Repository navigation
Stage 9b: older and interim Debian, Ubuntu and RHEL releases #14
Description
Goal: older and interim releases of the systems supported today. Needs 9a.
| Distribution | Versions | Vendor support on 2026-10-13 | Packages and extended support |
|---|---|---|---|
| Debian | 11, 10, 9, 8 | none (11 left LTS on 2026-08-31) | archive.debian.org; Freexian ELTS: 11 to 2031, 10 to 2029, 9 to 2027, 8 end date unclear |
| Ubuntu LTS | 20.04, 18.04, 16.04 | standard support ended | ESM through Ubuntu Pro (20.04 to 2030, 18.04 to 2028); 16.04 ESM ended 2026-05, Legacy is paid |
| Ubuntu interim | 26.10 from its release (2026-10-15) to about 2027-07 | yes | archive.ubuntu.com, later old-releases |
| RHEL | 8; minor releases of 8, 9 and 10; 7, 6, 5 | 8 yes; 7 only ELS (paid) | UBI 8, 9 and 10 images in CI without a subscription |
| Rocky Linux, AlmaLinux | 8 | to 2029-05-31 | vendor mirrors |
| CentOS Linux | 7, 6, 5 | none | vault.centos.org |
Known limits, handled in mod_check and listed in the matrix:
-
bash 4.3 (Debian 8, Ubuntu 16.04), 4.2 (EL7), 4.1 (EL6), 3.2 (EL5)
-
No systemd: EL6 (Upstart), EL5 (SysV)
-
OpenSSH without
Include: Debian 8 (6.7); old algorithm sets on EL7 (7.4), Ubuntu 16.04 (7.2), Debian 9 (7.4) -
Firewall: only iptables on EL6, EL5 and Debian 9; firewalld with the iptables backend on EL7; ufw on iptables-legacy on Ubuntu 16.04 to 20.04
-
Packages missing on old releases (chrony with NTS, CrowdSec, usbguard, AIDE options): the module installs them from the vendor repository, a backport or a verified upstream build instead of refusing
-
Containerfiles (pinned digests) and integration jobs for every version above; EOL images get their sources switched to the archive
-
Every module group green on each version; the matrix states where a module comes from on releases that lack the package
-
Profile minimal-secure in a VM on the oldest and the newest version of each family, with Lynis
-
README table and CHANGELOG
-
SonarQube Cloud: no open issues and no new security hotspots on the pull request; fixed in the code, not ignored (only a rule exclusion with a written reason in .sonarcloud.properties where a fix is impossible)
-
Every module installs, works and is used on every supported system of this stage; no module refuses a system, and no log line of an lss run or a CI job starts with "Not" or "No" (fix the cause or quiet the tool)
Activity