enabled by default.
- A new file manager (cockpit-files package) has been proposed in the web console, allowing management of files and directories.
- In server By default, CUPS printing has disabled operation in mDNS and broadcast modes, which were involved in recently discovered remotely exploitable vulnerabilities.
- glibc has included optimized versions of memcpy and memmove functions for AMD Zen 3 and Zen 4 processors.
- A large number of new drivers have been added, including drivers for the Intel processor-integrated QAT (QuickAssist Technology) accelerator, which offers tools for speeding up computations used in compression and encryption.
- The TigerVNC, Totem, power-profiles-daemon, gedit, gtkmm, WebKitGTK, Evolution, Festival, Eye of GNOME, Cheese, and Tweaks packages have been removed.
- The package delivery has been discontinued: sendmail (recommended to switch to postfix), redis, dhcp, dhcp-client, mod_security (moved to EPEL), spamassassin (moved to EPEL), xsane, runc.
- The packages squashfs and wget, as well as the interfaces utmp and utmpx in glibc, have been declared deprecated.
Source: opennet.ru
