142 lines
5.7 KiB
XML
142 lines
5.7 KiB
XML
<section xmlns="http://docbook.org/ns/docbook"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink"
|
|
xmlns:xi="http://www.w3.org/2001/XInclude"
|
|
version="5.0"
|
|
xml:id="sec-release-16.09">
|
|
|
|
<title>Release 16.09 (“Flounder”, 2016/09/??)</title>
|
|
|
|
<para>In addition to numerous new and upgraded packages, this release
|
|
has the following highlights: </para>
|
|
|
|
<itemizedlist>
|
|
|
|
<listitem>
|
|
<para>PXE "netboot" media has landed in <link xlink:href="https://github.com/NixOS/nixpkgs/pull/14740" />.
|
|
See <xref linkend="sec-booting-from-pxe" /> for documentation.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Xorg-server-1.18.*. If you choose <literal>"ati_unfree"</literal> driver,
|
|
1.17.* is still used due to ABI incompatibility.</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
|
|
<para>The following new services were added since the last release:</para>
|
|
|
|
<itemizedlist>
|
|
<listitem><para><literal>(this will get automatically generated at release time)</literal></para></listitem>
|
|
</itemizedlist>
|
|
|
|
|
|
<para>When upgrading from a previous release, please be aware of the
|
|
following incompatible changes:</para>
|
|
|
|
<itemizedlist>
|
|
|
|
<listitem>
|
|
<para>A large number of packages have been converted to use the multiple outputs feature
|
|
of Nix to greatly reduce the amount of required disk space. This may require changes
|
|
to any custom packages to make them build again; see the relevant chapter in the
|
|
Nixpkgs manual for more information. (Additional caveat to packagers: some packaging conventions
|
|
related to multiple-output packages
|
|
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/14766">were changed</link>
|
|
late (August 2016) in the release cycle and differ from the initial introduction of multiple outputs.)
|
|
</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Shell aliases for systemd sub-commands
|
|
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/15598">were dropped</link>:
|
|
<command>start</command>, <command>stop</command>,
|
|
<command>restart</command>, <command>status</command>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Redis now binds to 127.0.0.1 only instead of listening to all network interfaces. This is the default
|
|
behavior of Redis 3.2</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>/var/setuid-wrappers/
|
|
<link xlink:href="https://github.com/NixOS/nixpkgs/pull/18124">is now a symlink so
|
|
it can be atomically updated</link>
|
|
and it's not mounted as tmpfs anymore since setuid binaries are located on /run/ as tmpfs.
|
|
</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>Gitlab's maintainence script gitlab-runner was removed and split up into the more clearer
|
|
gitlab-run and gitlab-rake scripts because gitlab-runner is a component of Gitlab CI.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><literal>services.xserver.libinput.accelProfile</literal> default
|
|
changed from <literal>flat</literal> to <literal>adaptive</literal>,
|
|
as per <link xlink:href="https://wayland.freedesktop.org/libinput/doc/latest/group__config.html#gad63796972347f318b180e322e35cee79">
|
|
official documentation</link>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><literal>fonts.fontconfig.ultimate.rendering</literal> was removed
|
|
because our presets were obsolete for some time. New presets are hardcoded
|
|
into freetype; one selects a preset via <literal>fonts.fontconfig.ultimate.preset</literal>.
|
|
You can customize those presets via ordinary environment variables, using
|
|
<literal>environment.variables</literal>.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>The <literal>audit</literal> service is no longer enabled by default.
|
|
Use <literal>security.audit.enable = true;</literal> to explicitly enable it.</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para>
|
|
<literal>pkgs.linuxPackages.virtualbox</literal> now contains only the
|
|
kernel modules instead of the VirtualBox user space binaries.
|
|
If you want to reference the user space binaries, you have to use the new
|
|
<literal>pkgs.virtualbox</literal> instead.
|
|
</para>
|
|
</listitem>
|
|
|
|
<listitem>
|
|
<para><literal>goPackages</literal> was replaced with separated Go applications
|
|
in appropriate <literal>nixpkgs</literal> categories. Each Go package uses its own
|
|
dependency set defined in nix. There's also a new <literal>go2nix</literal>
|
|
tool introduced to generate Go package definition from its Go source automatically.</para>
|
|
</listitem>
|
|
|
|
</itemizedlist>
|
|
|
|
|
|
<para>Other notable improvements:</para>
|
|
|
|
<itemizedlist>
|
|
|
|
<listitem><para>Revamped grsecurity/PaX support. There is now only a single
|
|
general-purpose distribution kernel and the configuration interface has been
|
|
streamlined. Desktop users should be able to simply set
|
|
<programlisting>security.grsecurity.enable = true</programlisting> to get
|
|
a reasonably secure system without having to sacrifice too much
|
|
functionality. See <xref linkend="sec-grsecurity" /> for documentation
|
|
</para></listitem>
|
|
|
|
<listitem><para>Special filesystems, like <literal>/proc</literal>,
|
|
<literal>/run</literal> and others, now have the same mount options as
|
|
recommended by systemd. They are now unified across different places in NixOS.
|
|
Options are also updated on the system switch if possible. One benefit from
|
|
this is improved security -- most such filesystems are now mounted with
|
|
<literal>noexec</literal>, <literal>nodev</literal> and/or
|
|
<literal>nosuid</literal> options.</para></listitem>
|
|
|
|
<listitem><para>The reverse path filter was interfering with DHCPv4 server
|
|
operation in the past. An exception for DHCPv4 and a new option to log
|
|
packets that were dropped due to the reverse path filter was added
|
|
(<literal>networking.firewall.logReversePathDrops</literal>) for easier
|
|
debugging.</para></listitem>
|
|
|
|
</itemizedlist>
|
|
|
|
|
|
</section>
|