Thought the group might find this interesting.

From Red Hat:

Related:
- https://gynvael.coldwind.pl/?lang=en&id=782
- https://www.openwall.com/lists/oss-secu … 24/03/29/4
- https://nvd.nist.gov/vuln/detail/CVE-2024-3094

Changes, Features, Fixes: https://gcc.gnu.org/gcc-14/changes.html
Porting to GCC 14: https://gcc.gnu.org/gcc-14/porting_to.html

Kali is a solid project if you need to use a large number of tools in one place. Many of these tools are widely available in package managers, Docker images, and Git repos. This guide will give you an idea of how and how not to install them outside of Kali, with the intention of installing them in Devuan as applicable.

The project maintains a searchable list of all their tools here: https://www.kali.org/tools/

If you like a tool you used in Kali, and want to use it in your own (Devuan) system, try to find it in this order:

1. With apt search <tool>
2. From a search in pypi.org
3. From Docker Hub (if you can afford the overhead)
4. In a public repository, like Github
5. Pre-built from the project's homepage

Here are some quick-and-dirty examples from a Devuan terminal:

# Inspect network traffic.
sudo apt install wireshark

# Test endpoint parameters.
pip3 install arjun

# Content discovery.
git clone https://github.com/assetnote/kiterunner && \
cd kiterunner && \
make build

# Web application testing.
wget -O zap-install.sh https://github.com/zaproxy/zaproxy/releases/download/v2.14.0/ZAP_2_14_0_unix.sh && \
bash zap-install.sh

Many of these tools also have a Dockerfile or a docker-compose.yml, so you can build and run it that way if you want. This can simplify the installation process at the cost of overhead, which may prove substantial on lower-end systems. Images maintained by a tool's official project are often fine, but you may want to do your own testing on any image you're pulling from the web.

Many of the GUI tools will require libraries like Java JRE. If you hate Java, you could use a VM, but this will probably introduce more overhead. Just something to keep in mind.

"Rebasing Kali on Devuan" would be a substantial effort. However, nothing is stopping you from setting up your own Devuan test environment with the tools you want to use. The hard part is figuring out what you want and then maintaining the packages, an effort that is easily solved with a shell script or two.

So, yeah, that's the gist of it. Just use the tools you want.

But before I go...

Words of caution.

Something you want to avoid like the plague is repo-mixing: by importing Kali's repositories. This may work fine for some tools, or for some time, but it almost always ends in broken packages or a broken system. I note this because older projects, like katoolin, took this exact route.

You're welcome to test that if you want. (You may want to use a VM.) A quick setup:

wget http://http.kali.org/kali/pool/main/k/kali-archive-keyring/kali-archive-keyring_2022.1_all.deb && \
sudo dpkg -i kali-archive-keyring_2022.1_all.deb && \
rm kali-archive-keyring_2022.1_all.deb && \

echo "deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware" | \
    sudo tee --append /etc/apt/sources.list && \

sudo apt update

After setup completes, you can try to install any of the packages or metapackages. This is a path of pain. For example, you can try:

sudo apt install -t kali-rolling kali-linux-everything
sudo apt install -t kali-rolling wireshark
sudo apt install -t kali-rolling sqlmap
sudo apt install -t kali-rolling tshark

The first two installs failed because of dependency version mismatches: notably, due to the libfreerdp2-2 and libqt6multimedia6 dependencies. The command-line tools (sqlmap and tshark) installed fine; but both of these are readily available from the Devuan repos (and from Pip, or Docker, or source.)

The risks you introduce from mixing repos may not outweigh the reward to just using what's already there. Do some searching before importing packages from another project. Kali is no exception.