Home Blog Page 471

Linux Kernel Long Term Support Extended to 6 Years for Project Treble

Yesterday at Linaro Connect, Project Treble’s lead engineer Iliyan Malchev announced that Greg Kroah-Hartman, the current maintainer of the LTS kernels for the Linux Foundation, has agreed to extend the support period for LTS kernels from 2 years to 6 years. And this isn’t some far of in the future idea, the new Extended LTS (ELTS or XLTS) will start with Linux kernel 4.4.

This is a great change for everybody in the Linux community as it will not only apply to Android but to Linux on the desktop and more importantly to Linux servers. It will be interesting to see what companies like Ubuntu and Red Hat now do with the LTS versions of their distributions.

Read more at Android Authority

This Week in Open Source News: 4 Ways to Build an Open Source Community, Change Healthcare Working With Hyperledger & More

This week in Linux and open source news, the Open Community Conference at Open Source Summit NA earlier this month provided useful ways to build open communities within an existing company, and more! read on to stay in the open source know.

1) Jono Bacon chaired the Open Community Conference at Open Source Summit North America. This list shares community management takeaways from one of his talks.

Four Ways to Build an Open Source Community in Your Company– Superuser

2) Change Healthcare CEO Neil de Crescenzo stated that the company is working together with both customers and organizations, such as the Linux Foundation’s Hyperledger Project, to [increase] access to blockchain technology.

Change Healthcare Announces Enterprise Blockchain Solutions on Hyperleger Fabric– Nasdaq

3) Dan Cauchy of AGL shares how The Linux Foundation community is building an open source platform so that can serve as the de facto industry standard.

How Open Source is Transforming the Automotive Industry– AutoBodyNews.com

4) “A critical flaw in the Linux kernel has finally been patched, two years after it was first discovered.”

Linux Kernel Bug Enabled Privilege Escalation – Fixed After 2 Years– SC Magazine UK

5) React to be licensed under the MIT open source license

Facebook Buckles Under Pressure Over Hated React License– InfoWorld

Linking Commits to Reviews

In a talk in the refereed track of the 2017 Linux Plumbers Conference, Alexandre Courouble presented the email2git tool that links kernel commits to their review discussion on the mailing lists. Email2git is a plugin for cregit, which implements token-level history for a Git repository; we covered a talk on cregit just over one year ago. Email2git combines cregit with Patchwork to link the commit to a patch and its discussion threads from any of the mailing lists that are scanned by patchwork.kernel.org. The result is a way to easily find the discussion that led to a piece of code—or even just a token—changing in the kernel source tree.

Courouble began with a short demo of the tool. It can be accessed by typing (or pasting) in a commit ID on this web page, which brings up a list of postings of the patch to various mailing lists; following those links shows the thread where it was posted (and, often, discussed). Another way to get there is to use cregit; navigating to a particular file then clicking on a token will bring up a similar list that relates to the patch where the symbol was changed. Note that the Patchwork data only goes back to 2009, so commits before that time will not produce any results.

Read more at LWN

Librem 5 Leads New Wave of Open Source Mobile Linux Contenders

Just when it seemed that the dream for an open source Linux phone had run its course, several new hardware and software projects have emerged, and some older projects have sought new life as aftermarket replacements. The biggest news in recent weeks was the endorsement by the KDE project and GNOME Foundation for Purism’s new open source Librem 5 phone. Also, Raspberry Pi lovers are anticipating the upcoming Crowd Supply campaign for RPi Zero based ZeroPhone project.

Projects focusing primarily on open source Linux firmware replacements for older Android phones include the Halium OS project, which is setting itself up as sort of a Yocto-style project for standardizing mobile Linux components. There’s also an early-stage PostmarketOS project focused on long lifecycle updates (see farther below).

Unlike many of the failed Linux phone projects that emerged earlier this decade, none of these projects are backed by major corporations. That lack of financial clout combined with the strength of the well-entrenched Android and iOS platforms, would seem to doom these projects from the start. Yet, boosters point to embedded hardware projects like the Raspberry Pi Foundation as a guiding light. Perhaps the Pi thrived in part due to its grassroots nature and the lack of a major corporation to screw it up.

Others argue that the battle has already been won. According to IDC, the Linux-based Android represented 85 percent of the global smartphone market in the first quarter. Android is more open source than almost any successful tech standard in consumer electronics history.

Yet, Android includes a lot of proprietary components, and there’s very little transparency or  inclusiveness in the project’s governance. Google decides what it wants, and that’s that. True, their generally top-notch work pops out the other side as fully open source Android Open Source Project (AOSP) code, but it doesn’t come free with the cool stuff like Google Maps, Google Assistant, and especially Google Play. In addition, much of the codebase is out of step with mainstream Linux, and there are always the ongoing complaints about security, privacy, fragmentation, lack of timely updates, and corporate intrusion.

A decade ago, we began to see alternative, open source mobile Linux projects starting with OpenMoko and the related Greenphone, and then LiMo and the Moblin/MeeGo/Mer variants. These were followed by Firefox OS, Tizen, Sailfish, and Ubuntu Touch.

In recent years, most of these projects came crashing down. First, there was the collapse of Firefox OS, and then the death of the Ubuntu Phone. Between these two discontinuations, struggling Finnish firm Jolla gave up on its Sailfish based hardware and turned to software. Samsung is still selling Tizen phones in Asia, but the focus is increasingly on Tizen smartwatches and consumer electronics.

Can the new players do any better? Here’s a closer look at the new wave of open source mobile Linux projects:

Librem 5

Purism’s privacy-minded, 5-inch Librem 5 smartphone began crowdfunding in late August. With 24 days left, it’s more than halfway toward its ambitious $1.5 million goal.

The campaign got a boost in recent weeks from endorsements by the two major Linux desktop projects. First KDE announced it was working to bring its open source Plasma Mobile aftermarket distribution to the Librem 5, and then the GNOME Foundation said it was porting the GNOME/GTK desktop to the platform.

Assuming Purism gets its funding, the Librem 5 phone will ship as early as January with a version of the PureOS distribution that already runs on Purism’s Librem laptops. PureOS is a derivative of Debian that defaults to a GNOME 3 desktop with Wayland. The stack includes a homegrown PureBrowser with the Tor browser, the Duck Duck Go search engine, the EFF Privacy Badger, and HTTPS: Everywhere.

Promoted as the world’s first ever IP-native mobile handset, the unlocked Librem 5 offers end-to-end encrypted decentralized communication that covers calls, texts, and emails. The phone supports VPN services, and provides hardware kill switches for the front and back cameras, microphone, WiFi/Bluetooth radio, and baseband. The phone is equipped with 3GB of LPDDR3, 32GB eMMC, microSD, SIM, GPS, USB, and sensors.

Under the hood, you’ll find NXP’s quad-core Cortex-A9 i.MX6, which is far less powerful than mid-range Android phone SoCs. Yet, the i.MX6 has the advantages of low power consumption, widespread familiarity among developers, and a Vivante GPU supported by the open Etnaviv accelerated driver. Purism plans to move to the quad -A53 i.MX8, but the SoC has been delayed.

The Librem 5’s design separates the CPU from the baseband modem, letting developers “dig deeper and deeper to protect your privacy and isolate components for a strong security hardware stack,” says Purism. The company also plans to remove as many proprietary components as possible, and eventually open source the hardware.

ZeroPhone

The ZeroPhone was announced in January as a DIY Hackaday project. It’s launching soon on Crowd Supply, which already has a landing page. The open hardware ZeroPhone is based on open source hardware including the Raspberry Pi Zero, Espressif’s ESP8266 WiFi module, and an ATMega328P MCU borrowed from an Arduino Pro Mini. Together with other off-the-shelf components, the parts add up to only $50.

The current design is limited to a 1.3-inch, 128×64-pixel screen, but you can attach a monitor, keyboard, and mouse. It’s also limited to 2G GSM, with plans to move soon to 3G. Like the Librem 5, the ZeroPhone offers hardware switches, in this case for GSM, WiFi, and mic. Other features include extended batteries, 5- and 8-megapixel cameras, sensors, GPS, microSD, IR, and even Ethernet.

The Python-built interface offers root access to Raspbian Linux, which opens up a wide variety of applications. The stack provides security features, as well as automatic updates.

Linux mobile software projects: LuneOS, Sailfish X, PostmarketOS, Halium OS, etc.

The advantage of open source is never having to accept total defeat. Firefox OS, Ubuntu Touch, and other mobile Linux distros are still available for tinkering, and conceivably a company could swoop in and back the projects with major funding.  Even the old Palm/HP WebOS, which is used by LG in its smart TVs, is now available in an open source LuneOS distro backed by PivotCE.

Designed as an OS replacement for Android phones and legacy HP WebOS devices, LuneOS provides a WebOS-like GUI built on Linux, Android, and Qt. The project seems to have picked up where the defunct Open WebOS left off.

Meanwhile, Jolla may have given up on its Jolla phone and tablet, but it’s still pushing its Mer-based Sailfish OS. Recently, Jolla partnered with Sony to offer Sailfish on the Android-based Sony Xperia X phone. It’s part of a Sony Open Devices Program that emerged from Sony’s earlier collaborations with AOSP.

The final, flashable “Sailfish X” build was set for release on Sept. 27, but has been postponed to Oct. 4. The code for DIY development was extremely buggy, according to Sept. 24 XDA-Developers post

Another major software project, called PostmarketOS, is building a lightweight, touchscreen-friendly distro based on Alpine Linux. The project aims to keep your old Android phone alive with a 10-year support lifecycle. By comparison, the AOSP-based Android mods from LineageOS — the fork of the discontinued CyanogenMod — offers updates only for up to three years — if you’re lucky.

To enable such updates across multiple devices, the early stage PostmarketOS project is attempting to build a single kernel for all supported Android devices. It’s currently limited to very basic boot functionality on eight Nexus phones and other major models.

Alpine Linux requires only 5-6MB, according to this recent PostmarketOS report from Fossbytes. The story notes that Google is working on fixing the update problem on old Android phones with its Project Treble, but that, too, is an early stage project, and it doesn’t fix the root problem. Besides, many users are looking to be free of Google’s reach beyond any desire for frequent updates.

Finally, a new Halium Project is taking a different tack on the related issue of fragmentation. As explained in this CIO story, the project’s early-stage Halium OS is not a distribution, but a mobile framework designed to reduce coding duplication and fragmentation in a variety of mobile Linux distros.

For example, LuneOS, Mer, Plasma Mobile, SailfishOS, Ubuntu Touch, and AsteroidOS (for smartwatches), are all Linux distributions that offer varying levels of Android support. To do this, they all use libhybris to interact with Android blobs, but they all deploy it differently.

The Halium Project aims to standardize these libhybris interactions, as well as a common mobile Linux kernel and Android HAL layer. This would enable each project to differentiate on a top layer that sits on standardized mobile middleware, the Android HAL, and the underlying Linux kernel.

In many ways, Halium OS has the same goals as the old LiMo framework, some of which forms the basis of Tizen. The difference is that LiMo was developed primarily by mobile carriers while Halium is being built by open source developers. More modern equivalents would be the Yocto Project and Linaro.

Finally, there are plenty of specialized Android phones — and open source Android replacement distributions like LineageOS or Replicant — to consider as alternatives to standard commercial phones. Most of the phones are “hardened” security phones that are in some cases even less open source than Android. Secure Android phones include Bittium’s Bittium Tough Mobile, Silent Circle’s Blackphone 2, Motorola Solutions’s LEX L10, Sikur’s GranitePhone, TRI’s Turing Phone, and Sonim’s XP7 Public Safety.

Connect with the embedded Linux community at Embedded Linux Conference in Prague. You can view the schedule hereLinux.com readers receive an additional $40 off with code OSSEULDC20. Register Now!
 

Mesosphere DC/OS Brings Large-Scale Real-Time Processing to Geospatial Data

All of a sudden, the planet Earth has become one of the world’s most important sources of real-time data. So the business of gathering that data — climate information, travel and commuting data, crime statistics, sporting event attendance, freeway traffic — is growing on behalf of the growing number of academic institutions, research facilities, emergency response teams, humanitarian and relief organizations, and intelligence agencies (yes, they’re growing too).

These use cases require a scale that goes beyond what traditional enterprise infrastructures offer. This means an increasing need for high throughput, no latency and a next-generation degree of orchestration to process weather data, freeway traffic and any other information from infinite nodes that are programmatically capable of capturing and delivering data for analysis.

What’s emerging is the need for platforms that absorb input from these nodes, process the data securely and do so in isolation.

Read more at The New Stack

Tools and Practices for Documenting Microservices

I will assume you are at least familiar with the concept of microservices — loosely coupled services that provide discrete solutions to business use cases that you can combine to solve current needs and demand. The architectural pattern has gained popularity over the past years, and although not everyone is completely sure what “doing it right” looks like, it’s a concept that suits modern needs and is here to stay for the foreseeable future.

I help organize the Write the Docs (a global community for those interested in technical documentation) group in Berlin. Over the past month, multiple people asked me about what tools and practices I recommend for documenting microservices and application architectures that use the pattern.

Some light Googling later, I found others asking the same question, but no concrete recommendations, so thought it was time to set ideas down. I intend this post to set out the problem, pose some solutions and provoke discussion for those in the field. These are merely my musings, but together we can determine what best practice might be, and create ideas for actual tooling to help.

Read more at Codeship

What’s New in MySQL 8.0

MySQL, the popular open-source database that’s a standard element in many web application stacks, has unveiled the first release candidate for version 8.0.

Features to be rolled out in MySQL 8.0 include:

  • First-class support for Unicode 9.0 out of the box.
  • Window functions and recursive SQL syntax, for queries that previously weren’t possible or would have been difficult to write.
  • Expanded support for native JSON data and document-store functionality.

Read more at InfoWorld

Network Functions Virtualization: All Roads Lead to OPNFV

Previously in our discussion of the Understanding OPNFV book, we provided an introduction to network functions virtualization (NFV) and explored the role of OPNFV in network transformation. We continue our series with a look at chapters 4 and 5, which provide a comprehensive description of the various open source NFV projects integrated by OPNFV and the carrier grade features contributed back to these upstream projects by the community. In this article, we cover these two topics briefly and provide some related excerpts from the Understanding OPNFV book.

OPNFV Book

For those less familiar with OPNFV, according to the OPNFV website:                                       

Open Platform for NFV (OPNFV) facilitates the development and evolution of NFV components across various open source ecosystems. Through system level integration, deployment and testing, OPNFV creates a reference NFV platform to accelerate the transformation of enterprise and service provider networks.       

OPNFV is the only open source project that integrates, deploys, and tests a wide range of open source NFV projects on a continuous basis. If you believe that open source is the future of NFV, then OPNFV is a project you definitely want familiarize yourself with.

OPNFV integrates a wide range of networking, SDN and NFV open source projects.

The list of projects integrated by OPNFV includes the following categories:

  • NFV infrastructure (NFVI)

    • Hardware

    • Virtual compute

    • Virtual storage

    • Virtual networking and dataplane acceleration

  • Virtualized infrastructure manager (VIM)

  • SDN Controller

  • Management and network orchestration (MANO)

More details on the various projects in each category are outlined in the book. For example, here is an excerpt on the OpenDaylight project:

OpenDaylight

OpenDaylight.

Like OPNFV, OpenDaylight (ODL), is also a Linux Foundation project. It is a full blown modular SDN controller that caters to multiple use cases such as NFV, IoT, and enterprise applications. It supports numerous southbound interfaces to manage virtual and physical switches (OpenFlow, Netconf and other protocols). For the northbound interface to OpenStack or other orchestration layers, ODL uses YANG (a standard modeling language) models to describe the network, various functions, and the final state. The ODL community is large, with Brocade, Cisco, Ericsson, HPE, Intel, and Red Hat being just a few of the companies supporting the initiative.

In addition to integrating upstream projects, the OPNFV community plays a critical role by identifying carrier grade feature gaps, developing code to fill those gaps and contributing the code back to respective upstream projects. The book discusses 24 OPNFV feature development projects and groups them into the following four categories:

  • Service assurance and availability

  • Easing integration of upstream projects

  • Deployment and lifecycle management

  • Documentation and security

The book describes each of the 24 projects. For example:

NFV-KVM  The NFV-KVM project focuses on the KVM hypervisor in the NFVI and develops requirements and collaborates with the upstream community to achieve this integration. By using real-time KVM, the community has shown a 10x improvement in small packet performance.

One of the more important feature development projects is OPNFV Doctor that provides an  NFV service assurance framework. As with other feature development projects, the OPNFV Doctor project develops and contributes service assurance features directly to the upstream projects, in this case OpenStack Congress, Nova, Neutron, and Cinder.

Fault management event flow with OPNFV Doctor and OpenStack Vitrage.

Want to learn more? You can check out the previous blog post that discussed the broader NFV transformation complexities  and how OPNFV solves an important piece of the puzzle, download the Understanding OPNFV ebook in PDF (in English or Chinese), or order a printed version on Amazon.

In Joining Cloud Native Computing Foundation, SAP Steps Up Its Open Source Commitment

SAP has joined the Cloud Native Computing Foundation as the sixth Platinum level member to join so far this fall. This comes on the heels of the company joining The Linux Foundation’s Open API Initiative on September 24.

SAP is one of the largest and most important makers of enterprise software in the world today. And their increasing participation in the open source software (OSS) ecosystem shows their growing commitment to open source and underscores the value that OSS brings to businesses – even businesses with significant proprietary software revenue lines.

Read more at The Linux Foundation

 

CII Audit Identifies Most Secure NTP Implementation

Since its inception the CII has considered network time, and implementations of the Network Time Protocol, to be “core infrastructure.” Correctly synchronising clocks is critical both to the smooth functioning of many services and to the effectiveness of numerous security protocols; as a result most computers run some sort of clock synchronization software and most of those computers implement either the Network Time Protocol (NTP, RFC 5905) or the closely related but slimmed down Simple Network Time Protocol (SNTP, RFC 4330).

The CII recently sponsored a security audit of the Chrony code, carried out by the security firm Cure53 (here is the report). In recent years, the CII has also provided financial support to both the ntpd project and the NTPSec project. Cure53 carried out security audits of both ntpd and NTPSec earlier this year and Mozilla Foundation’s Secure Open Source (SOS) project funded those two audits. SOS also assisted the the CII with the execution of the Chrony audit.

Since the CII has offered support to all three projects and since all three were reviewed by the same firm, close together in time, we thought it would be useful to present a direct comparison of their results.

Read more at The Linux Foundation