Mirage 3.3.0 released

mirageos
announce

#1

It is my pleasure to announce MirageOS 3.3.0, which was just merged into opam-repository! MirageOS 3.3.0 contains some breaking changes, see below for details.

What is MirageOS?
MirageOS is a library operating system that constructs unikernels for secure, high-performance network applications across a variety of cloud computing and mobile platforms. Code can be developed on a traditional OS such as Linux or MacOS X, and then compiled into a fully-standalone, specialised unikernel that runs under the Xen or KVM hypervisors as well as lightweight hypervisors like FreeBSD’s BHyve, OpenBSD’s VMM. Xen and KVM power many public clouds; MirageOS unikernels are currently running on Amazon’s Elastic Compute Cloud and Google Compute Engine, and maybe others!

New target: (via solo5) Genode:
“Genode is a free and open-source operating system framework consisting
of a microkernel abstraction layer and a collection of userspace
components. The framework is notable as one of the few open-source
operating systems not derived from a proprietary OS, such as Unix. The
characteristic design philosophy is that a small trusted computing base
is of primary concern in a security oriented OS.” (from wikipedia, more
at https://genode.org/ #942, by @ehmry)

User-visible changes

  • use mirage-bootvar-unix instead of OS.Env.argv (deprecated since
    mirage-{xen,unix,os-shim}.3.1.0, mirage-solo5.0.5.0) on unix
    (#931, by @hannesm)

    WARNING: this leads to a different semantics for argument passing on
    Unix: all arguments are concatenated (using a whitespace " " as
    separator), and split on the whitespace character again (by parse-argv).
    This is coherent with all other backends, but the whitespace in
    “–hello=foo bar” needs to be escaped now.

  • mirage now generates upper bounds for hard-coded packages that are
    used in generated code. When we now break the API, unikernels which are
    configured with an earlier version won’t accept the new release of the
    dependency. This means API breakage is much smoother for us, apart from
    that we now track version numbers in the mirage utility. The following
    rules were applied for upper bounds:

    • if version < 1.0.0 then ~min:“a.b.c” ~max:“a.(b+1).0”
    • if version > 1.0.0 then ~min:“a.b.c” ~max:"(a+1).0.0"`
    • exceptions: tcpip (~min:“3.5.0” ~max:“3.6.0”), mirage-block-ramdisk
      (unconstrained)

    WARNING: Please be careful when release any of the referenced
    libraries by taking care of appropriate version numbering.
    (initial version in #855 by @avsm, final #946 by @hannesm)
    See below for a full list of current constraints.

  • since functoria.2.2.2, the “package” function (used in unikernel
    configuration) is extended with the labeled argument ~pin that receives
    a string (e.g.
    ~pin:“git+https://github.com/mirage-random/mirage-random.git”), and is
    embedded into the generated opam file as
    pin-depends

  • mirage-random-stdlib is now used for default_random instead of
    mirage-random (which since 1.2.0 no longer bundles the stdlib Random
    module). mirage-random-stdlib is not cryptographically secure, but “a
    lagged-Fibonacci F(55, 24, +) with a modified addition function to
    enhance the mixing of bits.”, which is now seeded using mirage-entropy.
    If you configure your unikernel with “mirage configure --prng fortuna”
    (since mirage 3.0.0), a cryptographically secure PRNG will be used (read
    more at https://mirage.io/blog/mirage-entropy)

  • mirage now revived its command-line “–no-depext”, which removes the
    call to “opam depext” in the depend and depends target of the generated
    Makefile (#948, by @hannesm)

  • make depend no longer uses opam pin for opam install --deps-only
    (#948, by @hannesm)

  • remove unused io_page configuration (initial discussion in #855, #940,
    by @hannesm)

  • charrua-client requires a Mirage_random interface since 0.11.0 (#938,
    by @hannesm)

  • split implementations into separate modules (#933, by @emillon)

  • improved opam2 support (declare ocaml as dependency #926)

  • switch build system to dune (#927, by @emillon)

  • block device writes has been fixed in mirage-solo5.0.5.0 (see
    https://github.com/mirage/mirage-solo5/issues/37)

The following package versions are constrained (generated by "git grep
package\ " in the mirage repository):

lib/mirage.ml:          package ~build:true ~min:"4.04.2" "ocaml";
lib/mirage.ml:          package "lwt";
lib/mirage.ml:          package ~min ~max "mirage-types-lwt";
lib/mirage.ml:          package ~min ~max "mirage-types";
lib/mirage.ml:          package ~min ~max "mirage-runtime" ;
lib/mirage.ml:          package ~build:true "ocamlfind" ;
lib/mirage.ml:          package ~build:true "ocamlbuild" ;
lib/mirage.ml:          package ~min:"3.1.0" ~max:"3.2.0" "mirage-unix"
lib/mirage.ml:          package ~min:"3.1.0" ~max:"3.2.0" "mirage-xen"
lib/mirage.ml:          package ~min:"0.4.0" ~max:"0.5.0" ~ocamlfind:[]
"solo5-bindings-*"
lib/mirage.ml:          package ~min:"0.5.0" ~max:"0.6.0" "mirage-solo5"
lib/mirage_impl_argv.ml:      Key.pure [ package ~min:"0.1.0"
~max:"0.2.0" "mirage-bootvar-unix" ]
lib/mirage_impl_argv.ml:      Key.pure [ package ~min:"0.4.0"
~max:"0.5.0" "mirage-bootvar-xen" ]
lib/mirage_impl_arpv4.ml:    Key.pure [ package ~min:"3.5.0"
~max:"3.6.0" ~sublibs:["arpv4"] "tcpip" ]
lib/mirage_impl_arpv4.ml:    Key.pure [ package ~min:"0.2.0"
~max:"0.3.0" ~sublibs:["mirage"] "arp" ]
lib/mirage_impl_block.ml:  [ package ~min:"1.5.0" ~max:"2.0.0"
~sublibs:["front"] "mirage-block-xen" ]
lib/mirage_impl_block.ml:        [ package ~min:"0.4.0" ~max:"0.5.0"
"mirage-block-solo5" ]
lib/mirage_impl_block.ml:        [ package ~min:"2.5.0" ~max:"3.0.0"
"mirage-block-unix" ]
lib/mirage_impl_block.ml:      Key.pure [ package "mirage-block-ramdisk" ]
lib/mirage_impl_block.ml:      Key.pure [ package ~min:"0.9.0"
~max:"0.10.0" "tar-mirage" ]
lib/mirage_impl_conduit_connector.ml:let pkg = package ~min:"3.0.1"
~max:"4.0.0" "mirage-conduit"
lib/mirage_impl_conduit_connector.ml:        package ~min:"0.9.2"
~max:"0.10.0" ~sublibs:["mirage"] "tls" ;
lib/mirage_impl_console.ml:      Key.pure [ package ~min:"2.2.0"
~max:"3.0.0" "mirage-console-unix" ]
lib/mirage_impl_console.ml:      Key.pure [ package ~min:"2.2.0"
~max:"3.0.0" "mirage-console-xen" ]
lib/mirage_impl_console.ml:      Key.pure [ package ~min:"0.3.0"
~max:"0.4.0" "mirage-console-solo5" ]
lib/mirage_impl_ethernet.ml:    Key.pure [ package ~min:"3.5.0"
~max:"3.6.0" ~sublibs:["ethif"] "tcpip" ]
lib/mirage_impl_fs.ml:let fat_pkg = package ~min:"0.12.0" ~max:"0.13.0"
"fat-filesystem"
lib/mirage_impl_fs.ml:      Key.pure [package ~min:"1.0.0" ~max:"2.0.0"
"mirage-fs-lwt"]
lib/mirage_impl_http.ml:      Mirage_key.pure [ package ~min:"1.0.0"
~max:"2.0.0" "cohttp-mirage" ]
lib/mirage_impl_ip.ml:  Key.pure [ package ~min:"0.11.0" ~max:"0.12.0"
"charrua-client-mirage" ]
lib/mirage_impl_ip.ml:      Key.pure [ package ~min:"0.6" ~max:"0.7"
"mirage-qubes-ipv4" ]
lib/mirage_impl_kv_ro.ml:        package ~min:"2.0.0" ~max:"3.0.0"
"io-page";
lib/mirage_impl_kv_ro.ml:        package ~min:"2.0.0" ~max:"3.0.0"
~build:true "crunch"
lib/mirage_impl_kv_ro.ml:      Key.pure [ package ~min:"1.5.0"
~max:"2.0.0" "mirage-fs-unix" ]
lib/mirage_impl_mclock.ml:      [ package ~min:"1.2.0" ~max:"2.0.0"
"mirage-clock-unix" ]
lib/mirage_impl_mclock.ml:      [ package ~min:"1.2.0" ~max:"2.0.0"
"mirage-clock-freestanding" ]
lib/mirage_impl_network.ml:      | `Unix -> [ package ~min:"2.3.0"
~max:"3.0.0" "mirage-net-unix" ]
lib/mirage_impl_network.ml:      | `MacOSX -> [ package ~min:"1.4.0"
~max:"2.0.0" "mirage-net-macosx" ]
lib/mirage_impl_network.ml:      | `Xen -> [ package ~min:"1.7.0"
~max:"2.0.0" "mirage-net-xen"]
lib/mirage_impl_network.ml:        [ package ~min:"1.7.0" ~max:"2.0.0"
"mirage-net-xen" ;
lib/mirage_impl_network.ml:        [ package ~min:"0.4.0" ~max:"0.5.0"
"mirage-net-solo5" ]
lib/mirage_impl_pclock.ml:      [ package ~min:"1.2.0" ~max:"2.0.0"
"mirage-clock-unix" ]
lib/mirage_impl_pclock.ml:      [ package ~min:"1.2.0" ~max:"2.0.0"
"mirage-clock-freestanding" ]
lib/mirage_impl_qubesdb.ml:let pkg = package ~min:"0.4" ~max:"0.7"
"mirage-qubes"
lib/mirage_impl_random.ml:    Mirage_key.pure [ package ~max:"0.1.0"
"mirage-random-stdlib" ]
lib/mirage_impl_random.ml:   the package array. *)
lib/mirage_impl_random.ml:        [ package ~min:"0.5.4" ~max:"0.6.0"
~sublibs:["mirage"] "nocrypto";
lib/mirage_impl_random.ml:          package ~max:"2.0" ~ocamlfind:[]
"zarith-xen" ]
lib/mirage_impl_random.ml:        [ package ~min:"0.5.4" ~max:"0.6.0"
~sublibs:["mirage"] "nocrypto";
lib/mirage_impl_random.ml:          package ~max:"2.0" ~ocamlfind:[]
"zarith-freestanding" ]
lib/mirage_impl_random.ml:        [ package ~min:"0.5.4" ~max:"0.6.0"
~sublibs:["lwt"] "nocrypto" ]
lib/mirage_impl_random.ml:    Mirage_key.pure [ package ~min:"0.5.4"
~max:"0.6.0" "nocrypto" ]
lib/mirage_impl_reporter.ml:      Key.pure [ package ~min:"0.3.0"
~max:"0.4.0" "mirage-logs" ]
lib/mirage_impl_resolver.ml:          package ~min:"1.0.0" ~max:"2.0.0"
"conduit-lwt-unix"; ]
lib/mirage_impl_syslog.ml:  Key.pure [ package ~min:"0.2.0" ~max:"0.3.0"
~sublibs "logs-syslog" ]
lib/mirage_impl_tracing.ml:        [ package ~max:"1.0.0" "mirage-profile";
lib/mirage_impl_tracing.ml:          package ~max:"1.0.0"
"mirage-profile-xen" ]
lib/mirage_impl_tracing.ml:        [ package ~max:"1.0.0" "mirage-profile";
lib/mirage_impl_tracing.ml:          package ~max:"1.0.0"
"mirage-profile-unix" ]

#2

Mirage on L4/seL4? At last!


#3

FWIW, mirage 3.3.1 (released on 21st November) fixes a regression (opam did no longer receive --yes), and functoria.2.2.3 (also released on 21st November) fixes multiple pin packages (which output pin-depends). :slight_smile: