Open-source News

Tern 1.0.0 is Generally Available!

The Linux Foundation - Wed, 12/11/2019 - 22:00

New release includes an updated CLI and support for custom report formats and analysis tool extensions

Tern is a VMware-originated open source tool that inspects container images to find individual software packages and their metadata installed in the image.

Due to changes in the command line options, Tern version 1.0.0 is the first non-backwards compatible release. If you have been using previous versions of Tern, we recommend that you upgrade to the latest release. You can run Tern by installing it from PyPI or you can clone the project from GitHub and install the project after cloning it.

Tern has a number of built-in report styles available including SPDX tag-value, JSON and YAML. Tern release 1.0.0 provides the ability to customize your own report plugin, which allows data collected by Tern to be formatted in a custom way to accommodate any user’s internal automation and auditing process. Tern uses the OpenStack Stevedore python module to dynamically load any customized report plugins at runtime. If you’re curious about how you can customize your own report plugin, we supply directions for how to do this on Tern’s GitHub page.

In addition to customizing your report format, the Tern 1.0.0 release can be extended to analyze container images using external file or filesystem analysis tools. The two currently supported external tools are scancode-toolkit and cve-bin-tool. Support for formatting the output of these external tools is expected to be completed in subsequent releases.

Scancode-toolkit is a license scanning tool that finds licenses in source code and binaries. cve-bin-tool is a security vulnerability scanning tool that finds common vulnerabilities. Note that although you can use a security scanner with Tern, there isn’t any support for reporting the results beyond printing them to console. This may change as the industry demand for security information in Software Bill of Materials seems to be on the rise. If you would like incorporate your own tool extension to Tern, there are some general steps to follow documented on Tern’s GitHub page.

The 1.0.0 release for Tern also includes important bug fixes to support the SPDX tag-value reporting that Tern does. These bug fixes primarily improve Tern’s compatibility with the SPDX online validation tool.

Other notable additions to Tern in the 1.0.0 release include:

  • Enablement for Tern to consume raw image tarballs
  • Continue to analyze the base image if a Docker build fails from a Dockerfile
  • Gracefully exit if Docker is not installed or properly setup
  • Fix working directory cleanup after a keyboard interrupt
  • Bug fixes that improve the overall stability and robustness of the tool

The next Tern release will be a little smaller in scope. It will focus on enabling the pip package manager to collect information and adding a “dockerfile freeze” command line option which will produce an annotated Dockerfile with all the versions pinned to the versions Tern finds in order help developers achieve a somewhat repeatable build (similar to the “pip freeze” functionality in Python).

If you are interested in contributing to Tern, or just want to know more about the project, visit our GitHub page.

The post Tern 1.0.0 is Generally Available! appeared first on The Linux Foundation.

DXVK Reportedly Going Into "Maintenance Mode" Due To State Of Code-Base

Phoronix - Wed, 12/11/2019 - 19:13
While DXVK tends to be much-loved by Linux gamers for allowing more Direct3D 10/11 Windows games to run nicely on Linux with Wine or Proton (Steam Play) thanks to its fairly complete translation of D3D10/D3D11 API calls to Vulkan, it looks like Philip Rebohle is at least contemplating shifting it just into maintenance-mode...

The Most Popular Linux / Open-Source News Of This Decade

Phoronix - Wed, 12/11/2019 - 17:39
With 2019 and in turn this decade quickly drawing to a close, here is a look back at the most popular open-source/Linux news on Phoronix from 2010 to present. So far this decade on Phoronix has been 27,840 original news articles pertaining to Linux/open-source/hardware...

NomadBSD 1.3 Released To Offer A Pleasant FreeBSD 12.1 Based Desktop Experience

Phoronix - Wed, 12/11/2019 - 16:28
Along similar aims to GhostBSD and MidnightBSD, GhostBSD is another one of the BSD distributions focused on providing a nice out-of-the-box experience. NomadBSD 1.3 is now available that is in turn based on the recent FreeBSD 12.1...

Revamp your old Linux desktop with Joe's Window Manager

opensource.com - Wed, 12/11/2019 - 16:02

Joe's Window Manager (JWM for short) is a lightweight window manager for X11. It's written in C, minimally using Xlib. Because it's so small and simple, JWM makes a great window manager for slow or old computers. The Raspberry Pi barely registers that JWM is running, leaving precious system resources for more important tasks than the desktop.


read more

Annotate screenshots on Linux with Ksnip

opensource.com - Wed, 12/11/2019 - 16:01

I recently switched from MacOS to Elementary OS, a Linux distribution focused on ease of use and privacy. As a user-experience designer and a free software supporter, I take screenshots and annotate them all the time. After trying out several different tools, the one I enjoy the most by far is Ksnip, an open source tool licensed under GPLv2.


read more

Pages