The CentOS Project has officially announced the availability of CentOS Stream 10, which serves as the basis for building Red Hat Enterprise Linux 10. CentOS Stream is categorized as a continuously updated distribution, allowing earlier access to packages being developed for future RHEL releases. CentOS Stream 10 builds are available for the x86_64_v3, Aarch64, ppc64le (POWER9), and s390x (IBM z14) architectures in the form of installation ISO files and images for isolated containers. Support for the CentOS Stream 10 branch will continue until 2030.
According to the new policy by Red Hat, the CentOS Stream repository is the only publicly accessible source of source code for packages related to Red Hat Enterprise Linux. CentOS Stream can be viewed as an upstream project for RHEL, serving as the foundation for its development and allowing external community members to partake in the development of the new RHEL branch, monitor package preparation for RHEL, propose their changes, and influence decision-making.
Before the establishment of CentOS Stream as the basis for the new RHEL branch, a snapshot of one of the Fedora releases was utilized, which was refined and stabilized behind closed doors, without the possibility of tracking the development process and decision-making. The new development process shifted the closed preparation stage of RHEL into CentOS Stream — a new branch of CentOS Stream is formed based on the Fedora snapshot with community participation, after which RHEL is rebuilt based on CentOS Stream.
Key changes in CentOS Stream 10 compared to the previous significant branch:
- The X.org Server and related components have been removed from the distribution. By default, a graphics stack based on the Wayland protocol is employed. The ability to run X11 applications in a Wayland session is ensured by the XWayland DDX server (only the package 'xorg-x11-server-Xwayland' remains).
- The desktop environment has been updated to GNOME 47. An overview mode has been added for viewing open windows in the classic GNOME session, which was previously only available in the standard GNOME session. Qt libraries have been updated to version 6.7. Qt5 packages have been removed from the distribution (only Qt 6 support remains).
- The supply of RPM packages for Firefox, GIMP, LibreOffice, Inkscape, and Thunderbird has been discontinued. For the installation of Firefox and Thunderbird, automatic downloading and installation of packages in Flatpak format is provided using the external repository flatpaks.redhat.io.
- The PulseAudio sound server has been replaced with the PipeWire package.
- Updated package versions for developers: GCC 14.2, LLVM 18.1.8, Python 3.12, Ruby 3.3, OpenJDK 21, Rust 1.82.0, Go 1.23, Node.js 22, Perl 5.40, PHP 8.3, Git 2.45, Subversion 1.14, SystemTap 5.1, Valgrind 3.23.0.
- Server packages updated: OpenSSH 9.8, nginx 1.26, Apache HTTPD 2.4.62, Varnish Cache 7.4, Squid 6.10, MariaDB 10.11, MySQL 8.4, PostgreSQL 16, PCP 6.3.0, Grafana 10.2.6, libreswan 4.15, Pacemaker 2.1.8, 389-ds-base 3.0.4, Podman 5.0.
- System packages updated: Linux kernel 6.12, glibc 2.39, binutils 2.41, NSS 3.101, gnutls 3.8.7, polkit 125, DNF 4.20, and RPM 4.19.
- New packages added: tuned-ppd (replacing power-profiles-daemon), libcpuid, and dnsconfd (a background process for DNS caching). Due to the transition of the Redis DBMS codebase to a proprietary license, the Valkey fork is recommended instead of Redis. The Kea DHCP server is used instead of ISC DHCP. The zlib-ng-compat package is used instead of zlib.
- In the DNF package manager, downloading file lists metadata (filelist) is disabled by default. Such data is rarely used but is large in size and slows down performance. For PGP handling in DNF and RPM, the rpm-sequoia library is utilized.
- Experimental support for the Composefs file system has been added, implemented as an overlay on OverlayFS and EROFS, optimized for efficient shared storage of multiple mounted disk images.
- In the KVM hypervisor, experimental (Technology Preview) support for AMD SEV, SEV-SNP, and SEV-ES technologies is provided.
- When creating new users through the Anaconda installer interface, these users are by default granted administrator rights (a specific setting is available to disable this behavior). The installer also offers a new interface for selecting the time zone. For remote access to the installer, the RDP protocol is used instead of VNC.
- Support has been added for quantum-resistant encryption algorithms. These algorithms are available in OpenSSL, OpenSSH, and in system cryptographic policies (crypto-policies). OpenSSL now allows the creation of files with certificates and keys in PKCS #12 format that meet FIPS requirements. The openssl-pkcs11 engine has been replaced by pkcs11-provider, which enables the use of hardware keys in apache httpd, libssh, bind, and other applications that utilize OpenSSL. Access permissions for SSH host keys have changed from 0640 to 0600 (accessible only to the owner). In GnuTLS, support for certificate compression using zlib, brotli, and zstd methods has been added.
- In addition to GnuPG, the Sequoia command-line toolkit (utilities sq and sqv) with an implementation of the OpenPGP standard (RFC-4880) in Rust has been included.
- By default, the predictable name selection mode for network interfaces is enabled (net.ifnames=1). In NetworkManager, a mechanism to detect duplicates for IPv4 has been activated. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. DAD (Duplicate Address Detection) has been introduced to prevent the assignment of the same IP on different systems in the local network.
- In disk images (for example, in system images for AWS and KVM), the use of a separate /boot partition has been discontinued.
- The user-space tools for SELinux (libsepol, libselinux, libsemanage, policycoreutils, checkpolicy, mcstrans) have been updated to version 3.7, which includes the 'audit2allow -C' parameter for output in CIL (Common Intermediate Language) format. Support for the Wayland protocol has been added to the sandbox utility.
- The Keylime component now supports device identification via IDevID (Initial Device Identity) and IAK (Initial Attestation Key), with TLS 1.3 protocol enabled by default.
- A new file manager (cockpit-files package) has been proposed in the web console, allowing management of files and directories.
- In server By default, CUPS printing has disabled operation in mDNS and broadcast modes, which were involved in recently discovered remotely exploitable vulnerabilities.
- glibc has included optimized versions of memcpy and memmove functions for AMD Zen 3 and Zen 4 processors.
- A large number of new drivers have been added, including drivers for the Intel processor-integrated QAT (QuickAssist Technology) accelerator, which offers tools for speeding up computations used in compression and encryption.
- The TigerVNC, Totem, power-profiles-daemon, gedit, gtkmm, WebKitGTK, Evolution, Festival, Eye of GNOME, Cheese, and Tweaks packages have been removed.
- The package delivery has been discontinued: sendmail (recommended to switch to postfix), redis, dhcp, dhcp-client, mod_security (moved to EPEL), spamassassin (moved to EPEL), xsane, runc.
- The packages squashfs and wget, as well as the interfaces utmp and utmpx in glibc, have been declared deprecated.
Additionally, the creation of the EPEL 10 (Extra Packages for Enterprise Linux) repository has been announced, which offers additional packages for the Red Hat Enterprise Linux 10-beta and CentOS Stream 10 distributions. Binary builds of EPEL are being created for x86_64, aarch64, ppc64le, and s390x architectures. Notably, at the time of the repository's launch, EPEL 10 already includes over 10,000 ready-to-use packages built from 3,600 source packages. Unlike past branches, starting from EPEL 10, separate repositories will be created for each intermediate version of RHEL, for example, a separate EPEL 10.1 branch will be created for RHEL 10.1.
Source: opennet.ru
