Ubuntu 24.04 LTS distribution release

The release of the Ubuntu 24.04 “Noble Numbat” distribution took place, which is classified as a long-term support (LTS) release, updates for which are generated within 12 years (5 years - publicly available, plus another 7 years for users of the Ubuntu Pro service). Installation images are created for Ubuntu Desktop, Ubuntu Server, Lubuntu, Kubuntu, Ubuntu Mate, Ubuntu Budgie, Ubuntu Studio, Xubuntu, UbuntuKylin (Chinese edition), Ubuntu Unity, Edubuntu and Ubuntu Cinnamon.

Major changes:

• The desktop has been updated to the release of GNOME 46, which added a global search function, improved performance of the file manager and terminal emulators, added experimental support for the VRR (Variable Refresh Rate) mechanism, improved output quality for fractional scaling, expanded capabilities for connecting to external services, updated configurator and improved notification system. GTK uses a new rendering engine that is based on the Vulkan API. The Cheese camera app has been replaced by GNOME Snapshot.
• The Linux kernel has been updated to version 6.8.
• Updated versions of GCC 14-pre, LLVM 18, Python 3.12, OpenJDK 21 (OpenJDK 8, 11 and 17 are optionally available), Rust 1.75, Go 1.22, .NET 8, PHP 8.3.3, Ruby 3.2.3, binutils 2.42, glibc 2.39.
• Updated user applications: Firefox 124 (built with Wayland support), LibreOffice 24.2, Thunderbird 115, Ardour 8.4.0, OBS Studio 30.0.2, Audacity 3.4.2, Transmission 4.0, digiKam 8.2.0, Kdenlive 23.08.5, Krita 5.2.2 .3.0.20, VLC XNUMX.
• Subsystems updated: Mesa 24.0.3, systemd 255.4, BlueZ 5.72, Cairo 1.18, NetworkManager 1.46, Pipewire 1.0.4, Poppler 24.02, xdg-desktop-portal 1.18.
• Server packages updated: Nginx 1.24, Apache httpd 2.4.58, Samba 4.19, Exim 4.97, Clamav 1.0.0, Chrony 4.5, containerd 1.7.12, LXD 5.21.0, Django 4.2.11, Docker 24.0.7, Dovecot 2.3.21. 11.1, GlusterFS 2.8.5, HAProxy 2.4.1, Kea DHCP 10.0.0, libvirt 5.9.4, NetSNMP 2.6.7, OpenLDAP 12.3.5, open-vm-tools 16.2, PostgreSQL 1.1.12, Runc 8.2.1, QEMU 4.0.0 .6.6, SpamAssassin 2.9.4, Squid 2.1.6, SSSD 2024.1, Pacemaker 19.2.0, OpenStack 3.3.0, Ceph 24.03, Openvswitch XNUMX, Open Virtual Network XNUMX.
• The Thunderbird email client now only comes in snap format. The Thunderbird DEB package contains a stub for installing the snap package.
• The ubuntu-desktop-installer installer has been modernized, which is now being developed as part of the larger ubuntu-desktop-provision project and renamed ubuntu-desktop-bootstrap. The essence of the new project is to divide the installer into stages performed before installation (disk partitioning and copying packages) and during the first boot of the system (initial system setup). The installer is written in the Dart language, uses the Flutter framework to build the user interface and is implemented as an add-on over the low-level curtin installer, which is already used in the Subiquity installer used in Ubuntu Server.

  Among the changes in the new installer, there is an improved interface design, the addition of a page for specifying the URL for downloading the autoinstall.yaml automated installation script, and the ability to change the default behavior and design style through the configuration file. Added support for updating the installer itself - if a new version is available at an early stage of installation, a request to update the installer is now issued.

  The Ubuntu Desktop installer uses minimal installation mode by default. To install additional programs such as LibreOffice and Thunderbird, you must select the advanced installation mode. The installer also highlights features added in the previous release of Ubuntu 23.10, such as support for the ZFS file system and the ability to encrypt drives without requiring you to enter a drive unlock password at boot by storing key decryption information in a TPM (Trusted Platform Module).

  
• The new Ubuntu App Center application manager has been improved, written in Dart using the Flutter framework and adaptive interface layout methods to work correctly on screens of any size. The Ubuntu Store implements a combined interface for working with packages in DEB and Snap formats (if there is one program in both deb and snap packages, snap is selected by default), allows you to search and navigate through the snapcraft.io package catalog and connected DEB repositories, and allows you to manage installing, uninstalling and updating applications, installing individual deb packages from local files. The application uses a rating system in which the five-point rating scale is replaced by voting in the like/dislike format (+1/-1), on the basis of which a virtual five-star rating is displayed.

  Ubuntu App Center replaces the old Snap Store interface. Compared to Ubuntu 23.10, a new application category has been added - Games (GNOME games have been removed from the package). A separate interface for updating firmware is proposed - Firmware Updater, available for systems based on amd64 and arm64 architectures, and allowing you to update firmware without running a full-fledged application manager in the background.

  
• By analogy with changes in Arch Linux and Fedora Linux, the sysctl vm.max_map_count parameter, which determines the maximum number of memory mapping areas available to a process, has been increased by default from 65530 to 1048576. The change has improved compatibility with Windows games launched via Wine (for example, with the old value did not launch the games DayZ, Hogwarts Legacy, Counter Strike 2, Star Citizen and THE FINALS), and solved some performance problems with memory-intensive applications.
• Access of unprivileged users to user namespaces is limited, which will increase the security of systems using container isolation from vulnerabilities that require manipulation of the user namespace to exploit. Ubuntu uses a hybrid blocking scheme that selectively allows some programs to create a user namespace if they have an AppArmor profile with the “allow userns create” rule or CAP_SYS_ADMIN rights. For example, profiles are created for Chrome and Discord, in which user namespace is used to sandbox processes.
• When building packages, compiler options are enabled by default to make exploiting vulnerabilities more difficult. In gcc and dpkg, the “-D_FORTIFY_SOURCE=3” mode is enabled by default, which detects possible buffer overflows when executing string functions defined in the string.h header file. The difference from the previously used “_FORTIFY_SOURCE=2” mode comes down to additional checks. Theoretically, additional checks can lead to reduced performance, but in practice, the SPEC2000 and SPEC2017 tests showed no differences and there were no complaints from users during the testing process about the decrease in performance.
• Apparmor is enabled by default to allow any application to access GnuTLS and OpenSSL library configuration files. Previously, selective provisioning resulted in problems that were difficult to diagnose due to the lack of error output when configuration files could not be accessed.
• The pptpd and bcrelay packages have been removed due to potential security issues and deprecation of the underlying codebases. The PAM module pam_lastlog.so, which does not solve the 2038 problem, has also been removed.
• Added "-mbranch-protection=standard" flag to dpkg to enable execution protection on ARM64 systems for instruction sets that should not be branched to (ARMv8.5-BTI - Branch Target Indicator). Blocking transitions to arbitrary sections of code is implemented to prevent the creation of gadgets in exploits that use return-oriented programming techniques (ROP - Return-Oriented Programming).
• For applications using gnutls, support for the TLS 1.0, TLS 1.1 and DTLS 1.0 protocols, which were officially classified as obsolete technologies by the IETF (Internet Engineering Task Force) three years ago, is forcibly disabled. For openssl, a similar change was implemented in Ubuntu 20.04.
• The 1024-bit RSA keys used in APT to verify repositories using a digital signature have been declared obsolete and disabled. On Ubuntu 24.04, repositories must be signed with RSA keys of at least 2048 bits, or with Ed25519 and Ed448 keys. Because 1024-bit RSA keys continue to be used in some PPAs, such keys are not currently blocked, but are issued a warning. After some time, the warning is planned to be replaced with an error output.
• The APT package manager has changed the priority for the "proposed pocket" repository, which pre-tests new versions of packages before they are released to the main repositories for the general public. The change is aimed at reducing the likelihood of automated installation of unstable updates, if the “proposed pocket” repository is enabled, which can lead to system malfunction. After enabling the “proposed pocket”, all updates will no longer be transferred from it, but the user will be able to selectively install updates to the necessary packages using the “apt install /-proposed” command.
• The irqbalance service, which distributes hardware interrupt processing across different CPU cores, has been discontinued by default. Currently, in most situations, the standard handler distribution mechanisms provided by the Linux kernel are sufficient. The use of irqbalance may be justified in certain situations, but only if properly configured by the administrator. In addition, irqbalance causes problems in certain configurations, for example when used in virtualization systems, and can also interfere with manual configuration of parameters that affect power consumption and latency.
• To configure the network, the release of the Netplan 1.0 toolkit is used, which provides storage of settings in YAML format and provides backends that abstract access to configuration for NetworkManager and systemd-networkd. The new version has the ability to simultaneously use WPA2 and WPA3, added support for Mellanox VF-LAG network devices with SR-IOV (Single-Root I/O Virtualization) and implemented the “netplan status -diff” command to visually assess the differences between the actual state of the settings and configuration files. Ubuntu Desktop has NetworkManager enabled as a configuration backend by default.

• The Active Directory Certificate Auto Enrollment (ADSys) mechanism is enabled, allowing you to automatically obtain certificates from Active Directory services when group policies are enabled. Automatically obtaining certificates through Active Directory also applies when connecting to corporate wireless networks and VPNs.
• Ubuntu's Apport package, used to automate the handling of application crashes, provides integration with systemd-coredump to handle crashes. You can now use the coredumpctl utility to analyze core dumps.
• The basic package includes applications for performance analysis, process tracing and system health monitoring. In particular, the procps, sysstat, iproute2, numactl, bpfcc-tools, bpftrace, perf-tools-unstable, trace-cmd, nicstat, ethtool, tiptop and sysprof packages have been added, which are combined into the performance-tools meta-package.
• Settings for active repositories have been converted to use the deb822 format and moved from /etc/apt/sources.list to the file /etc/apt/sources.list.d/ubuntu.sources.
• Services are now restarted after installing updates to their associated libraries, even if the updates are installed automatically in unattended-upgrade mode. To prevent the service from automatically restarting after an update, add it to the override_rc section in the /etc/needrestart/needrestart.conf file.
• The work of the Power Profiles Manager has been improved, adding support for new hardware power management mechanisms available in AMD processors, and also adding the ability to use different optimization drivers. When working in offline mode, the optimization level is automatically increased.
• The fprintd package and the libfprint library have been updated to include support for additional fingerprint scanning devices.
• A thinner version of the Ubuntu font is used. To return the old system font, you can install the fonts-ubuntu-classic package.
• Added support for the QAT (QuickAssist Technology) accelerator built into Intel processors, which offers tools to speed up calculations used in compression and encryption. To use Intel QAT, the packages included are qatlib 24.02.0, qatengine 1.5.0, qatzip 1.2.0, ipp-crypto 2021.10.0 and intel-ipsec-mb 1.5-1.

• Packages for the 32-bit Armhf architecture have been converted to use the 64-bit time_t type. The change affected more than a thousand packages. The previously used 32-bit time_t type cannot be used to handle times later than January 19, 2038, due to the overflow of the seconds counter since January 1, 1970.
• Updated assemblies for Raspberry Pi 5 (server and user) and StarFive VisionFive 2 (RISC-V) boards.
• Ubuntu Cinnamon uses the Cinnamon 6.0 user environment with initial support for Wayland.
• Support for transferring settings using cloud-init has been added to the Ubuntu build for the WSL subsystem (Windows Subsystem for Linux).
• Xubuntu continues to supply environments based on Xfce 4.18.
• Ubuntu Mate continues to ship the MATE 1.26.2 desktop environment (the 1.28 branch is already available in the MATE repository, which has not yet been officially announced). A new installer is used, similar to that offered in Ubuntu Desktop. Instead of the Firmware Updater application, GNOME Firmware is used to update firmware, and instead of Software Boutique, App Center has been added to manage application installations. The MATE Welcome app has been discontinued.
• Ubuntu Budgie uses the Budgie 10.9 desktop environment. Many applets and mini-applications have been updated. A new Budgie Control Center configurator has been introduced. Instead of GNOME Software, App-Center is used to manage applications. Pulseaudio has been replaced by Pipewire. Replaced some default applications, for example, GNOME-Calculator → Mate Calc, GNOME System Monitor → Mate System Monitor, Evince → Atril, GNOME Font Viewer → font-manager, Cheese → guvcview, Celluloid → Parole, Rhythmbox → Lollypop + Goodvibes + gpodder . Removed GNOME-Calendar, GNOME System Monitor and GNOME Screenshot from the base distribution.
• Kubuntu continues to ship KDE Plasma 5.27.11, KDE Frameworks 5.115 and KDE Gear 23.08 by default. KDE 6 will be offered in the fall release of Kubuntu 24.10. Updated logo and color scheme.
• In Lubuntu, the installer based on the Calamares framework has been improved. Added a page for configuring installation options, such as installing available updates, installing codecs and proprietary drivers, and installing additional programs. Added minimal, full and normal installation modes. The first boot screen has been added, allowing you to configure the language and connection to the wireless network, as well as choose to launch the installer or switch to Live mode. Added Bluetooth Manager and SDDM display manager settings editor. The desktop environment has been updated to LXQt 1.4.
• Ubuntu Studio has added the Ubuntu Studio Audio Configuration utility to configure PipeWire settings. A new installer is used, similar to that offered in Ubuntu Desktop. Added meta-package for installing programs useful for teaching music, such as FMIT, GNOME Metronome, Minuet, MuseScore, Piano Booster, Solfege.

Source: opennet.ru