Welcome to another edition of “This month in KDE Linux” — KDE’s in-progress operating system.
Infrastructure
This month we completed a major infrastructure project. Previously, our build process was generating Arch packages for KDE software and having mkosi install them; Hadi Chokr ported this to use KDE’s kde-builder tool to compile all KDE software directly. This change brings three benefits:
- Better alignment with how developers compile KDE software themselves.
- Improves distro-agnosticism, so we can more easily get non-KDE software from a different source in the future should the need arise.
- Substantially faster by using a more effective caching system.
QA & testing
Another major focus this month was on improving KDE Linux’s automatic QA story. The project already has a basic “does it boot to the desktop?” test for every build, but we can do much better.
To that effect, Bhushan Shah and Thomas Duckworth worked on finishing up the OpenQA-based testing system prototyped by Kangwei Zhu last year. Once fully integrated, this promises to hugely improve our ability to catch bad builds before they’re released, and we can update it over time to catch even more failure conditions.
Harald Sitter also added a test using the existing system to make sure we don’t ship an image with broken file capabilities. We did ship one bad build that includes a regression here, so this new test ensures that it won’t happen again.
Security
After multiple security issues were discovered in the upstream Linux kernel last month, a few of us (Adrian Vovk, Hadi Chokr, and I) did a mini-audit of insecure and unused software included in KDE Linux. This resulted in a variety of positive changes:
- Returning to the vanilla kernel; it turned out the Zen kernel no longer offered very much beyond the config tweaks we had already made anyway.
- Deleting the insecure and unused alf_alg kernel modules.
- Replacing the NTFS and CDemu kernel modules with their userspace FUSE versions.
- Removing the out-of-tree OpenRazer and APFS kernel modules. It was nice to have these pre-installed, but we realized they would eventually cause us to fail secure boot review, and we should instead be working towards upstream solutions. APFS support can work in userspace anyway via its FUSE driver. It looks light it might be abandoned, though. So there may be no good option; we’ll see.
- Removing a bunch of unused and unnecessary packages: acpi_call, busybox, cryfs, encfs, hplip, v4l2loopback-utils (yes it is indeed unneeded; you can do everything it does in userspace), and vpl-gpu-rt.
- Removing fuse2 as it’s unmaintained and known to be insecure. This will unfortunately have the effect of breaking some old AppImage apps. If you encounter any, please report that as a bug to the app’s authors/packagers; multiple other OSs have already booted fuse2, so apps really need to update to fuse3 ASAP.
- Removing fenrir, which it turns out was embarrassingly not used at all for various technical reasons. This allowed us to completely remove our usage of the AUR, which had been a source of infrastructure instability in the past.
Pre-installed apps
I implemented a service to install any new pre-installed Flatpak apps on people’s existing systems. It ignores any apps you’ve previously uninstalled manually.
Speaking of new Flatpak apps, I replaced KWalletManager and its configuration page in System Settings with the new KeepSecret app, packaged using Flatpak.
I also updated Ark’s nightly Flatpak packaging to include 7-zip support and generally synchronize it with the Flathub version.
Documentation
I migrated the project’s website and documentation to https://linux.kde.org, where everything lives now. I also added a few more pages.
Grab bag
Hadi Chokr set up /opt/local for being a supported location for installing compiled binaries. This is because the usual /usr/local location is read-only on KDE Linux. This is now documented here.
João Pedro Silva Sousa fixed a bug that could make installation fail if there happened to be two KDE Linux live USB disks plugged in at once.
And that wraps up May! There’s still lots to do, so if you’re a fan of the project, please help out:
- User support: help support people on discuss.kde.org using KDE Linux.
- Issue reporting: install KDE Linux and report issues.
- Documentation: improve docs; submit merge requests here.
- Flatpak: fix packaging or code issues in Flatpak-packaged apps.
- OS development: help build KDE Linux! There’s plenty to do.
- Kapsule development: work on our Incus-based Kapsule system, which is integral to the “expansion by experts” story.
Adventures in Linux and KDE 