Release of FreeBSD 15.0

Two years after the publication of the 14.0 branch, the release of FreeBSD 15.0 has been formed. Installation images have been prepared for the amd64, aarch64, armv7, powerpc64, powerpc64le, and riscv64 architectures. Additionally, images are provided for virtualization systems (QCOW2, VHD, VMDK, raw) and cloud environments like Amazon EC2, Google Compute Engine, and Vagrant.

Starting with the FreeBSD 15 branch, the support period for significant branches after the first release (15.0) has been reduced from 5 to 4 years, and new significant branches will be formed every two years. Intermediate releases (15.1, 15.2, 15.3) will be developed within a fixed development cycle, meaning new versions in a branch will be published approximately every 6 months, rather than annually as before. Considering the simultaneous support of two different significant branches, a new intermediate release will be published every 3 months (15.4, 16.1, 15.5, 16.2, etc.), except for the preparation of the first releases of new significant branches, which will be preceded by a 6-month release hiatus (for example, release 15.3 will be formed in June 2027, 16.0 in December 2027, 15.4 in March 2028, 16.1 in June 2028).

The main changes in FreeBSD 15.0 (the official release notes mention many features previously added in branches 14.1, 14.2, and 14.3, besides the specific changes for the 15.0 release):

• The ability to use the pkg package manager for installing and updating components of the base system has been provided. Pkgbase packages can be supplied on the installation media for offline installation or downloaded from the pkg.freebsd.org repository. In the pkg configuration (/etc/pkg/FreeBSD.conf), the FreeBSD-base repository is not included by default. The bsdinstall installer offers two installation options: traditional and using packages (pkgbase). Support for the traditional method, where the base system is viewed as a monolithic environment updated using the freebsd-update utility, is planned to be removed in FreeBSD 16. The new method, which involves installing the base system as a set of packages from the FreeBSD-base repository, is proposed by default in the builds for of virtual machines and images for cloud environments, but is still considered experimental for ordinary systems.
• Support for FreeBSD builds in unprivileged environments that do not require root permissions has been added. Installation ISO images and system images for virtual machines can also be created without root rights. During the build process, root permissions were necessary for creating device files, setting access rights, and mounting additional file systems (e.g., when creating disk images).
• Support for reproducible builds has been implemented, allowing verification that distributed binaries are built from the provided source code and do not contain hidden changes. Reproducible builds ensure the identity of binary files generated from source code in different build environments.
• The generation of installation images and binary package builds for 32-bit architectures i386, armv6, and powerpc has been discontinued. Only armv7 remains among 32-bit platforms. The ability to build 32-bit programs and use the COMPAT_FREEBSD32 mode to run 32-bit executables in a 64-bit kernel environment will remain available at least until the end of the FreeBSD 16 branch lifecycle.
• System calls implementing the inotify mechanism for monitoring changes in file systems have been added.
• Support for named file attributes (Solaris-style extended attributes) has been added, which are planned to be supported as an alternative mechanism for managing extended attributes available for ZFS and NFSv4. The differences from traditional methods of working with extended attributes in FreeBSD and Linux come down to the representation of attributes in a service directory, which is not visible in the main namespace of the FS and is associated with the file. Attributes are handled like normal files; for example, to determine the list of attributes, the readdir() function can be used.
• The mac_do module has been declared ready for use, allowing the specification of policies that permit unprivileged users to change process credentials. A utility called mdo, similar to the su utility but not requiring suid root, has been prepared to run commands as another user.
• The state of the DRM drivers i915 and amdgpu is synchronized with the Linux kernel 6.9. The drivers for wireless devices rtw88 (Realtek 802.11n/ac), rtw89 (Realtek 802.11ax), and iwlwifi (Intel 02.11a/b/g/n/ac/ax/be) are synchronized with the Linux kernel 6.17.
• The TLS protocol implementation on the kernel side (KTLS) is enabled by default.
• A utility called sndctl has been added for managing sound card settings.
• A utility called mididump has been added for dumping MIDI 1.0 events in real time.
• A new network backend 'slirp' has been added to the bhyve hypervisor, using the libslirp library with a user-space network stack implementation. The 'slirp' backend allows network access from the guest system to the host environment without separate network configuration on the host side.
• The Kerberos implementation in the main FreeBSD repository has been replaced from Heimdal Kerberos to MIT Kerberos. To revert back to Heimdal Kerberos during the build, the WITHOUT_MITKRB5 flag can be used. Support for building Heimdal Kerberos will be removed in FreeBSD 16.
• The behavior of the system calls setgroups, getgroups, and initgroups when handling user groups has been aligned closer to other platforms (the difference in FreeBSD's implementation was that it stored the effective group identifier in the zero element of the group list array).
• In the pkg package manager settings, the new FreeBSD-kmods repository is enabled by default, which contains packages with kernel modules compiled for specific release branches of 15.x-RELEASE, rather than the constantly updated branch 15-STABLE. The FreeBSD-kmods repository resolves the issue with installing drivers linked to unstable kernel interfaces (such as graphics drivers). The previously present repositories 'FreeBSD' and 'FreeBSD-kmods' in /etc/pkg/FreeBSD.conf have been renamed to 'FreeBSD-ports' and 'FreeBSD-ports-kmods'.
• Support for the CLONE operation, defined in the NFSv4.2 specification and allowing for quick file copying through block cloning on the server, has been added to NFS. This mode currently works only when exporting ZFS partitions via NFS.
• On amd64 systems, the possibility to use more than 4TB of RAM has been added.
• A ufshci driver has been added to support storage controller interfaces with UFSHCI (Universal Flash Storage Host Controller Interface).
• The sysctl net.link.bridge.member_ifaddrs is defaulted to 0, i.e., interfaces can be added to network bridges without. (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community..
• The reliability of partitions with the UFS file system containing more than 2,000,000,000 inodes has been enhanced. In the implementation of UFS1, the year 2038 problem has been resolved (dates can be used up to the year 2106).
• A network socket option SO_SPLICE has been added to combine TCP connections (similar to a proxy that operates without copying data to user space).
• In the grep utility, following symbolic links is disabled by default during recursive searches.
• A nvmf kernel module has been added for supporting NVMe over Fabric controllers and the nvmecontrol utility for connecting to an external NVMe over Fabric controller.
• The date utility has added support for outputting time with nanosecond precision, for example, "date -Ins" will output "2024-04-22T12:20:28,763742224+02:00".
• Support for the zfs.dataset option has been added to the jail to include a ZFS dataset, snapshot, or clone in the isolated jail environment. The jail command has added support for the "meta" and "env" parameters, allowing the binding of metadata or passing of environment variables. It is now possible to address jail environments by jail descriptors, for which the jail_set and jail_get functions have been provided, as well as the system calls jail_attach_jd and jail_remove_jd. The ability to use kevent filters for tracking operations of creating, deleting, modifying, and attaching Jails has also been added.
• In the newsyslog utility, a parameter has been implemented to set the default compression method (bzip2, xz, zstd, gzip), eliminating the need to specify individual flags (J, X, Y, Z) in each line of newsyslog.conf.
• In the standard C library, many functions for working with strings and memory have optimizations based on SIMD instructions.
• The Gallant font used in virtual terminals has been enhanced with over 4300 new glyphs, including glyphs with Cyrillic characters and mathematical symbols.
• In the tty, the IUTF8 flag is set by default, which correctly handles the deletion of UTF-8 characters when the Backspace key is pressed.
• The dialog utility, used in the bsdconfig configurator and the bsdinstall installer, has been replaced with bsddialog.
• In the adduser utility used in bsdinstall, a separate ZFS dataset (partition, snapshot, or clone) is created for the user's home directory if a ZFS dataset is already used for the parent directory. Support for home directory encryption using ZFS has also been added. Parameters "Zcreate" and "Zencrypt" have been added to adduser.conf to manage the activation of these features.
• OCI-compatible container images and system images for Oracle Cloud are now generated.
• A new image type "small" has been added for cloud environments compatible with AWS EC2. Unlike the base images, debug data, tests, 32-bit libraries, the LLDB debugger, the Amazon SSM Agent, and AWS CLI have been excluded from them. The loading of "base" images for EC2 has been accelerated by 76%.
• By default, the net.inet.tcp.nolocaltimewait setting has been disabled and marked as obsolete, meaning that the creation of TIME_WAIT records for TCP connections terminated on the local system side has been reverted to its default behavior. A new sysctl net.inet.tcp.msl_local has been added to configure the time a connection remains in the TIME_WAIT state.
• By default, support for creating network connections to localhost specifying INADDR_ANY has been disabled. To restore support, the sysctl net.inet.ip.connect_inaddr_wild can be set to 1.
• The gvinum logical volume manager, which was used for software RAID, has been removed. Gvinum development stopped about 15 years ago, despite known issues in the code that have not been addressed. It is recommended to use gconcat, gmirror, gstripe, graid, or zfs instead of gvinum.
• The agp (Accelerated Graphics Port) driver, necessary for many drivers for older graphics cards, is scheduled to be removed in FreeBSD 16. The following drivers have also been marked as obsolete and are planned for removal: fdc (IBM PC Floppy Disk Controller), firewire (IEEE1394 Serial Bus), le (AMD Am7900 LANCE and Am79C9xx Ethernet), and upgt (USB 802.11g).
• The readdir_r function has been deprecated.
• Support for UDP transport has been discontinued in the SNMP server bsnmpd.
• RSA host key generation for SSH and EC2 AMI has been discontinued. DSA support has been removed from OpenSSH. The publickey database associated with the DES algorithm has been removed.
• The ftpd and shar utilities have been removed from the base system, and ports ftp/freebsd-ftpd and sysutils/freebsd-shar should be used instead.
• The fdisk utility has been deprecated, and gpart should be used instead.
• The syscons driver has been moved to the legacy category; it is incompatible with UEFI, does not support UTF-8, and is tied to global locking.
• Updated versions: LLVM 19.1.7, OpenSSH 10.0p2, OpenSSL 3.5.4, OpenZFS 2.4.0rc4, Lua 5.4.8, jemalloc 5.3.0, Awk 20250804 (with UTF-8 support), bc 7.1.0, unicode 16.0.0, ncurses 6.5, libarchive 3.8.2, tcpdump 4.99.5, unbound 1.24.1, less 679, file 5.46, GoogleTest 1.15.2.

Source: opennet.ru