After two years of development release (), available for ten officially supported : Intel IA-32/x86 (i686), AMD64/x86-64, ARM EABI (armel), 64-bit ARM (arm64), ARMv7 (armhf), MIPS (mips, mipsel, mips64el), PowerPC 64 (ppc64el) and IBM System z (s390x). Updates for Debian 10 will be released for 5 years.
The repository features 57,703 binary packages, which is about 6,000 more than were offered in Debian 9. Compared to Debian 9, 13,370 new binary packages have been added, 7,278 (13%) outdated or abandoned packages have been removed, and 35,532 (62%) packages have been updated. For 91.5% of packages support for reproducible builds, ensuring that the executable file is built from the specified source code and does not contain unauthorized changes, which could potentially occur through attacks on the build infrastructure or backdoors in the compiler.
For DVD images, which can be downloaded via , or . There are also an unofficial installation image nonfree, including proprietary firmware. For amd64 and i386 architectures, , available in GNOME, KDE, and Xfce variants, as well as a multi-architecture DVD combining packages for the amd64 platform with additional packages for the i386 architecture. Support has been added for network bootable (netboot) images for SD cards and images fitting on a 16 GB USB Flash drive;
in Debian 10.0:
- support for UEFI Secure Boot, for which the Shim bootloader signed with a digital signature from Microsoft (shim-signed) is employed, along with signing the kernel and grub bootloader (grub-efi-amd64-signed) with the project's own certificate (shim acts as a layer to allow the distribution to use its own keys). Packages shim-signed and grub-efi-ARCH-signed are included in the build dependencies for amd64, i386, and arm64. The signed bootloader and grub are integrated into EFI images for amd64, i386, and arm64. Note that support for Secure Boot was initially expected in Debian 9 but was not stabilized before the release and was postponed until the next significant release of the distribution.
- By default, the AppArmor mandatory access control system is enabled, which allows controlling the permissions of processes by defining file lists with corresponding rights (such as read, write, memory mapping and execution, setting file locks, etc.) for each application, as well as controlling network access (for example, prohibiting the use of ICMP) and managing POSIX capabilities. The main difference between AppArmor and SELinux is that SELinux operates with object-associated labels, while AppArmor defines permissions based on file paths, which significantly simplifies the configuration process. The main package with AppArmor includes protection profiles for only a few applications, and for others, you should use the apparmor-profiles-extra package or profiles from specific application packages;
- Replaced by By default, the iptables-nft package is installed, which offers a set of utilities for compatibility with iptables, having the same command line syntax but translating the received rules into nf_tables bytecode, executed in a virtual machine. Optionally, the iptables-legacy package is available for installation,
which includes старую реализацию на основе x_tables. Исполняемые файлы iptables теперь устанавливаются в /usr/sbin, а не в /sbin (для совместимости создаются символические ссылки);
- For APT, a sandbox isolation mode has been implemented, activated through the APT::Sandbox::Seccomp option, providing syscall filtering using seccomp-BPF. For more granular control over the syscall whitelist and blacklist, you can use the APT::Sandbox::Seccomp::Trap and APT::Sandbox::Seccomp::Allow lists;
- The Linux kernel has been upgraded to version 4.19;
- The GNOME desktop by default has been transitioned to using Wayland, while a session based on the X server is offered as an option (the X server is still included in the base package). The graphical stack and user environments have been updated: , , Cinnamon 3.8, LXDE 0.99.2, , , and Xfce 4.12. The LibreOffice office suite has been updated to the release , and Calligra to the release . Updated versions include Evolution 3.30, GIMP 2.10.8, Inkscape 0.92.4, Vim 8.1;
- The distribution now includes a compiler for the Rust language (Rustc 1.34 is supplied). Updated versions include GCC 8.3, LLVM/Clang 7.0.1, OpenJDK 11, Perl 5.28, PHP 7.3, Python 3.7.2;
- Server applications have been updated, including Apache httpd 2.4.38, BIND 9.11, Dovecot 2.3.4, Exim 4.92, Postfix 3.3.2, MariaDB 10.3, nginx 1.14, PostgreSQL 11, Samba 4.9 (support for SMBv3 is provided in the kernel);
- In cryptsetup, the transition to the LUKS2 disk encryption format has occurred (LUKS1 was previously used). LUKS2 features a simplified key management system, the ability to use large sectors (4096 instead of 512, reducing the load during decryption), symbolic partition identifiers (labels), and mechanisms for backing up metadata with automatic recovery from a copy in case of damage. During the upgrade, existing LUKS1 partitions will be automatically converted to a format compatible with LUKS2, but due to header size limitations, not all new features will be available for them;
- The installer now includes the ability to use multiple consoles simultaneously during installation. Support for ReiserFS has been removed. For Btrfs, support for ZSTD compression (libzstd) has been added. NVMe device support has also been added;
- In debootstrap, the "—merged-usr" option is enabled by default, where all executables and libraries from the root directories are moved to the /usr partition (the /bin, /sbin, and /lib* directories are made symbolic links to the corresponding directories within /usr). This change applies only to new installations; during upgrades, the old directory layout remains intact;
- In the unattended-upgrades package, in addition to automatically installing updates related to vulnerability fixes, updating to interim releases (such as Debian 10.1, 10.2, etc.) is now also enabled by default;
- The printing system components have been updated to and cups-filters 1.21.6 with full support for AirPrint, DNS-SD (Bonjour), and IPP Everywhere for printing without the need to install drivers;
- Support for Allwinner A64-based boards has been added, such as FriendlyARM NanoPi A64, Olimex A64-OLinuXino, TERES-A64, PINE64 PINE A64/A64/A64-LTS, SOPINE, Pinebook, SINOVOIP Banana Pi BPI-M64, and Xunlong Orange Pi Win(Plus);
- The number of med-* metapackages supported by the Debian Med team has been expanded, allowing the installation of , related to biology and medicine;
- Support for guest systems in Xen PVH mode has been ensured;
- Support for TLS 1.0 and 1.1 has been disabled in OpenSSL, with TLS 1.2 being the minimum supported version;
- Many obsolete and unsupported packages have been removed, including Qt 4 (only Qt 5 remains), phpmyadmin, ipsec-tools, racoon, ssmtp, ecryptfs-utils, mcelog, revelation. Support for Python 2 will cease in Debian 11;
- A port for the 64-bit RISC-V architecture has been created, which was not among those officially supported in Debian 10. Currently, about V;
- In Live environments, an independently developed modular installer with a Qt-based interface is now being used, which is also employed for installing the Manjaro, Sabayon, Chakra, NetRunner, KaOS, OpenMandriva, and KDE neon distributions. The debian-installer continues to be used in regular installation builds.
In addition to those previously available, a Live environment with the LXQt desktop and a Live environment without a graphical interface, featuring only console utilities that make up the base system, has been created. The console Live environment can be quickly used for distribution installation, as it copies a ready-made snapshot of directories, without unpacking individual packages using dpkg.
Source: opennet.ru
