Wiki - https://fedoraproject.org/wiki/Changes/ReproduciblePackageBuilds
Discussion.fpo -
https://discussion.fedoraproject.org/t/f41-change-proposal-reproducible-pac…
== Summary ==
A post-build cleanup is integrated into the RPM build process so that
common causes of build irreproducibility in packages are removed,
making most of Fedora packages reproducible.
== Owner ==
* Name: Davide Cavalca
* Name: Neil Hanlon
* Name: [[User:churchyard|Miro Hrončok]]
* Name: [[User:zbyszek|Zbigniew Jędrzejewski-Szmek]]
* Email: dcavalca(a)fedoraproject.org
* Email: neil at shrug.pw
* Email: mhroncok at redhat.com
* Email: zbyszek at in.waw.pl
== Detailed Description ==
As of 2023 there is an active effort to implement
[https://docs.fedoraproject.org/en-US/reproducible-builds/
Reproducible builds] in Fedora. Reproducible builds will allow our
users to be able to independently verify that the RPMs have not been
tampered with (either maliciously or via hardware/software fault):
someone can do an independent rebuild of a package and confirm that
they get identical binaries when building with the same versions of
the compiler and other tools. This Change allows us to move forward in
this direction by removing the common sources of irreproducibility.
[https://github.com/keszybz/add-determinism add-determinism] is a Rust
program which, as its name suggests, adds determinism to files that
are given as input by attempting to standardize metadata contained in
binary or source files to ensure consistency and clamping to
$SOURCE_DATE_EPOCH in all instances. `add-determinism` is the "Fedora
version" of [https://salsa.debian.org/reproducible-builds/strip-nondeterminism
strip-nondeterminism] from the Debian project. Since
strip-nondeterminism is written in perl, it is undesirable for use in
Fedora, as we don't want to pull perl in the buildroot for every
package.
It's worth noting that this Change does not intend to impose any
specific reproducibility requirements on Fedora packages. Once this
Change is implemented and we have been through a mass rebuild and can
verify that the common causes of irreproducibility have indeed been
removed, we can consider further steps. But that will be at least one
release later.
This change does add a small amount of time to the processing of RPMs
at the end of a build. Accordingly, packages containing large
quantities or sizes of files can be slower, but this effect is not
expected to be noticeable. `add-determinism` takes steps to ensure it
does not interfere with other buildroot post processors like
`mangle-shebangs`, `python-hardlink`, `python-bytecompile`. It
defaults to not doing any modifications in case it doesn't understand
the input file or there are any other problems.
A mechanism to opt-out will be provided: to either completely disable
the postprocessing step or to disable specific "handlers" (i.e.
implementations of cleanup for specific file types, for example static
archives). See [https://github.com/keszybz/add-determinism/blob/main/rpm/macros.build-repro…
macros.build-reproducibility].
=== Related Changes ===
* [https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes
Clamp build mtimes to SOURCE_DATE_EPOCH]
* [https://fedoraproject.org/wiki/Changes/RPM-4.20 RPM 4.20] — this
pulls in changes to `%autosetup -S git` which removed a source of
irreproducibility.
== Feedback ==
== Benefit to Fedora ==
Adding determinism (i.e., removing non-determinsim) enables the Fedora
community to have confidence that, if given the same source code,
build environment, build instructions, and metadata from the build
artifacts, any party can recreate copies of the artifacts that are
identical except for the signatures and some parts of metadata.
Reproducibility of builds leads to packages of higher quality. It
turns out that quite often those irreproducible bits are caused by an
error or sloppiness in the code. In particular, any dependence on
architecture in noarch packages is almost always unwanted and/or a
bug. Test builds that check reproducibility will expose such
instances.
Reproducibility of builds makes it easier to develop packages: when a
small change is made and a package is rebuilt (in the same
environment), then with a reproducible package, the only difference is
directly caused by the change. If the package is different every time
it is rebuilt, making a comparison is much harder.
Build reproducibility for noarch ''sub''packages solves the problem
where package builds on different architectures are different, causing
mock to reject the whole build. In particular, this issue occurs for
[https://docs.fedoraproject.org/en-US/packaging-guidelines/Python_Appendix/#…
pyc files]. This will now be solved without requiring opt-in from
individual packages.
== Scope ==
* Proposal Owners:
** Integrate `add-determinism` as a BuildRoot Policy script
** Add a dependency on `marshalparser` to `python3` (probably
conditionalized on `rpm-build`)
* Other Developers:
** Test their packages with the additional phase, report problems
** Potentially integrate changes to packages to enable reproducibility
* Release Engineering: Ideally we want this to happen before the mass
rebuild, but that is not strictly required.
* Policies and Guidelines: Fedora Packaging Guidelines should be
updated to include information on the add-determinism BuildRoot
Policy. User documentation should be amended to include instructions
on how to verify reproducibility for a given package, and what
packages are known to be non-reproducible, and how to opt-out.
* Trademark approval: N/A (not needed for this Change)
* Alignment with Community Initiatives: All software and requests are
consistent with the decision process and similar across other groups
in Fedora. The Fedora Reproducibility Working group began at Flock
2023 in Cork.
== Upgrade/compatibility impact ==
No impact is expected.
== How To Test ==
To test on the level of individual files:
* install `add-determinism`
* call `SOURCE_DATE_EPOCH=… add-determinism -v ./path/to/file`
To test package builds:
* build a local copy of `redhat-rpm-config` with
https://src.fedoraproject.org/rpms/redhat-rpm-config/pull-request/293
* install `add-determinism`
* build packages ;)
(This can be done on a normal system or in a mock chroot.)
== User Experience ==
No impact is expected.
== Dependencies ==
== Contingency Plan ==
* Contingency mechanism:
** In case of major problems, disable the change in `redhat-rpm-config`.
** In case of problems with specific packages, opt-out by setting a macro.
* Contingency deadline: No limit really.
* Blocks release? No.
== Documentation ==
* [https://docs.fedoraproject.org/en-US/reproducible-builds/ Fedora
Reproducible Builds]
* [https://github.com/keszybz/add-determinism/blob/main/rpm/macros.build-repro…
add-determinism macros.build-reproducibility]
* [https://github.com/keszybz/add-determinism/tree/main?tab=readme-ov-file#bui…
add-determinism README]
== Release Notes ==
Fedora package builds are now more deterministic, bringing the
distribution closer to the goal of achieving fully reproducible builds
for all of its packages.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/SwitchToDnf5
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Change the default package manager from dnf to dnf5.
== Owner ==
* Name: [[User:jkolarik| Jan Kolarik]]
* Email: jkolarik(a)redhat.com
* Name: [[User:jmracek| Jaroslav Mracek]]
* Email: jmracek(a)redhat.com
== Detailed Description ==
This proposal will implement several topics, which are outlined below.
=== Provider of the dnf command ===
This change proposes to switch the current provider of the
/usr/bin/dnf symlink from dnf to dnf5. Currently, the symlink target
is /usr/bin/dnf-3, provided by the dnf sub-package, python3-dnf. Upon
implementation of this change, the symlink will point to
/usr/bin/dnf5, provided by the dnf5 package.
=== Prepare the upgrade path ===
The dnf5 package, serving as the new provider of the /usr/bin/dnf
symlink, will obsolete the dnf package starting with Fedora 41. Upon
the release of this dnf5 package, upgrading the system or installing
dnf5 will replace the existing dnf package on the system.
Additionally, the dnf5 package will provide a /usr/bin/yum symlink for
backwards compatibility and the dnf-automatic command will be
obsoleted.
=== Feature parity with dnf ===
We aim to cover the majority of use cases available in the existing
dnf package. However, there are some features that may not be
implemented in time. Nevertheless, we plan to deliver them at a later
stage.
==== Plugins ====
The progress of implementing plugins to match the current set from the
dnf-plugins-core package is tracked
[https://github.com/rpm-software-management/dnf5/issues/389 upstream].
Among the missing plugins, we still plan to implement:
* debuginfo-install plugin
* reposync plugin
==== Modularity ====
As support for modularity was retired in Fedora 39, dnf5 currently
only implements a basic feature set for listing and enabling/disabling
modules.
=== Background service support ===
A new daemonized service, dnf5daemon, utilizing the D-Bus interface,
is prepared for clients as a sub-package. This will serve as an
alternative or replacement for the PackageKit layer. Integration of
dnf5daemon support into the default Fedora user interface, GNOME
Software, is currently in progress
=== Documentation of API changes ===
The public interface has undergone significant changes to enhance the
user experience and remove unused and obsolete code components. To
facilitate user migration to the new CLI and API interfaces, a
[https://dnf5.readthedocs.io/en/latest/changes.html guide] was
prepared covering all differences compared to the interface provided
by the existing dnf package, along with examples of typical use cases.
=== Deployment tasks ===
During the deployment of the dnf5 package manager as the new default,
several adjustments need to be made both to the infrastructure and the
dnf5 package itself. Some of these adjustments are detailed [[#Release
engineering|below]]. To ensure synchronization and address all
necessary changes, we've established an upstream tracking
[https://github.com/rpm-software-management/dnf5/issues/1057 issue].
== Feedback ==
As this is the second iteration of such a proposal, we've gathered a
lot of feedback from various sources during the first attempt to
accept this change.
=== FESCo inputs ===
A [https://pagure.io/fesco/issue/3039 ticket] discussing the reasons
why the contingency mechanism was invoked for the first attempt of the
proposal was opened by FESCo. It includes a list of items that are
either incomplete or in progress.
Below is a list of issues from the ticket that are still unresolved or
require clarification on their current status. Other items not
mentioned below are considered completed.
==== Switch in ELN ====
This should not block the proposal, as the current plan is to target
RHEL 11. Integration can occur there after the proposal is implemented
for Fedora 41.
==== Aligning configuration with the current state in dnf ====
All overrides to match the current state of dnf configuration will be
provided to the Fedora release project, see [[#Apply downstream
configuration overrides|below]].
==== System upgrade and offline transactions ====
The implementation work has been completed and is already present
upstream. We anticipate extensive testing during the summer, and we
also plan to organize testing days for this purpose.
==== Dropping the Snapper plugin ====
In dnf5, we've adopted a new approach for implementing functionality
that was previously handled by the Snapper plugin in dnf.
We're introducing the Actions plugin, which offers more capabilities
than the Snapper plugin, including support for running external
applications before or after transactions and interacting with the
dnf5 configuration.
[https://dnf5.readthedocs.io/en/latest/libdnf5_plugins/actions.8.html
Here] is the documentation for the Actions plugin, which includes
examples of how to emulate the behavior of the Snapper plugin.
==== Messages from RPM scriptlets ====
An issue with output from RPM scriptlets is the potential length,
coupled with the absence of a standardized policy for distinguishing
between important and unimportant messages.
Currently, all messages are logged in the dnf5 log files, with
differentiation based on their originating scriptlets, representing an
improvement over dnf. Additionally, in case of transaction errors, the
scriptlet output is included in the standard output. Furthermore,
there is already a resolved [https://pagure.io/koji/issue/4009 ticket]
in the infrastructure to incorporate logs on the builders.
=== Testing days ===
We've already held several dnf5 test days for Fedora
[https://fedoraproject.org/wiki/Test_Day:2023-03-14_Fedora_38_DNF_5
38], [https://fedoraproject.org/wiki/Test_Day:2023-08-11_Fedora_39_DNF_5
39], and recently also
[https://fedoraproject.org/wiki/Test_Day:2024-03-15_Fedora_40_DNF_5
40]. We've made efforts to document all reported issues in our
upstream tracking system, and major issues should now be resolved.
Some of these issues were related to user documentation, improving
command-line outputs, and enhancing overall user experience. These
topics are next on our priority list after completing the
functionality for mandatory commands and plugins.
=== Fedora QA scenarios ===
We've started a discussion
[https://discussion.fedoraproject.org/t/requirements-for-dnf5-in-fedora-41
thread] on the requirements for accepting this proposal from a QA
perspective. A list of relevant test cases and criteria has been
mentioned, which we'll review to ensure we've covered everything on
our end.
=== Fedora CI readiness ===
The dnf project is also deployed in the CI pipeline. We've initiated
communications with this team to ensure that all dnf functionality
used there is either already implemented in dnf5 or can be addressed
through an alternative dnf5 method. We've already received some
feedback from the first iteration of the proposal.
=== Tracking issue upstream ===
When implementing the first iteration of this proposal, we created an
upstream [https://github.com/rpm-software-management/dnf5/issues/635
ticket] to track all bugs or lack of needed functionality. All items
have been addressed, and only several known deployment issues remain,
which need to be managed at the time of the next switch.
== Benefit to Fedora ==
The new dnf5 will significantly improve the user experience and
performance. Detailed descriptions of individual areas are provided
below.
=== Reduced footprint ===
The dnf5 package is a fully-featured package manager that doesn't
require Python dependencies.
It also reduces the number of software management tools in Fedora by
replacing both the dnf and microdnf packages.
The installation size of the dnf5 stack in an empty container is
approximately 60% smaller than the dnf installation.
Currently, dnf, microdnf, and PackageKit use their own cache, leading
to significant metadata redundancy. With dnf5 and dnf5daemon, which
share metadata, this redundancy will be eliminated.
=== Enhanced performance ===
Loading and downloading repository metadata now occur concurrently.
Package query operations, including processing numerous command-line
arguments, have been significantly accelerated.
=== Lowered maintenance costs ===
Many functional duplicates in dnf were eliminated during the
development of the new dnf5 package manager. This was partly because
the integration of the original PackageKit and dnf libraries into the
original libdnf library was never completed.
Plugins are now included in the same package as the core functionality.
=== Unified user experience ===
Consistent user experience is offered to users across servers,
workstations, and containers, as dnf5 is the sole package manager
deployed there. Existing dnf, yum, and microdnf commands will be
linked to dnf5, while compatibility aliases for essential use cases
will be provided to facilitate migration.
Configuration files will be shared among dnf5 components.
API users will encounter unified code style and naming conventions.
Various scripting language interfaces are now provided from a single
source using SWIG bindings (formerly CPython and SWIG).
== Scope ==
=== Proposal owners ===
The remaining work on the proposal can be divided into several sections.
==== Feature implementation ====
===== [https://github.com/rpm-software-management/dnf5/issues/1052
System upgrade] =====
This command is essential for upgrading the system to the next
release. While the implementation is already completed, we plan to
conduct extensive testing, including community participation, to
minimize the risk of issues occurring in production.
===== [https://github.com/rpm-software-management/dnf5/issues/140
History command] =====
The functionality related to manipulating transaction history has not
yet been implemented. However, following the completion of the system
upgrade functionality, it is currently our top priority. Due to the
significant overlap between the functionality in the history command
and the system upgrade functionality, we anticipate its readiness
shortly thereafter.
===== [https://github.com/rpm-software-management/dnf5/issues/169
GNOME Software support] =====
The integration of dnf5 support, particularly dnf5daemon, into GNOME
Software is currently underway. Developers from both DNF5 and GNOME
Software are closely connected and regularly synchronize the progress
of their work.
==== Documentation ====
While our current priority is achieving full coverage of
[https://dnf5.readthedocs.io/en/latest/ user and API documentation],
there may still be some undocumented parts of the code. Please don't
hesitate to [https://github.com/rpm-software-management/dnf5/issues/new
report] any such issues upstream, and we'll endeavor to address them
promptly.
==== Early access for developmental branch users ====
The intention is to implement the proposed changes in the Rawhide
developmental branch prior to the date specified in the Contingency
Deadline section, targeting the transition period between March and
April. It is anticipated that certain mandatory items for the regular
release, as outlined in previous sections, may not be completed by
this time.
===== System upgrade =====
This functionality is unnecessary as Rawhide operates on a rolling
release model.
===== GNOME Software =====
Rawhide users will continue to utilize the current PackageKit backend
connected to the existing libdnf interface until the integration of
dnf5 is finalized. These libraries can coexist with the new dnf5
package on the same system. For more details, see [[#Different system
state|below]].
=== Other developers ===
The following components are already prepared for transition to dnf5:
* [https://github.com/ansible/ansible/issues/78898 Ansible]
* [https://github.com/rpm-software-management/dnf5/issues/66 Lorax]
* [https://github.com/rpm-software-management/mock/issues/894 Mock]
Below is a list of dependencies that have not yet integrated with dnf5.
==== Anaconda ====
Migration to the dnf5 API will not be implemented at this time. After
discussion with the Anaconda team, it was determined that there isn't
sufficient capacity and time to complete the work on schedule.
Therefore, the existing dnf4 Python bindings from the python3-dnf
package will continue to be used for now.
==== GNOME Software ====
This integration is already addressed in the section above, as it
involves collaborative efforts.
=== Release engineering ===
==== Building with dnf5 ====
The Fedora infrastructure has been utilizing dnf5 for building Fedora
40+ chroots since before the Fedora 40 mass rebuilds began. This
implementation was based on the system-wide change outlined
[https://fedoraproject.org/wiki/Changes/BuildWithDNF5 here].
==== Apply downstream configuration overrides ====
Starting with dnf5, distro-specific overrides of the default
configuration values are implemented using
[https://dnf5.readthedocs.io/en/latest/dnf5.conf.5.html#drop-in-configuratio…
drop-in directories]. Options with different values upstream compared
to the current state of dnf in Fedora will be filed in a pull request
against the [https://src.fedoraproject.org/rpms/fedora-release Fedora
release project].
==== Update of kickstarts for image composes ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-kickstarts Fedora Kickstarts project].
==== Update of package groups definitions ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-comps Fedora Comps project].
==== Update of KIWI image descriptions ====
The dnf team will prepare a pull request to include the packages for
the new default dnf5 package manager in the
[https://pagure.io/fedora-kiwi-descriptions Fedora KIWI descriptions
project].
== Upgrade/compatibility impact ==
=== Running the upgrade ===
The dnf5 package will be installed on the system to provide
/usr/bin/dnf, replacing the existing dnf package as it becomes
obsolete. Additionally, the dnf automatic tool will be replaced by the
new dnf5 automatic plugin.
Below is an example of performing this upgrade transaction.
<pre>
$ sudo dnf upgrade
Last metadata expiration check: 0:01:09 ago on Wed 13 Mar 2024 05:48:25 AM EDT.
Dependencies resolved.
================================================================================
Package Arch Version Repository Size
================================================================================
Installing:
dnf5-plugin-automatic x86_64 5.1.14-1.fc41 rawhide 120 k
replacing dnf-automatic.noarch 4.19.0-1.fc40
Upgrading:
dnf-data noarch 4.19.0-1.fc41 rawhide 40 k
python3-dnf noarch 4.19.0-1.fc41 rawhide 551 k
Installing group/module packages:
dnf5 x86_64 5.1.14-1.fc41 rawhide 599 k
replacing dnf.noarch 4.19.0-1.fc40
replacing yum.noarch 4.19.0-1.fc40
Installing dependencies:
fmt x86_64 10.2.1-3.fc40 rawhide 125 k
libdnf5 x86_64 5.1.14-1.fc41 rawhide 991 k
libdnf5-cli x86_64 5.1.14-1.fc41 rawhide 229 k
Installing weak dependencies:
bash-completion noarch 1:2.11-15.fc41 rawhide 360 k
Transaction Summary
================================================================================
Install 6 Packages
Upgrade 2 Packages
</pre>
=== Binaries and symlinks ===
The existing dnf binaries will remain on the system and will be
available at /usr/bin/dnf-3, which refers to the Python 3 version to
which dnf was migrated in the past. Additionally, they will be
accessible at /usr/bin/dnf4, which is a symlink to the dnf-3 script
and denotes the major version of the dnf binary. This binary naming
convention is also used for /usr/bin/dnf5, which will become the
target of the /usr/bin/dnf symlink.
Below is the output of the tree command showing the expected file
structure after the upgrade.
==== Before upgrade ====
<pre>
$ tree /usr/bin/ -P dnf*
/usr/bin/
├── dnf -> dnf-3
├── dnf-3
└── dnf4 -> dnf-3
</pre>
==== After upgrade ====
<pre>
$ tree /usr/bin/ -P dnf*
/usr/bin/
├── dnf -> dnf5
├── dnf-3
├── dnf4 -> dnf-3
└── dnf5
</pre>
=== Different system state ===
Though the RPM DB, which contains the database of installed packages,
remains the singular source in the system, the transactional history
and installed packages reasons in dnf and dnf5 is not shared, and they
now use different formats.
Transactions performed in dnf will not be visible in dnf5, and vice
versa. Therefore, when concurrently using dnf and dnf5 on the system,
packages installed by one of them as dependencies will appear as
user-installed to the other one, potentially leading to them not being
auto-removed later.
While the history database is not migrated to dnf5, when running a
transaction in dnf5 for the first time, an attempt is made to convert
and load the existing system state from dnf. This should preserve
information about the reasons for installed packages and prevent them
from being treated as user-installed, requiring manual removal from
the system instead of being seen as dependencies of explicitly removed
packages.
=== Compatibility ===
While the majority of CLI use cases for managing packages should
remain the same, the dnf5 API has undergone significant changes. To
ease adoption, dnf5 will provide compatibility aliases for commands
and options. Additionally, user output will differ, and we plan to
offer machine-readable support for most commands. For more details,
please refer to the section above.
Applications encountering difficulties with dnf5 adoption can continue
using the existing dnf CLI and API provided by the python3-dnf and
libdnf packages. These libraries can be used in parallel on the
system, but modifying installed software is not recommended due to
differences in system state, as mentioned in the [[#Documentation of
API changes|previous]] section.
== How To Test ==
=== Copr repository ===
[https://copr.fedorainfracloud.org/coprs/rpmsoftwaremanagement/dnf5-testing/
A testing Copr repository] has been set up with dnf5 already deployed
as the default package manager. Instructions on how to proceed are
provided alongside.
=== Quay containers ===
We have also prepared Fedora container images with the dnf5 stack
preinstalled on
[https://quay.io/repository/rpmsoftwaremanagement/fedora-dnf5
quay.io], making it easy to test in isolation with Podman.
=== Side-tag for testing ===
Before pushing the new dnf5 into the Rawhide compose, we plan to
announce the prepared side-tag containing this new package publicly.
This will allow interested parties to test it against their software.
=== Testing days ===
We are planning at least two iterations of testing days before dnf5 is
delivered into Fedora 41. One will focus on testing the overall
functionality of dnf5, with an emphasis on parts that were not tested
during previous testing days. The other iteration will center around
testing the system upgrade functionality.
=== Communication channels ===
Community feedback, including bug reports, issues, or feature
requests, is highly encouraged.
Our primary communication channel is
[https://github.com/rpm-software-management/dnf5 upstream], where you
can report [https://github.com/rpm-software-management/dnf5/issues
issues], participate in
[https://github.com/rpm-software-management/dnf5/discussions
discussions], or even propose
[https://github.com/rpm-software-management/dnf5/pulls pull requests].
We are happy to review them.
Issues specific to a particular version of the dnf5 package can also
be reported through the
[https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=dnf5
Bugzilla] tracking system, which we also monitor.
== User Experience ==
=== Faster query processing ===
The processing of package metadata is now significantly faster.
Executing commands such as repoquery to list packages available in
repositories is now twice as fast compared to dnf. Similarly,
operations like listing dependencies or parsing numerous command-line
arguments are notably expedited, potentially saving users seconds to
tens of seconds in waiting time for the results.
=== Consolidated and streamlined API ===
The API for managing packages, working with repositories, and solving
package dependencies is now consolidated into a single component,
providing a unified solution. The original dnf API underwent a review
process, during which unused workflows and obsolete methods were
removed, while improving usability for users.
=== Enhanced command-line outputs ===
Transaction tables now offer more detailed information, verbose
scriptlet outputs are redirected and organized by package name into
log files, individual commands come with their own man pages, bash
completion has been enhanced, and numerous other improvements have
been made.
== Dependencies ==
=== Owned by our team ===
==== dnf-plugins-core ====
Installed plugins will persist on the system and remain functional
using the dnf4 binary from the python3-dnf package.
With the exception of the system upgrade plugin, all essential plugins
are now implemented in dnf5 and are provided by the dnf5-plugins
package or dnf5 directly.
==== dnf-plugins-extras ====
Installed plugins will persist on the system and remain functional
using the dnf4 binary from the python3-dnf package.
Porting the functionality to dnf5 is currently of low priority, and
its implementation depends more on community involvement. The
functionality of the Snapper plugin is already covered by the dnf5
actions plugin.
=== Requirements on dnf ===
This is the most critical category of packages as issues connected
with them can potentially disrupt the system upgrade path.
Here, we can split components into two groups.
The first group utilizes dnf from the command line interface (CLI),
and thus, they either need to adjust to the new syntax and behavior of
dnf5 or switch to utilizing the existing dnf4 binary directly.
The second group consists of components providing plugins for the dnf
command. These plugins will remain functional using the binary from
python3-dnf, requiring packaging changes to depend on this package
instead.
<pre>
auter
calamares
copr-builder
cpanspec
dnfdragora
etckeeper-dnf
fedora-review
fedora-upgrade
kiwi-systemdeps-core
libdnf-plugin-subscription-manager
lpf
mock
osbuild
perl-CPAN-Plugin-Sysdeps
rbm
rpmdistro-repoquery
supermin
system-config-language
</pre>
A tracking [https://github.com/rpm-software-management/dnf5/issues/418
issue] was created in advance to inform maintainers about the planned
switch to dnf5.
=== Requirements on python3-dnf ===
Here, we can also categorize components into two groups.
The first group consists of components providing plugins for the dnf
command. These plugins will remain functional using the binary from
python3-dnf, requiring packaging changes to depend on this package
instead.
The second group utilizes the dnf’s Python API, and they should not be
directly affected by the change. However, testing is still necessary,
and it is strongly recommended to consider porting to the dnf5 API.
<pre>
anaconda-core
copr-builder
dnf-plugin-diff
dnf-plugin-ovl
dnfdaemon
fedora-easy-karma
fedora-review
fedrq
lorax
mock-core-configs
module-build-service
modulemd-tools
needrestart
policycoreutils-devel
pungi
python3-dnf-plugin-cow
python3-dnf-plugin-flunk_dependent_remove
python3-dnf-plugin-perfmetrics
python3-imgcreate
python3-libreport
retrace-server
subscription-manager
system-config-language
</pre>
=== Requirements on libdnf ===
These packages utilize the libdnf API and should not be directly
impacted by the change. However, testing is still necessary.
Tools that modify system software, such as PackageKit, may exhibit
different behavior when used alongside dnf5 to manage the same system,
as previously described.
Additionally, it is strongly recommended to consider porting to the
dnf5 API in this context.
<pre>
PackageKit
copr-builder
libdnf-plugin-subscription-manager
libdnf-plugin-swidtags
libdnf-plugin-txnupd
</pre>
=== Requirements on python3-hawkey ===
These components utilize unsupported Hawkey Python bindings and should
not be directly impacted by the change. However, thorough testing is
necessary. Again, it is strongly recommended to consider porting to
the dnf5 API in this context.
<pre>
mock-core-configs
modulemd-tools
python3-rpmdeplint
retrace-server
</pre>
== Contingency Plan ==
=== Contingency mechanism ===
To revert to the previous state with dnf as the default package
manager on the system, the following steps would be necessary:
* Packaging changes in dnf5 to remove the obsoletion of dnf and
provider of the /usr/bin/dnf symlink.
* Untagging the candidate dnf5 package from the compose.
* Components that adapted to the dnf5 CLI must synchronize in this
process and revert the changes to use dnf4 again. Proactive
communication will be conducted similarly to how components were
informed about the dnf5 migration.
=== Contingency deadline ===
Branch Fedora Linux 41 from Rawhide
=== Blocks release? ===
No
== Documentation ==
=== [https://dnf5.readthedocs.io/en/latest/index.html Official
documentation] ===
=== [https://github.com/rpm-software-management/dnf5 Upstream project] ===
=== [https://dnf5.readthedocs.io/en/latest/changes.html Changes
between dnf and dnf5] ===
=== [https://dnf5.readthedocs.io/en/latest/dnf_daemon/dnf5daemon_dbus_api.8.html
D-Bus API documentation] ===
=== [https://github.com/rpm-software-management/dnf5/blob/main/CONTRIBUTING.md
Contributing guide for developers] ===
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
We disable building the packages using ENGINE API in OpenSSL without
breaking ABI.
== Owner ==
* Name: [[User:Dbelyavs| Dmitry Belyavskiy]]
* Email: dbelyavs(a)redhat.com
== Detailed Description ==
We are going to deprecate OpenSSL engine support. Engines are not FIPS
compatible and corresponding API is deprecated since OpenSSL 3.0. The
engine functionality we are aware of (PKCS#11, TPM) is either covered
by providers or will be covered soon.
We don't plan to remove the API from libcrypto.so. We are going to
prevent creating the new packages dependent on OpenSSL ENGINE API and
remove ENGINE dependencies from the existing packages.
During discussion of the previous proposal - to completely remove the
ENGINE API - there were many relevant arguments why it shouldn't be
done. We agree with them but still want to deprecate the ENGINE
support to simplify removing it in the earliest release when it's
feasible.
== Feedback ==
== Benefit to Fedora ==
We get rid of deprecated functionality and enforce using up-to-date
API. Engine support is deprecated in OpenSSL upstream, and after
provider migration caused some deficiencies with engine support. No
new features will be added to engine. So we reduce maintenance burden
and potentially attack surface.
It follows approach planned for CentOS 10.
== Scope ==
* Proposal owners: maintainers of packages enumerated here:
https://clang.fedorapeople.org/c10s-engine-users/ plus probably owners
of some Fedora-only packages
For most of the packages the maintainers will just have to rebuild
their packages after the OpenSSL change lands in compose. For several
packages some patches should be implemented to prevent compilation
errors.
* Other developers: -
* Release engineering: [https://pagure.io/releng/issues #Releng issue number]
This change probably requires mass-rebuild.
* Policies and guidelines: We need reject/modify packages providing
OpenSSL engines
* Trademark approval: N/A (not needed for this Change)
* Alignment with Community Initiatives:
== Upgrade/compatibility impact ==
None. Users will be encouraged to switch their configurations to use
providers instead but existing engines will continue working.
== How To Test ==
OpenSSL libcrypto.so exports the same ENGINE_* symbols as for f40.
Applications relying on the ENGINE API can't be built but still work.
== User Experience ==
Users will be encouraged to reconfigure systems to providers if they
use engines. No other changes are expected.
== Dependencies ==
In theory, all OpenSSL-dependent packages. In practice, only those
that explicitly use ENGINE api.
== Contingency Plan ==
Returning the engine header file to allow old applications to be built.
* Contingency mechanism: (What to do? Who will do it?) rebuild
OpenSSL and dependent packages
* Contingency deadline: beta freeze?
* Blocks release? Yes
== Documentation ==
TBD
== Release Notes ==
TBD
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/FedoraPlasmaWorkstation
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Switch the default desktop experience for Workstation to KDE Plasma.
The GNOME desktop is moved to a separate spin / edition, retaining
release-blocking status.
== Owner ==
* Names: [[User:joshstrobl | Joshua Strobl]], [[User:marcdeop | Marc
Deop i Argemí]], [[User:tdawson | Troy Dawson]], [[User:farchord |
Steve Cossette]], [[User:aleasto| Alessandro Astone]]
* Emails: joshua(a)buddiesofbudgie.org, marcdeop(a)fedoraproject.org,
tdawson(a)redhat.com, farchord(a)gmail.com, aleasto(a)fedoraproject.org
== Detailed Description ==
With the release of Plasma 6, KDE Plasma has developed into a high
quality, well-regarded desktop experience.
=== Improved end user experience ===
Plasma has been at the forefront of creating a cohesive desktop
platform that empowers the user to have full ownership of their
computing experience.
Plasma provides this approachable, highly-flexible, user-extensible
experience with predictability across Plasma releases. Unlike other
desktop experiences such as GNOME Shell, the APIs leveraged by Plasma
applets / widgets have been more stable across “minor” Plasma
releases, reducing long-term user frustration and promoting a
healthier ecosystem for developers and users alike.
This extensibility additionally applies to the underlying window
manager, KWin, with effects and scripts that provide both utility and
personalization, such as:
* Automatically blocking compositing for full screen applications
* Fun effects such as window glitch and portals
Plasma provides a more traditional user experience that could be
viewed as being more approachable to everyday computing users, serving
as a smoother "on-ramp" to using Linux-based operating systems.
Alongside its wide breadth of personalization capabilities, it
provides an out-of-the-box desktop experience that is more predictable
than some of its counterparts. As an example, Plasma provides a system
tray for applications supporting StatusNotifierItem (e.g. Flameshot,
OBS Studio, VPN clients), which is not functionality supported by
default in GNOME Shell and requires an extension which may break
between releases.
=== Standardization support ===
The KDE community has a long heritage of collaborative standards
development and supporting capabilities that application developers
and users need for a productive experience.
KDE is heavily involved in the development of cross-desktop standards
and tools that benefit the larger open source desktop community. From
the XDG icon theme specification to D-Bus to StatusNotifierItems and
Wayland protocols, KDE has been front and center for evolving the
Linux desktop platform in a manner that benefits the wider community.
Many of the specifications and protocols in use today originate or are
heavily influenced by KDE, and KDE has continued to be a bastion of
innovation in a user-centric and community-centric manner.
Notably, the following recent Wayland protocols have been driven or
influenced by KDE:
* xdg-toplevel-drag (dragging tabs in and out of windows)
* content-type
* drm-lease (enable applications to selectively gain privileged
display device access)
* tearing-control (enable faster than display framerate refreshing, ie
no “vsync lock”)
* ext-idle-notify
* xdg-activation (enable notifications to bring a window to the
foreground on user activation)
* xdg-decoration (server side decorations, derived from KDE’s protocol)
There are several upcoming protocols being driven by KDE as well, such as:
* alpha-modifier (set alpha values for a surface)
* ext-blur (enable blur effect underneath a surface)
* xdg-toplevel-icon (enable applications to set window icons)
* ext-placement (allow application window positioning)
* window-id (consistent, uniform method window IDs)
* xdg-pip (picture in picture overlays)
* dbus-annotation (link D-Bus objects to surfaces)
This demonstrates that KDE works not to just enable new technologies
and features for Plasma Wayland, but they also do it in a way that
drives larger community adoption, success, and growth.
=== Wayland support ===
KDE Plasma offers the most advanced Wayland desktop experience today,
providing support for highly-demanded features, such as:
* Fractional scaling
* Color management
* Variable Refresh Rate for capable displays
* Support for optionally allowing legacy X11 applications to access
desktop resources
* Screensharing for legacy applications
* Global shortcut support for legacy applications
* Support for accessibility, including integration with the Orca screen reader
* Support for AR/VR displays
=== Industry support ===
KDE Plasma has been garnering wider industry support in consumer
products over the last couple years. This includes various PINE64
products (PinePhones, PineBooks, etc.), the Steam Deck from Valve, and
Tuxedo OS from Tuxedo Computers.
The Steam Deck in particular has brought the Linux desktop in the form
of KDE Plasma to more people than ever before, through the desktop
mode in SteamOS 3.x releases. As a result, Valve has heavily invested
into KDE and its technology stack for mainstream usage. Game
developers are also testing on KDE Plasma more often nowadays as part
of SteamOS compatibility testing.
=== Community Support ===
A number of Fedora downstreams have launched with KDE Plasma as the
flagship experience or migrated to it over time. Notably Fedora Asahi
Remix uses KDE Plasma as the flagship due to significantly better
support and features for ARM based platforms and the hardware that
Apple Silicon systems have. Nobara uses KDE Plasma as the flagship due
to a high quality Wayland experience that supports gaming and game
development well.
Developers of Linux XR applications and services already recommend
using KDE Plasma to be able to leverage AR/VR experiences in a modern
desktop.
Starting in 2025, KDE Plasma’s release cycle switches to a semi-annual
cadence that lines up with Fedora Linux releases, enabling a tight
interlock of development and integration between Fedora and KDE.
== Feedback ==
== Benefit to Fedora ==
* Fedora Linux advertises and advocates for the most advanced Wayland
desktop experience with broad community support and engagement.
* We ship a desktop experience that supports the wide range of user
needs and enables the experiences people expect from a modern desktop
(HDR, VRR, VR gaming, HiDPI) and strives to support as many users as
possible in a manner that results in positive engagement with the
community.
* We align the default Fedora workstation experience with what the
larger PC ecosystem expects for a high quality desktop.
== Scope ==
* Proposal owners: fedora-release: -kde subpackages get renamed to
-workstation-kde. -workstation subpackages get renamed to
-workstation-gnome.
* Other developers: Fedora Plasma Workstation is added to the main
landing page and promoted as the default desktop experience
* Release engineering: [https://pagure.io/releng/issue/12043 12043]
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
* Policies and guidelines: No, it would not required changes as it is
already release-blocking.
* Trademark approval: N/A (not needed for this Change)
* Alignment with Community Initiatives: N/A
== Upgrade/compatibility impact ==
Existing Fedora Workstation systems will not be switched to KDE
Plasma. This will only affect new installs of Fedora Workstation.
Existing Fedora KDE installs will be upgraded to the Plasma
Workstation branding.
== How To Test ==
As the fundamental experience is not changing in the existing KDE
Plasma variant, users can try out the Fedora KDE spin to see what
Fedora Plasma Workstation looks like.
== User Experience ==
The user experience does not change from the existing KDE Plasma
variant. Existing Fedora Workstation users won’t see their experience
change. New users of Fedora will get KDE Plasma instead of GNOME.
== Dependencies ==
N/A
== Contingency Plan ==
Retain the existing default GNOME experience for Fedora Workstation.
Move Fedora Plasma Workstation back to spin branding.
== Documentation ==
Documentation would need to be updated to reference Plasma and point
links to KDE rather than GNOME.
== Release Notes ==
Fedora Linux now offers a new default workstation experience as
“Fedora Plasma Workstation” using KDE Plasma Desktop. This replaces
the previous Fedora KDE Plasma spin. The previous "GNOME Shell"-based
desktop experience can now be accessed through its dedicated Edition
page.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney