Beta release of Red Hat Enterprise Linux 10 and release of RHEL 9.5

Red Hat has released the beta version of the Red Hat Enterprise Linux 10 distribution and the release of Red Hat Enterprise Linux 9.5. The installation images are prepared for registered Red Hat Customer Portal users (ISO images of CentOS Stream 10 and CentOS Stream 9.5 can also be used for functionality evaluation, as well as free RHEL developer builds). The repositories with binary packages for RHEL 10 are publicly available. Releases are built for x86_64, s390x (IBM System z), ppc64le, and Aarch64 (ARM64) architectures. The release of RHEL 10 is expected in the first half of next year.

The RHEL 10 branch uses the package base of CentOS Stream 10 as a foundation, which is positioned as an upstream project for RHEL, allowing third parties to oversee the preparation of packages for RHEL, suggest their changes, and influence the decisions being made. In accordance with the 13-year support cycle, RHEL 10 will be supported until 2035, with an additional 3 years of extended paid support. Updates for RHEL 9 will continue to be released until the end of May 2032, while RHEL 8 will receive updates until 2029.

The source codes of the RHEL 10 RPM packages have been published for free download. RHEL 9.5 packages are not hosted in the public git.centos.org repository and are only provided to the company's clients through a restricted section of the website, where a user license agreement (EULA) prohibits data redistribution, making it impossible to use these packages for creating derivative distributions. The source codes for RHEL 9.5 remain available in the CentOS Stream repository, but it is not fully synchronized with RHEL, and the most recent package versions do not always match those from RHEL. Rocky Linux, Oracle, and SUSE reproduce the source codes of the RPM packages from RHEL releases as part of the OpenELA project.

Key changes in RHEL 10:

• When creating new users through the Anaconda installer interface, these users are by default granted administrator rights (a specific setting is available to disable this behavior). The installer also offers a new interface for selecting the time zone. For remote access to the installer, the RDP protocol is used instead of VNC.
• Support has been added for quantum-resistant encryption algorithms. These algorithms are available in OpenSSL, OpenSSH, and in system cryptographic policies (crypto-policies). OpenSSL now allows the creation of files with certificates and keys in PKCS #12 format that meet FIPS requirements. The openssl-pkcs11 engine has been replaced by pkcs11-provider, which enables the use of hardware keys in apache httpd, libssh, bind, and other applications that utilize OpenSSL. Access permissions for SSH host keys have changed from 0640 to 0600 (accessible only to the owner). In GnuTLS, support for certificate compression using zlib, brotli, and zstd methods has been added.
• In addition to GnuPG, the Sequoia command-line toolkit (utilities sq and sqv) with an implementation of the OpenPGP standard (RFC-4880) in Rust has been included.
• In the DNF package manager, downloading file lists metadata (filelist) is disabled by default. Such data is rarely used but is large in size and slows down performance. For PGP handling in DNF and RPM, the rpm-sequoia library is utilized.
• Updated package versions for developers: GCC 14.2, LLVM 18.1.8, Python 3.12, Ruby 3.3, OpenJDK 21, Rust 1.79.0, Go 1.22, Node.js 22, Perl 5.40, PHP 8.3, Git 2.45, Subversion 1.14, SystemTap 5.1, Valgrind 3.23.0.
• Server packages updated: OpenSSH 9.8, nginx 1.26, Apache HTTPD 2.4.62, Varnish Cache 7.4, Squid 6.10, MariaDB 10.11, MySQL 8.4, PostgreSQL 16, PCP 6.3.0, Grafana 10.2.6, libreswan 4.15, Pacemaker 2.1.8, 389-ds-base 3.0.4, Podman 5.0.
• System packages have been updated: Linux kernel 6.11, glibc 2.39, binutils 2.41, NSS 3.101, gnutls 3.8.7, polkit 125.
• New packages added: tuned-ppd (replacing power-profiles-daemon), libcpuid, and dnsconfd (background process for DNS caching). Due to the transition of the Redis database management system codebase to a proprietary license, Valkey is proposed as a fork instead of Redis. Kea DHCP is utilized instead of the ISC DHCP server. The package zlib-ng-compat is used instead of zlib.
• By default, the predictable name selection mode for network interfaces is enabled (net.ifnames=1). In NetworkManager, a mechanism to detect duplicates for IPv4 has been activated. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. DAD (Duplicate Address Detection) has been introduced to prevent the assignment of the same IP on different systems in the local network.
• In disk images (for example, in system images for AWS and KVM), the use of a separate /boot partition has been discontinued.
• Experimental support for the Composefs file system has been added, implemented as an overlay on OverlayFS and EROFS, optimized for efficient shared storage of multiple mounted disk images.
• Experimental (Technology Preview) support for AMD SEV, SEV-SNP, and SEV-ES has been provided in the KVM hypervisor.
• The user-space tools for SELinux (libsepol, libselinux, libsemanage, policycoreutils, checkpolicy, mcstrans) have been updated to version 3.7, which includes the 'audit2allow -C' parameter for output in CIL (Common Intermediate Language) format. Support for the Wayland protocol has been added to the sandbox utility.
• The Keylime component now supports device identification via IDevID (Initial Device Identity) and IAK (Initial Attestation Key), with TLS 1.3 protocol enabled by default.
• A new file manager (cockpit-files package) has been proposed in the web console, allowing management of files and directories.
• The CUPS print server has mDNS and broadcast modes disabled by default, which were involved in recently identified remotely exploitable vulnerabilities.
• glibc has included optimized versions of memcpy and memmove functions for AMD Zen 3 and Zen 4 processors.
• Transition to supplying Firefox and Thunderbird in Flatpak package format has been implemented.
• A preview mode for viewing open windows has been added to the classic GNOME session, which was previously available only in the standard GNOME session.
• A large number of new drivers have been added, including drivers for the Intel processor-integrated QAT (QuickAssist Technology) accelerator, which offers tools for speeding up computations used in compression and encryption.
• The package delivery has been discontinued: sendmail (recommended to switch to postfix), redis, dhcp, dhcp-client, mod_security (moved to EPEL), spamassassin (moved to EPEL), xsane, runc.
• The packages squashfs and wget, as well as the interfaces utmp and utmpx in glibc, have been declared deprecated.

Key changes in RHEL 9.5:

• Developer packages updated: GCC 11.5, Node.js 22, GCC Toolset 14, LLVM Toolset 18.1.8, Rust Toolset 1.79.0, Go Toolset 1.22, OpenJDK 17, GDB 14.2, Valgrind 3.23.0, SystemTap 5.1, elfutils 0.191, libabigail 2.5.
• System package versions updated: OpenSSL 3.2.2, NSS 3.101, clevis 20, ipa 4.12.0, Podman 5.0.
• Server packages updated: Apache HTTPD 2.4.62, BIND 9.18, PCP 6.2.2, Grafana 10.2.6, libreswan 4.15, PostgreSQL 16, samba 4.20.2.
• A new system role for managing and configuring sudo has been added. The snapshot role now includes support for managing snapshots in the LVM pool. Enhanced capabilities for the postfix, podman, ssh, network, nbde_client, journald, logging, and storage roles.
• The nbdkit and bootupd services have been transitioned under SELinux protection. Support for executing commands under SELinux protection via QEMU Guest Agent has been added.
• Support for live migration of virtual machines with passed-through NVIDIA vGPUs has been added.
• A cockpit-files package with file manager implementation has been proposed for the web console.
• IPsec connection support has been added to NetworkManager. VPN using IPv6 addresses.
• Simultaneous use of firewalld and nftables services has been allowed.
• Support for the Composefs file system has been added.
• The '-O3' optimization mode has been enabled in GCC for building CPython, increasing Python performance by approximately 4%.
• For Glibc, the mode 'GLIBC_TUNABLES=glibc.cpu.prefer_map_32bit_exec=1' has been implemented, which arranges dynamic objects in the address space contiguously rather than randomly, potentially improving performance at the cost of reduced ASLR protection in certain configurations. Optimized versions of memcpy and memmove functions for AMD Zen 3 and Zen 4 processors have been included in glibc.
• The eBPF subsystem has been synchronized with the Linux kernel 6.8 (the previous release used the eBPF implementation from the Linux kernel 6.6).
• Support for disk quotas has been implemented for the tmpfs filesystem, commonly used for the /tmp partition.
• Experimental support for the QUIC protocol on the client side has been added to OpenSSL.
• Experimental support for offload mode has been added to offload UDP packet encapsulation operations to the network card.
• Experimental support for HSM (Hardware Security Module) has been added.
• An experimental option for using LMDB database in the Directory Server has been added.
• In Identity Management, an experimental ipa-migrate command has been added for migrating data to another IdM server.
• Continued provision of experimental (Technology Preview) support:
  • VPN WireGuard,
  • kTLS (TLS at the kernel level),
  • asynchronous I/O interface io_uring,
  • DAX (Direct Access) for ext4 and XFS,
  • AMD SEV and SEV-ES in the KVM hypervisor,
  • systemd-resolved service,
  • the Sigstore mechanism for container verification via digital signatures,
  • PRP (Parallel Redundancy Protocol) and HSR (High-availability Seamless Redundancy) protocols,
  • hardware acceleration of IPsec by offloading packet encapsulation operations to the network card,
  • the ACME certificate management protocol used in Let's Encrypt,
  • SRv6 (Segment Routing over IPv6)
  • package with the GIMP image editor 2.99.8,
  • MPTCP (Multipath TCP) settings via NetworkManager,
  • DNSSEC in IdM,
  • virtio-mem,
  • Socket API for TuneD,
  • Soft-iWARP (Internet Wide-area RDMA Protocol),
  • GNOME for ARM64 and IBM Z.
• The packages libgcrypt and pam_ssh_agent_auth have been deprecated.
• The X.org Server and its associated components have been removed from the distribution (this was not mentioned in the release notes for the test release, but it was planned). The ability to run X11 applications in a Wayland session is provided via the XWayland DDX server.
• The PulseAudio sound server has been replaced with the PipeWire package. The packages TigerVNC, Totem, power-profiles-daemon, gedit, gtkmm, WebKitGTK, Evolution, Festival, Eye of GNOME, Cheese, Tweaks, and Qt5 have been removed (only Qt 6 has been retained).
  
  Source: opennet.ru