Adélie Linux

Packages, base files, and all other relevant software is all tracked in a publicly-accessible, hosted GitLab instance: https://code.foxkit.us/groups/adelie

Git does this.

Every package change is tracked in a separate commit, except batch changes (like typo correction, changing HTTP URLs to HTTPS, etc).

Git is used.

Detailed information about our release process is forthcoming; we plan on using SemVer-style versioning.

All releases are tagged in their respective repositories. The packages.git repository is tagged with the overall distribution version (1.0-beta2, for example).

Release notes are provided for every release on our blog, https://adelie.blog/ - these are additionally posted to our main Web site.

Issues may be reported using the issue tracker at https://bts.adelielinux.org/ or the mailing lists at https://lists.adelielinux.org/postorius/lists/

https://bts.adelielinux.org/

Approximately 80% of bugs have been triaged.

Most enhancement requests have been requests for packages; most reasonable requests are handled within two weeks.

Both our issue tracker and mailing lists would qualify: https://bts.adelielinux.org/ and https://lists.adelielinux.org/postorius/lists/

Security-sensitive issues are discussed at https://code.foxkit.us/adelie/packages/blob/master/CONTRIBUTING.rst

The sec-bugs email alias as discussed at https://code.foxkit.us/adelie/packages/blob/master/CONTRIBUTING.rst is for private vulnerability reports.

We have not received any.

The abuild system is used to build packages and is available as the 'abuild' package in the distribution, or https://code.foxkit.us/adelie/abuild

The abuild system is written in Bourne shell, with a replacement forthcoming that is written in pure Python 3.

abuild is released under the MIT and GPL-2 licenses: https://code.foxkit.us/adelie/abuild

abuild has its own test suite: https://code.foxkit.us/adelie/abuild/tree/master/tests

Each package that we ship that has a test suite as part of its distribution has that test suite run as part of the packaging process. If the test suite fails, we are alerted and must fix the issue before the package can be shipped. In some cases, test suites fail due to upstream issues: this is noted with options="!check" in the build recipe. A reason is required.

make check for abuild, abuild check for packages (also run as part of the normal abuild process).

sh -e is used: https://code.foxkit.us/adelie/abuild/blob/master/abuild.in#L1 checkbashisms is also being used.

We are integrating changes that remove dependence on bash-specific features.

The Project Lead, A. Wilcox, is familiar with security best practices and has worked to close multiple CVEs in other projects, including packages that are shipped in Adélie Linux.

abuild uses SHA-512 for checksumming and openssl for package signing.

abuild uses openssl and sha512sum; it does NOT implement its own cryptography.

All cryptography libraries and software used are fully libre.

The default key size for package signing is RSA 2048: https://code.foxkit.us/adelie/abuild/blob/efc6792/abuild-keygen.in#L53

RSA 2048 keys for package signing, SHA-512 for checksumming.

SHA-512 is used for checksumming.

Packages are synced to mirrors using rsync over SSH. Each architecture builder has its own SSH key that can be revoked in the event of a breach..

Package metadata is always verified with RSA 2048 signature verification. Additionally, package metadata is sent over HTTPS by default. If the user forces HTTP, the signature verification step is still performed. (It is possible, though severely warned against, to defeat this using apk's --allow-untrusted parameter.)

As far as we are aware, there are no unpatched vulnerabilities in any of our produced projects. We do not yet have a way to determine that for every package we ship.

The last critical vulnerability was fixed in under 12 hours after being reported. https://adelie.blog/2018/09/14/urgent-security-patch-for-all-systems-running-adelie-linux/

No static analysis tools are used yet.

No static analysis tools are used yet.

No static analysis tools are used yet.