Debian 'Bullseye' enters final phase before release as team debates whether it will be last to work on i386 architecture

Security, lack of suitable hardware for testing makes full 32-bit support hard

Debian 11, codenamed "Bullseye", has entered the first freeze stage, meaning no large or disruptive changes, or new package transitions (merging, splitting, renaming or removing) are allowed. The 32-bit i386 architecture is part of the release but may not be in Debian 12, codenamed "Bookworm".

The Debian project comes up with a new major release approximately every two years. The release date for Bullseye has not yet been determined, but hard freeze is scheduled for mid-March, according to the the release team.

Debian is one of the most significant Linux distros since it is not only popular in its own right, but is also used as the basis for Ubuntu and many others.

"We are missing the Bug Squashing parties," said the release team's Paul Gevers. He added that "there are quite a few bugs that are relatively easy to fix by NMU [non-maintainer upload] and we normally don't see them this late in the cycle."

Gevers also noted that support for the i386 architecture is no longer being waived. If a decision is made to drop it, he said, the start of the Bookworm cycle is a good moment to deal with any issues. "We're interested in the discussion about i386 support in Debian that was going on recently," he said.

The discussion was kicked off by Debian contributor Andrew Cater, who questioned the future of i386. "There seems to be only one maintainer," he said. "No one has real UEFI hardware for i386 and it's becoming harder and harder to justify spending too much time on testing of the images as fewer and fewer machines can benefit from them."

Although new PCs all support 64-bit architecture, 32-bit applications are common, and there are also embedded use cases. Many older PCs also remain in service. "i386 hardware is so numerous and widely spread that [the] tiny fraction of i386 users might be more users than half of our release architectures combined," claimed one comment to the thread.

Studying data from a Debian telemetry package called Popularity Contest confirmed this. "There are an order of magnitude more people with i386 kernels (and thus presumably i386 hardware) than there are for every other non-amd64 release architecture combined. Further, there are more people with old i386 hardware than there are for any other arch," said another developer.

Ubuntu has already dropped full 32-bit i386 releases, but a proposal to remove all 32-bit i386 packages went down so badly that Canonical changed its mind.

Commenting on the thread, an Ubuntu developer noted that "while the ongoing costs of maintaining a full port were a consideration, of equal concern was the fact that we believed we would not be able to provide security support for the architecture as a whole at par with other architectures."

Mitigations for speculative execution vulnerabilities like Spectre have been slow to arrive on i386, he added.

Key to the issue is not so much a lack of desire to support i386, but more that the infrastructure to test and maintain on i386 can no longer be taken for granted. "The folks who care about it should probably start thinking about building more organization and structure around the work, recruiting people, building a task list, and so forth, instead of just assuming 'Oh, everything will work on i386, it always has'," said a developer.

Despite the continued support for i386 in the last release, "Buster", the caveats in this discussion show that it will be less secure than 64-bit builds and that this may well be the final version of Debian that will boot on i386 – even though some 32-bit support will likely live on for compatibility reasons. ®