Debian

Debian

Debian 7.0 (Wheezy) with GNOME 3
Developer	Debian Project
OS family	Unix-like
Working state	Current
Source model	Open-source
Initial release	August 16, 1993 (1993-08-16)
Latest release	11.5 (Bullseye) (September 10, 2022 (2022-09-10)) [±]
Repository	salsa.debian.org/public
Available in	73 languages
Update method	APT (several front-ends available)
Package manager	dpkg
Platforms	IA-32, x86-64, PowerPC, SPARC, ARM, MIPS, S390
Kernel type	Monolithic: Linux, kFreeBSD (unstable: Micro: Hurd)
Userland	GNU
Default user interface	GNOME
License	Free software (mainly GPL). Proprietary software in a separate (non-default) repository.
Official website	www.debian.org

Debian (/ˈdɛbiən/) is an operating system composed of Free Software mostly carrying the GNU General Public License. The operating system is developed by an Internet collaboration of volunteers aligned with The Debian Project.

Debian GNU/Linux is one of the most popular Linux distributions for personal computers and network servers. Debian has been used as a base for other Linux distributions and has been forked many times but is not affiliated with its derivatives.

In addition to releasing security updates, the Debian project is committed to providing accurate information about security issues. Debian Security Advisories include standardized references for vulnerabilities and security exposures.

Debian, one of the earliest distributions in Linux's history, was envisioned to be developed openly in the spirit of Linux and GNU. This vision drew the attention and support of the Free Software Foundation. A few years later, the project created its well-known social contract.

Features

Text version of the Debian Installer

Graphical version of the Debian Installer (available since Etch)

Debian GNU/Linux console login and welcome message

Debian is primarily a Linux distribution with access to online repositories hosting over 37,500 software packages. Debian officially hosts free software on its repositories but also allows non-free software to be installed. Debian includes popular free programs such as LibreOffice, Iceweasel (a rebranding of Firefox), Evolution mail, K3b CD/DVD burner, VLC media player, GIMP image editor and Evince document viewer. Debian is a popular choice for web servers.

The cost of developing all the packages included in Debian 5.0 lenny (323 million lines of code) using the COCOMO model, has been estimated to be about US$ 8 billion. Ohloh estimates that the codebase (68 million lines of code) using the same model, would cost about US$ 1.2 billion to develop.

The current stable release, code-named Wheezy, is officially supported on eleven architectures and also brought support for two new architectures: s390x and armhf. Notable new features in this latest release include: Multiarch, which allows 32-bit Linux software to run on 64-bit operating system installs; UEFI support for amd64; improved multimedia support, reducing reliance on third-party repositories; compiled packages with hardened security flags; AppArmor, which can protect a system against unknown vulnerabilities; and systemd, which shipped as a technology preview.

Kernels

Debian 6.0 introduced a new kernel: the Debian GNU/kFreeBSD kernel. This project's new kernel is released as a technology preview and still lacks the amount of software available as on Debian's Linux. kFreeBSD is offered for Intel/AMD 32-bit and 64-bit architecture machines. Debian now supports two kernels, Linux and kFreeBSD, and offers GNU Hurd unofficially.

Installation

Debian offers DVD and CD images for installation that can be downloaded using BitTorrent, with jigdo and bought from retailers. The full sets are made up of several disks (the amd64 port consists of 10 DVDs or 69 CDs), but only the first disk is required for installation, as the installer can retrieve software not contained in the first disk image from online repositories. Installation images are hybrid on some architectures and can be used to create a bootable USB drive. The Wheezy release offers to install a variety of default Desktops (GNOME, KDE, Xfce, and LXDE) from its DVD boot menu and from special disk 1 CDs. The Debian installer includes aids for visually-impaired people, featuring in Wheezy a textual mode that performs audio output for each stage of installation. Debian offers different network installation methods. A minimal install of Debian is available via the 'netinstall' CD, whereby Debian is installed with just a base and later additional software can be downloaded from the Internet. Another option is to boot the installer from the network.

Desktop environments

Debian KDE desktop

Debian offers stable and testing CD images specifically built for GNOME (the default in Wheezy), KDE Plasma Workspaces, Xfce and LXDE. Less common window managers such as Enlightenment, Openbox, Fluxbox, IceWM, Window Maker and others are also available.

It was previously suggested that the default desktop environment of version 7.0 Wheezy may be switched to Xfce, because GNOME 3 might not fit on the first CD of the set. In November 2013 it was announced that the desktop environment of version 8.0 Jessie would change to Xfce. Demand for Xfce will be evaluated and the default environment may switch back to GNOME again just before Jessie is frozen.

As of March 2014, MATE is available in the testing and unstable repositories, while Cinnamon is only available in the unstable repository.

Blends

Debian Pure Blends are subsets of a Debian release configured out-of-the-box for users with particular skills and interests. For instance, Debian Jr. is targeted at children. The complete Debian distribution includes all available Debian Pure Blends. "Debian Blend" (without "Pure") is a term for a Debian-based distribution that strives to mainstream, improving Debian as a whole. Consequently, all extras offered by Blends will either become part of Debian, or are temporary workarounds to solve a need of the target group which cannot yet be solved within Debian.

Debian Live

Debian also releases live install images for CDs, DVDs and USB thumb drives, for IA-32 and x86-64 architectures, and with a choice of desktop environments. These "Debian Live" images allow the user to boot from a removable media and run Debian without affecting the contents of their computer. A full install of Debian to the computer's hard drive can be initiated from the live image environment.

Personalized Debian Live images can be built with the live-build tool, in which images are generated for CD/DVD/USB drives and for network booting purposes. Live-magic is another tool used for personalizing Debian Live images, along with the assistance of a graphical interface.

Embedded systems

Debian supports a variety of ARM-based NAS devices. The cheap NSLU2 was supported by Debian 4.0 and 5.0 and can be upgraded to Debian 6.0 although there are problems with a 6.0 clean install. Other supported NAS devices are the Buffalo Kurobox Pro, GLAN Tank, Thecus N2100 and QNAP Turbo Stations.

Devices based on the Kirkwood SoC are supported too, such as the SheevaPlug plug computer and OpenRD products. There are efforts to run Debian on mobile devices, but this is not a project goal yet since the Debian Linux kernel maintainers would not apply the necessary patches. Nevertheless, there are packages for resource-limited systems.

There are efforts to support Debian on other hardware, such as automobiles and wireless routers. Debian is known to run on set-top boxes. As of June 2014, there is an ongoing work to support the AM335x processor, which is used in electronic point of service solutions. Debian may be customized to run on cash machines.

Packages

Debian package

The GNOME icon for deb files
Filename extension	.deb
Internet media type	application/x-deb
Developed by	Debian
Type of format	Package management system
Container for	Software package
Extended from	ar archive

Package management

Package management operations can be performed with different tools available on Debian, from the lowest level command dpkg to graphical front-ends like synaptic. The official standard for administering packages on a Debian system is the apt toolset.

dpkg is the storage information center of installed packages and provides no configuration for accessing online repositories. The dpkg database is located at /var/lib/dpkg/available and contains the list of installed software on the current system. The dpkg command tool is used for the dpkg database without capability of accessing online repositories. The command can work with local .deb package files as well as information from the dpkg database.

APT tools for online repositories

Using Aptitude to view Debian package details

Package installed with Aptitude.

An APT tool allows administration of an installed Debian system for retrieving and resolving package dependencies from online repositories. APT tools share dependency information (/etc/apt configuration files) and downloaded cache .deb files (/var/cache/apt/archives). APT tools depend on verifying what is installed in the dpkg database in order to determine missing packages for requested installs.

• aptitude is a command tool and offers a TUI interface. The program comes with enhancements such as better search on package metadata. This command's support is self-contained for full features of APT administration.
• apt-get and apt-cache are command tools of the standard APT-class toolset apt package. apt-get installs and removes packages, and apt-cache is used for searching packages and displaying package information.

The GDebi tool and other front-ends

GDebi is an APT tool which can be used in command-line and on the GUI. GDebi combines the functionality of the dpkg tool and APT package resolving with online repositories. The local .deb file in the GUI environment's file manager can be associated to be opened with GDebi providing a graphical experience of installing packages via double clicking. GDebi can also install a local .deb file via the command line alike the dpkg command, but with access to online repositories. If GDebi is requested to install a local .deb file that requires to install a dependency, it then searches the repositories as defined in the common APT configuration folder (/etc/apt) and performs to resolving and downloading missing packages.

There are various front-ends for APT, both graphical and command-line based. Graphical applications include Software Center, Synaptic and Apper.

Repositories

A Debian 4.0 "Etch" Box Cover

The Debian Project offers at least three maintained releases at any one time. The distributions include packages which comply with the Debian Free Software Guidelines (DFSG), which are included inside the main repositories. Debian also officially supports the optional backports repository for the stable distribution.

Official

Official repositories are the following:

• stable, currently aliased wheezy, is the current release that has stable and well-tested software. Stable is made by freezing testing for a few months where bugs are fixed to make the distribution as stable as possible; then the resulting system is released as stable. It is updated only if major security or usability fixes are incorporated. After Debian 6.0, new releases will be made every two years. Stable's CDs and DVDs can be found in the Debian website.
• backports: This repository provides more recent versions than stable for some software. It is mainly intended for users of stable who need a newer version of a particular package.
• testing, currently aliased jessie, contains software being tested for inclusion in the next major release. The packages included in this distribution have had some testing in unstable but they may not be completely fit for release yet. It contains newer packages than stable but older than unstable. This distribution is updated continually until it enters the "frozen" state. Security updates for testing distribution are provided by Debian testing security team. Testing's CDs and DVDs can be found on the Debian website.
• unstable, permanently aliased sid, repository contains packages currently under development and is updated continually. This repository is designed for Debian developers who participate in a project and need the latest libraries available, or for those who prefer to run bleeding-edge software, and is not as stable as the other distributions. Debian does not support official sid installation CDs/DVDs because the repository is rapidly changing, although CD and DVD images of sid are built quarterly by aptosid. Additionally, the other distributions can be set to draw software from unstable the next time the system is upgraded.

Depreciating repositories in Debian:

• oldstable, currently aliased squeeze, is the prior stable release. It is supported until 1 year after a new stable is released. Debian recommends to update to the new stable once it has been released.
• snapshot provides older versions of other repositories. They may be used to install a specific older version of some software.

Other repository in Debian:

• experimental is a temporary staging area of highly experimental software for use by developers. Even though it is documented as a 'distribution' branch from Debian's documentation, many dependency packages that fulfill experimental software are commonly resolved with the unstable branch. This branch of experimental software is not as documented as the other branches as it should not even be referenced by advanced users.

Non-free and unofficial repositories

The Debian Free Software Guidelines (DFSG) define their distinctive meaning of the word "free" as in "free and open source software". In accordance with these guidelines, a relatively small number of packages are excluded from the distributions' main repositories and included inside the non-free and contrib repositories. These two repositories are not officially part of Debian. The project offers its distribution without non-free repositories but can be adopted manually after initial setup.

• non-free: repositories include packages which do not comply with the DFSG (this does not usually include legally questionable packages, like libdvdcss).
• contrib: repositories include packages which do comply with the DFSG, but may fail other requirements. For instance, they may depend on packages which are in non-free or requires such for building them.

Richard Stallman and the Free Software Foundation have criticized the Debian Project for providing the non-free repository, rather than excluding this type of software entirely, an opinion also echoed by some in Debian including the former project leader Wichert Akkerman. The internal dissent in the Debian Project regarding the non-free section has persisted, but the last time it came to a vote in 2006, the majority decided to keep it.

Third-party repositories

These repositories are not part of the Debian Project, they are maintained by third party organizations. They contain packages that are either more up to date than the ones found in stable or include packages that are not included in the Debian Project for a variety of reasons such as: e.g. possible patent infringement, binary-only/no sources, or special licenses that are too restrictive. Their use requires precise configuration of the priority of the repositories to be merged; otherwise these packages may not integrate correctly into the system, and may cause problems upgrading or conflicts between packages from different sources. The Debian Project discourages the use of these repositories as they are not part of the project.

Hardware support

Hardware requirements

Debian has no hardware requirements beyond those of the Linux kernel and the GNU tool-sets (gcc, coreutils, bash, etc.) Therefore, any architecture or platform to which these packages have been ported, and for which a Debian port exists, can run Debian. Linux, and therefore Debian, supports the use of multiple processors in a system (symmetric multiprocessing). This does not inhibit support for single-processor systems. Debian's recommended system requirements differ depending on the level of installation, which corresponds to increased numbers of installed components:

Install desktop	RAM minimum	RAM recommended	Minimum processor clock speed	Hard drive space used
No	64 MB	256 MB		1 GB
Yes	128 MB	512 MB	1 GHz	5 GB

The real minimum memory requirements depend on the architecture and may be much less than the numbers listed in this table. It is possible to install Debian with as little as 20 MB of RAM for s390, or 60 MB of RAM for x86-64. The installer will run in low memory mode and it is recommended to create a swap partition. Similarly, disk space requirements, which depend on the packages to be installed, can also be reduced by manually selecting the packages needed.

It is possible to run graphical user interfaces on older or low-end systems, but the installation of window managers instead of desktop environments is recommended, as desktop environments are more resource-intensive. Requirements for individual software vary widely and must be considered as well as those of the base operating environment.

Architecture ports

HP 9000 C110 PA-RISC workstation booting Debian GNU/Linux

Most software packages in the official Debian repositories are compiled for an abundance of available and older instruction sets.

Stable ports

As of the current stable release (wheezy), the official ports are:

• amd64: x86-64 architecture designed for 64-bit PCs, with the goal of supporting both 32bit- and 64bit-userland on this architecture
• armel: little-endian ARM architecture (Instruction set ARMv4) on RiscPC and various embedded systems (EABI)
• armhf: ARM (Instruction set ARMv7) hard-float architecture requiring hardware with a floating-point unit (FPU)
• i386: IA-32 architecture designed for 32-bit PCs. Also compatible with (but carries over the limitations of 32-bit to) 64-bit machines
• ia64: Intel Itanium (IA-64) architecture
• kfreebsd-amd64: Kernel of FreeBSD on x86-64 architecture
• kfreebsd-i386: Kernel of FreeBSD on IA-32 architecture
• mips, mipsel: MIPS architecture (big-endian and little-endian)
• powerpc: PowerPC architecture
• s390: IBM ESA/390 architecture and z/Architecture
• s390x: IBM ESA/390 architecture and z/Architecture with 64-bit userland
• sparc: Sun SPARC architecture on sun4u/v systems

Unstable ports

In the current official unstable distribution there are following ports:

• hurd-i386: GNU Hurd kernel on IA-32 architecture

Unofficial ports

Unofficial ports are also available as part of the unstable distribution:

• alpha: DEC Alpha architecture
• hppa: HP PA-RISC architecture
• m68k: Motorola 68k architecture on Amiga, Atari, Macintosh and various embedded VME systems
• powerpcspe: PowerPCSPE architecture (binary-incompatible variant of the PowerPC)
• ppc64: PowerPC64 architecture supporting 64-bit PowerPC CPUs with VMX
• sh4: Hitachi SuperH architecture
• sparc64: Sun SPARC architecture with 64-bit userland
• x32: 32-bit userland for modern x86-64 processors, incompatible with IA-32

The m68k port was the second official one in Debian, and has been part of five stable Debian releases. Due to its failure to meet the release criteria, it was dropped before the release of etch but is in current status of being revived. The arm (OABI, <armv4t), alpha and hppa ports were dropped before the release of squeeze.

Derivatives

Debian GNU/Linux is one of the most popular Linux distributions, and many other distributions have been created from the Debian code base, including Ubuntu and Knoppix. As of 2014, DistroWatch lists 138 active Debian derivatives. Although Debian is not affiliated with its derivatives, the project provides guidelines for best practices and encourages derivatives to merge their work back into Debian.

Policies

Debian is known for its manifesto, social contract, and policies. Debian's policies and team efforts focus on collaborative software development and testing processes and dedicates lengthy development time between unstable and stable release cycles. As a result of its strictly guarded policies, a new distribution release for Debian tends to occur every one to two years.,ref>http://debian-handbook.info/browse/stable/sect.release-lifecycle.html</ref> The strategy policies used by the Debian project for minimizing software bugs, albeit with longer release cycles, has allowed it to remain one of the most stable and secure Linux distributions.

Organization

Diagram of the organizational structure of the project

The Debian Project is a volunteer organization with three foundational documents:

• The Debian Social Contract defines a set of basic principles by which the project and its developers conduct affairs.
• The Debian Free Software Guidelines define the criteria for "free software" and thus what software is permissible in the distribution, as referenced in the Social Contract. These guidelines have also been adopted as the basis of the Open Source Definition. Although it can be considered a separate document for all practical purposes, it formally is part of the Social Contract.
• The Debian Constitution describes the organizational structure for formal decision-making within the Project, and enumerates the powers and responsibilities of the Debian Project Leader, the Debian Project Secretary, and the Debian Developers generally.

Debian is developed by over three thousand volunteers, but it is possible to contribute to the project without being a Debian Developer.

Debian is supported by donations through several nonprofit organizations around the world. The largest supporter is Software in the Public Interest, the owner of the Debian trademark, manager of the monetary donations and umbrella organization for various other community free software projects.

The project maintains official mailing lists and conferences for communication and coordination between developers. For issues with single packages and other tasks, a public bug tracking system is used by developers and end-users. Internet Relay Chat channels (primarily on the OFTC and freenode networks) are also used for communication among developers and to provide real time help.

Together, the Developers may make binding general decisions by way of a General Resolution or election. All voting is conducted by Cloneproof Schwartz Sequential Dropping, a Condorcet method of voting. A Project Leader is elected once per year by a vote of the Developers; in April 2010, Stefano Zacchiroli was voted into this position, succeeding Steve McIntyre. The Debian Project Leader has several special powers, but they are not absolute. Under a General Resolution, the Developers may, among other things, recall the leader, reverse a decision by him or his delegates, and amend the constitution and other foundational documents.

The Leader sometimes delegates authority to other developers in order for them to perform specialized tasks. Delegates make decisions as they think is best, taking into account technical criteria and consensus.

A role in Debian with a similar importance to the Project Leader's is that of a Release Manager. Release Managers set goals for the next release, supervise the processes, and make the final decision as to when to release.

Project leaders

The Debian Project Leader (DPL) is the public face of the project and defines the current direction of the project. The project has had the following leaders:

• Ian Murdock (August 1993 – March 1996), founder of the Debian Project
• Bruce Perens (April 1996 – December 1997)
• Ian Jackson (January 1998 – December 1998)
• Wichert Akkerman (January 1999 – March 2001)
• Ben Collins (April 2001 – April 2002)
• Bdale Garbee (April 2002 – April 2003)
• Martin Michlmayr (March 2003 – March 2005)
• Branden Robinson (April 2005 – April 2006)
• Anthony Towns (April 2006 – April 2007)
• Sam Hocevar (April 2007 – April 2008)
• Steve McIntyre (April 2008 – April 2010)
• Stefano Zacchiroli (April 2010 – April 2013)
• Lucas Nussbaum (April 2013 – present)

A supplemental position, Debian Second in Charge (2IC), was created by Anthony Towns. Steve McIntyre held the position between April 2006 and April 2007. From April 2009 to April 2010 this position was held by Luk Claes. Stefano Zacchiroli abandoned this unofficial position when elected in April 2010.

Release managers

• Brian C. White (1997–1999)
• Richard Braakman (1999–2000)
• Anthony Towns (2000–2004)
• Steve Langasek, Andreas Barth and Colin Watson (2004–2007)
• Andreas Barth and Luk Claes (2007–2008)
• Luk Claes and Marc Brockschmidt (2008–2009)
• Luk Claes and Adeodato Simó (2009–2010)
• Adam D. Barratt and Neil McGovern (2010–2013)
• Adam D. Barratt and Niels Thykier (2013–present)

Note that this list includes the active release managers; it does not include the release assistants (first introduced in 2003) and the retiring managers ("release wizards").

Developer recruitment, motivation, and resignation

The Debian project has an influx of applicants wishing to become developers. These applicants must undergo a vetting process which establishes their identity, motivation, understanding of the project's goals (embodied in the Social Contract), and technical competence. This process has become much harder throughout the years.

Debian Developers join the Project for a number of reasons; some that have been cited in the past include:

• A desire to contribute back to the free-software community (practically all applicants are users of free software)
• A desire to see some specific software task accomplished (some view the Debian user community as a valuable testing or proving ground for new software)
• A desire to make, or keep, free software competitive with proprietary alternatives
• A desire to work closely with people who share some of their aptitudes, interests, and goals (there is a very strong sense of community within the Debian project which some applicants do not experience in their paid jobs)
• A simple enjoyment of the iterative process of software development and maintenance

Debian Developers may resign their positions at any time by orphaning the packages they were responsible for and sending a notice to the developers and the keyring maintainer (so that their upload authorization can be revoked). Alternatively, when necessary, existing developers can be expelled.

Development procedures

Software packages in development are either uploaded to the project distribution named unstable (also known as "sid"), or to the "experimental" repository. Software packages uploaded to "unstable" are normally versions stable enough to be released by the original upstream developer, but with the added Debian-specific packaging and other modifications introduced by Debian developers. These additions may be new and untested. Software not ready yet for the "unstable" distribution is typically placed in the "experimental" repository.

After a version of a software package has remained in "unstable" for a certain length of time (depending on the urgency of the software's changes), that package is automatically migrated to the "testing" distribution. The package's migration to testing occurs only if no serious ("release-critical") bugs in the package are reported and if other software needed for package functionality qualifies for inclusion in "testing".

Since updates to Debian software packages between official releases do not contain new features, some choose to use the "testing" and "unstable" distributions for their newer packages. However, these distributions are less tested than "stable", and "unstable" does not receive timely security updates. In particular, incautious upgrades to working "unstable" packages can sometimes seriously break software functionality. Since September 9, 2005 the "testing" distribution's security updates have been provided by the "testing" security team.

When "testing" is deemed mature enough and the number of remaining bugs is acceptable, the "testing" distribution becomes the next stable release. The timing of the release is decided by the Release Managers, and in the past the exact date was rarely announced earlier than a couple of weeks beforehand.

Package maintenance

Flowchart of the life cycle of a Debian package

Each Debian software package has a maintainer who keeps track of releases by the "upstream" authors of the software and ensures that the package is compliant with Debian Policy, coheres with the rest of the distribution, and meets the standards of quality of Debian. In relations with users and other developers, the maintainer uses the bug tracking system to follow up on bug reports and fix bugs. Typically, there is only one maintainer for a single package, but, increasingly, small teams of developers "co-maintain" larger and more complex packages and groups of packages.

A package maintainer makes a release of a package by uploading it to the "incoming" directory of the Debian package archive (or an "upload queue" which periodically batch-transmits packages to the incoming directory). Package uploads are automatically processed to ensure that they are well-formed (all the requisite files are in place) and that the package is digitally signed by a Debian developer using OpenPGP-compatible software. All Debian developers have individual cryptographic key pairs. Developers are responsible for any package they upload even if the packaging was prepared by another contributor.

If the package in incoming is found to be validly signed and well-formed, it is installed into the archive into an area called the "pool" and distributed every day to hundreds of mirrors worldwide. Initially, all package uploads accepted into the archive are only available in the "unstable" distribution, which contains the most up-to-date version of each package.

For packages to become candidates for the next "stable" release of the Debian distribution, they first need to be included in the "testing" distribution. For a package to be included in "testing":

• It must have been in "unstable" for the appropriate length of time (the exact duration depends on the urgency of the changes)
• It must not have a greater number of "release-critical" bugs filed against it than the current version in testing. Release-critical bugs are those bugs which are considered serious enough that they make the package unsuitable for release.
• It must be compiled for all release architectures the package claims to support (e.g.: the i386-specific package gmod can be included in "testing")
• All of its dependencies must either be satisfiable by packages already in "testing", or be satisfiable by the group of packages which are going to be installed at the same time.
• The operation of installing the package into "testing" must not break any packages currently in "testing".

Thus, a release-critical bug in a new version of a shared library on which many packages depend may prevent those packages from entering "testing", because the updated library must meet the requirements too.

Periodically, the release team publishes guidelines to the developers in order to ready the release. A new release occurs when all important software is reasonably up-to-date in the release-candidate distribution, and when any other significant issues are solved. At that time, all packages in the "testing" distribution become the new "stable" distribution.

A version of a package can belong to more than one distribution, usually "testing" and "unstable". It is possible for a package to keep the same version between stable releases and be part of "oldstable", "stable", "testing" and "unstable" at the same time. Each distribution, also called suite, can be seen as a collection of pointers into the package "pool" mentioned above.

Debian Security Announcement (DSA)

The Debian Project, being free software, handles security policy through public disclosure rather than through security through obscurity. Many advisories are coordinated with other free software vendors and are published the same day a vulnerability is made public. Debian has a security audit team that focuses on packages in the stable release looking for new or unfixed security bugs. The Debian security advisories are compatible with the Common Vulnerabilities and Exposures (CVE) dictionary.

The Debian Project offers documentation and tools to harden a Debian installation both manually and automatically. SELinux (Security-Enhanced Linux) packages are installed by default though not enabled. Debian provides an optional hardening wrapper and does not compile their packages by default using gcc features such as PIE and buffer overflow protection to harden their software, unlike Ubuntu, Fedora and Hardened Gentoo among others, but tries to build as many packages as possible with hardening flags. These extra features increase security at a performance cost of 1% in IA-32 and 0.01% in x86-64.

In May 2008, a Debian Developer revealed his discovery that changes made in 2006 to the random number generator in the version of the OpenSSL package distributed with Debian and other Debian-based distributions such as Ubuntu or Knoppix, made a variety of security keys vulnerable to a random number generator attack. The security weakness was caused by changes made to the OpenSSL code by another Debian Developer in response to memory debugger warnings. The security hole was soon patched by Debian and others, but the complete resolution procedure was cumbersome for users because it involved regenerating all affected keys, and it drew criticism to Debian's practice of making Debian-specific changes to software.

History

Releases

As of June 2014, the stable release is version 7, code name wheezy. When a new version is released, the prior stable version becomes oldstable. This is version 6.0, code name squeeze.

In addition, a stable release gets minor updates (called point releases). The numbering scheme for the point releases up to Debian 4.0 was to include the letter r (for release) after the main version number (e.g. 4.0) and then the number of the point release; for example, the latest point release of version 4.0 (etch) is 4.0r9. From Debian 5.0 (lenny), the numbering scheme of point releases has been changed and conforms to the GNU version numbering standard; so, for example, the first point release of Debian 5.0 was 5.0.1 (instead of 5.0r1). The numbering scheme was once again changed for the first Debian 7 update, with the latter being assigned version 7.1.

Security updates

The Debian security team releases security updates for the latest stable major release, and for the prior stable release for one year. Version 4.0 etch was released on 8 April 2007, and the security team supported version 3.1 Sarge until 21 March 2008. For most uses it is strongly recommended to run a system which receives security updates. The testing distribution also receives security updates, but not in as timely a manner as stable.

Time-based development schedule

For Debian 6.0 (squeeze) a new policy of time-based development freezes on a two-year cycle was announced. Time-based freezes are intended to allow the Debian Project to blend the predictability of time based releases with its policy of feature based releases. Having predictable freezes was expected to reduce overall freeze time. The squeeze cycle was intended to be especially short to "get into the new cycle". However this short freeze cycle for squeeze was abandoned.

Debian release code names

The code names of Debian releases are names of characters from the film Toy Story. The unstable, development distribution is permanently nicknamed sid, after the emotionally unstable next-door neighbor boy who regularly destroyed toys. The current release wheezy is named after the rubber toy penguin in Toy Story 2. The release after wheezy will be named jessie, after the cowgirl in Toy Story 2 and Toy Story 3.

Timeline

Debian has made twelve major stable releases:

Version	Code name	Release date	Ports	Packages	Supported until	Notes
Old version, no longer maintained: 1.1	buzz	17 June 1996	1	474	Old version, no longer maintained: -	dpkg, ELF transition, Linux 2.0
Old version, no longer maintained: 1.2	rex	12 December 1996	1	848	Old version, no longer maintained: -	-
Old version, no longer maintained: 1.3	bo	5 June 1997	1	974	Old version, no longer maintained: May 1998	-
Old version, no longer maintained: 2.0	hamm	24 July 1998	2	≈ 1,500	Old version, no longer maintained: 1998	glibc transition, new architecture: m68k
Old version, no longer maintained: 2.1	slink	9 March 1999	4	≈ 2,250	Old version, no longer maintained: December 2000	APT, new architectures: alpha, sparc
Old version, no longer maintained: 2.2	potato	15 August 2000	6	≈ 3,900	Old version, no longer maintained: April 2003	New architectures: arm, powerpc
Old version, no longer maintained: 3.0	woody	19 July 2002	11	≈ 8,500	Old version, no longer maintained: August 2006	New architectures: hppa, ia64, mips, mipsel, s390
Old version, no longer maintained: 3.1	sarge	6 June 2005	11	≈ 15,400	Old version, no longer maintained: April 2008	Modular installer, semi-official amd64 support.
Old version, no longer maintained: 4.0	etch	8 April 2007	11	≈ 18,000	Old version, no longer maintained: 15 February 2010	New architecture: amd64. Dropped m68k. Graphical installer, udev transition, modular X.Org transition.
Old version, no longer maintained: 5.0	lenny	15 February 2009	12	≈ 23,000	Old version, no longer maintained: 6 February 2012	New architecture: armel Dropped SPARC 32-bit. Full Eee PC support.
Older version, yet still maintained: 6.0	squeeze	6 February 2011	9+2[A]	≈ 29,000	Older version, yet still maintained: Standard: 31 May 2014 LTS: February 2016	New architectures: kfreebsd-i386, kfreebsd-amd64. Dropped alpha, hppa, arm. Moved to eglibc. Dependency-based boot sequence. Free firmware.
Current stable version: 7	wheezy	4 May 2013	11+2[B]	≈ 37,000	Current stable version: TBA	New architectures: armhf­, s390x. Multiarch support.
Future release: 8	jessie	TBA	TBA	TBA	Future release: TBA	Freeze date announced.
Legend: Old version Older version, still maintained Latest version Latest preview version Future release

^A 9 architectures with Linux kernel + 2 architectures with kernel of FreeBSD

^B 11 architectures with Linux kernel + 2 architectures with kernel of FreeBSD

Due to an incident involving a CD vendor who made an unofficial and broken release labeled 1.0, an official 1.0 release was never made.

1993–1998

Debian was first announced on 16 August 1993 by Ian Murdock, who initially called the system "the Debian Linux Release". The word "Debian" was formed as a combination of the first name of his then-girlfriend Debra Lynn and his own first name. Prior to Debian's release, the Softlanding Linux System (SLS) had been the first Linux distribution compiled from various software packages, and was a popular basis for other distributions in 1993–1994. The perceived poor maintenance and prevalence of bugs in SLS motivated Murdock to launch a new distribution.

In 1993 Murdock also released the Debian Manifesto, outlining his view for the new operating system. In it he called for the creation of a distribution to be maintained in an open manner, in the spirit of Linux and GNU.

The Debian Project grew slowly at first and released the first 0.9x versions in 1994 and 1995. During this time it was sponsored by the Free Software Foundation's GNU Project. Ian Murdock delegated the base system, the core packages of Debian, to Bruce Perens and Murdock focused on the management of the growing project. The first ports to other, non-IA-32 architectures began in 1995, and Debian 1.1 was released in 1996. By that time and thanks to Ian Jackson, the dpkg package manager was already an essential part of Debian.

In 1996, Bruce Perens assumed the project leadership. Perens was a controversial leader, regarded as authoritarian and strongly attached to Debian. He drafted a social contract and edited suggestions from a month-long discussion on the Debian mailing lists into the Debian Social Contract and the Debian Free Software Guidelines. He also initiated the creation of the legal umbrella organization, Software in the Public Interest. He led the conversion of the project from a.out to ELF. He created the BusyBox program to make it possible to run a Debian installer on a single floppy, and wrote a new installer. Perens was also responsible for many policy and design elements of Debian that persist to this day. By the time Debian 1.2 was released the project had grown to nearly two hundred volunteers. Perens left the project in 1998.

1999–2004

The Project elected new leaders and made two more 2.x releases, each including more ports and packages. The Advanced Packaging Tool was deployed during this time and the first port to a non-Linux kernel, Debian GNU/Hurd, was started. The first Linux distributions based on Debian, namely Libranet, Corel Linux and Stormix's Storm Linux, were started in 1999. The 2.2 release in 2000 was dedicated to Joel Klecker, a developer who died of Duchenne muscular dystrophy.

In late 2000, the project made major changes to archive and release management, reorganizing software archive processes with new "package pools" and creating a testing distribution as an ongoing, relatively stable staging area for the next release. In the same year, developers began holding an annual conference called DebConf with talks and workshops for developers and technical users.

In July 2002, the Project released version 3.0, codenamed woody, the first release to include cryptographic software, a free licensed KDE and internationalization. During these last release cycles, the Debian Project drew considerable criticism from the free software community because of the long time between stable releases.

2005–present

Debian 4.0 "Etch" (2007)

The 3.1 sarge release was made in June 2005. There were many major changes in this release, mostly due to the long time it took to freeze and release the distribution. This release updated 73% of the software and included over 9,000 new packages. A new installer replaced the aging boot-floppies installer with a modular design. This allowed advanced installations (with RAID, XFS and LVM support) including hardware detection, making installations easier for novice users. The installation system also boasted full internationalization support as the software was translated into almost forty languages. An installation manual and release notes were released in ten and fifteen different languages respectively. This release included the efforts of the Debian-Edu/Skolelinux, Debian-Med and Debian-Accessibility sub-projects which raised the number of packages that were educational, had a medical affiliation, and ones made for people with disabilities.

In 2006, as a result of a much-publicized dispute, Mozilla software was rebranded in Debian, with Firefox becoming Iceweasel and Thunderbird becoming Icedove. The Mozilla Corporation stated that Debian may not use the Firefox trademark if it distributes Firefox with modifications which have not been approved by the Mozilla Corporation. Two prominent reasons that Debian modifies the Firefox software are to change the artwork and to provide security patches. Debian Free Software Guidelines consider Mozilla's artwork non-free. Debian provides long term support for older versions of Firefox in the stable release, where Mozilla preferred that old versions not be supported but has since included Legacy versions of programs. These software programs developed largely by the Mozilla Corporation were rebranded despite having only minor differences in the source code.

Debian 4.0 (etch) was released April 8, 2007. It included the x86-64 port but dropped support for m68k. The m68k port was, however, still available in the unstable distribution. There were approximately 18,200 binary packages maintained by more than 1,030 Debian developers.

Debian 6.0 "Squeeze" (2011)

Debian 5.0 (lenny) was released February 14, 2009. It included more than 25,000 software packages. Support was added for Marvell's Orion platform and for netbooks such as the Asus Eee PC, but support was dropped for 32-bit SPARC machines. The release was dedicated to Thiemo Seufer, an active developer and member of the community who died in a car accident on December 26, 2008. On September 5, 2010, the backports service became official, providing more recent versions of some software for the stable release.

Debian continued to support new architectures and add new features with each release. Debian 6.0 (squeeze) was released February 6, 2011 introducing Debian GNU/kFreeBSD as a technology preview. Debian 7.0 (wheezy) was released May 4, 2013 featuring multiarch support. At present, Debian is still in development, working on the unstable distribution.

Throughout Debian's lifetime, both the Debian distribution and their website have won various awards from different organizations, including Server Distribution of the Year 2011, The best Linux distro of 2011, and a Best of the Net award for October 1998.

See also

• Comparison of Linux distributions
• DCC Alliance
• List of Linux distributions

External links

• Official website
• Debian GNU/Linux at DistroWatch