Skip to content

version-delta.md

Latest commit

 

History

History
96 lines (78 loc) · 6.33 KB

version-delta.md

File metadata and controls

96 lines (78 loc) · 6.33 KB
Raw

Version delta — five years of upstream fixes (P2.10)

⚠ Stock moved to Release 20260907, re-measured 2026-09-10. Every "Stock" cell in the tables below was re-checked against the 20260907 rootfs (rootfs.tar.bz2 + modules.tar.gz + firmware.tar.gz + addon.tar overlaid per create_img.sh, the same tree docs/stock-inventory/20260907/ inventories) — see README.md's "Stock vs. this image" table for the full method and citations. Every one re-measured turned out unchanged: Buildroot 2021.02.4, glibc 2.31, OpenSSL 1.1.1k, OpenSSH 8.6p1, Samba 4.14.6, Python 3.9.6 — Release 20260907 replaced the kernel, modules and firmware only, not the Buildroot userland. The kernel row is the one real change (5.15.1 → 6.18.38); its "Stock" cell below is now stale and should read 6.18.38 (12 .y releases behind our pin at time of writing — docs/kernel-recon/fork-sync-2026-09/PLAN.md), not 5.15.1. BlueZ, wpa_supplicant and dbus were not re-measured this pass (no per-file version string was checked for those three) — treat those rows as still 20250402-era. The SONAME table (docs/package-manifest.md, "The full per-package mapping" below) was checked: docs/stock-inventory/20260907/shared-libraries.md shows the 20260907 rootfs has the identical shared-library counts as 20250402 (1,039 ELF shared objects, 534 SONAME-bearing, 507 true-ABI libraries) — no headline SONAME-count change, consistent with the userland being unchanged.

Stock MiSTer froze its entire userland at Buildroot 2021.02.4 (glibc 2.31, Linux 5.15.1) and has taken no .y stable updates on the kernel and few on the packages since. This project rebases the whole stack on Buildroot 2026.08 — roughly five years of upstream security and correctness work, on a base with a real update path (Renovate-tracked, P4.6/P4.7).

This is a headline reason the project exists (goals G2/G3: a real security-update path), and it belongs in the release notes.

A note on honesty. This document states version deltas, which are facts, and the general "~5 years of upstream maintenance" framing, which is true and defensible. It deliberately does not enumerate specific CVE numbers or claim a count of "N CVEs fixed" — those are not verified here, and an unverifiable count would undermine the very credibility this document exists to build. One end-of-life fact is cited because it is public and load-bearing (OpenSSL 1.1.1: https://openssl-library.org/news/timeline/index.html).

The stack

Ours-side figures last re-read off the built tree on 2026-07-22 (kernel from configs/mister_de10nano_defconfig; package versions from output/build/). They move whenever Renovate lands a bump — when in doubt, the defconfig and Makefile pins are the ground truth and this table is a summary of them.

Component Stock (2021.02.4) Ours (2026.08) Note
Buildroot 2021.02.4 2026.08 ~5 years of the whole distro
Linux kernel 5.15.1 (forked Nov 2021, never merged a single 5.15.y) 6.18 LTS — the .y moves with upstream stable, so the pin (BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE, configs/mister_de10nano_defconfig) is the only place it is written down; hardware-validated at 6.18.33, 6.18.38 and 6.18.41 on a stable .y line with security backports
glibc 2.31 2.44 backward-compatible; every stock binary still runs (proven on hardware)
gcc (toolchain) 10.x era 15.3.0

The kernel jump is the sharpest: stock forked 5.15.1 and never took any of the subsequent 5.15.y stable releases, and 5.15 itself reaches EOL in Oct 2026 (per kernel.org).

Security-relevant userland movers

Versions are from the shipped artifacts: stock from the extracted stock linux.img (work/imgroot), ours from the built packages.

Package Stock Ours Why it matters
OpenSSL 1.1.1 (libssl.so.1.1) 3.6.4 (libssl.so.3) OpenSSL 1.1.1 reached end-of-life on 2023-09-11 — stock ships a TLS library that has received no upstream fixes for ~2 years. This is the single strongest security argument. Major SONAME bump 1.1 → 3.
OpenSSH 8.6p1 10.5p1 the network login surface; ~4 years and several release cycles of hardening
Samba ~4.14 4.24.6 SMB file sharing, network-facing; ~9 major-minor releases
BlueZ 5.x (libbluetooth.so.3) 5.86 Bluetooth stack — 5.86 carries upstream's CablePairing series (DS3 over BT), which this repo backported by hand while Buildroot pinned 5.79 (bluetooth-parity §10)
wpa_supplicant 2.9 2.12 Wi-Fi auth
Python 3.9 3.14.7 on-device interpreter (A6) — 3.9 is itself near EOL; runs the Downloader and community scripts (compatibility tested in P3.9)
dbus — 1.14.10

Multimedia / library set (SONAME-compatible, still newer)

Every one of these is at a compatible major version (the ABI contract, P0.5) yet carries years of fixes:

Package Ours Package Ours
freetype 2.14.3 libpng 1.6.58
Imlib2 1.12.5 alsa-lib 1.2.15.3
fluidsynth 2.4.7 dbus 1.14.10

The full per-package mapping

docs/package-manifest.md (P0.7) carries the complete table — all 251 stock SONAMEs mapped to a Buildroot package with its version and whether the major bumped. The three deliberate major bumps flagged there (OpenSSL 1.1→3, libtiff.so.5→6, libffi.so.7→8) are handled; every other SONAME carries forward at the same major version, which is why the unmodified stock MiSTer binary runs unchanged (confirmed on hardware, docs/testlogs/p2-menu.md).

Where we now stand ahead of upstream-frozen stock

The point is not just "newer once." Stock has no mechanism to move — the Buildroot config that builds it is unpublished and the kernel fork takes no stable updates. This project pins every input by hash, builds reproducibly, and wires Renovate over the kernel (board/mister/de10nano/patches/linux/linux.hash) and Buildroot (BUILDROOT_VERSION/BUILDROOT_SHA256) version stanzas (P4.6/P4.7), so .y security bumps become a reviewed, testable PR rather than a manual re-fork. That maintainability — not any single version number — is the deliverable.