October 2026 - Arch-dev-public - lists.archlinux.org

OpenSSL 4 Rebuild
by pierre＠archlinux.de 17 Oct '26

17 Oct '26

Hi all, I have been preparing the rebuild of OpenSSL 4. This affects more than 550 packages. While most packages did not build on release, we are now at a point where mosts do and we have gathered patches or proposed upstream changes. At this point only about 12 packages would need a openssl-3 packages which we would keep on the LTS version 3.5. I would now like to coordinate a time frame when this rebuild can happen. As it's a core part of our system and affects many packages, it would be best or even required if no other rebuilds are happening at the same time. Depending on how many helping hands we end up with I guess we should plan for about two weeks from staging to the release to the core repos. So we should finish the current rebuilds first and if possible also cleanup the testing repos. If other rebuilds are planed, let's figure out in which order to handle these best. Greetings, Pierre PS: I have kept a generated wiki page with the compatibility status of each package: https://gitlab.archlinux.org/archlinux/packaging/packages/openssl/-/wikis/o…

1 1

Central repository to share reproducible builds related patches across distributions
by Robin Candau 15 Oct '26

15 Oct '26

Hi everyone, During this year's Reproducible Builds summit [1], we explored the idea of a central place for distributions to share reproducible builds patches. During said discussion, Bernhard M. Wiedemann (from SUSE / OpenSUSE) [2] remembered that he already created a repository [3] for that purpose about 10 years ago, which we decided to bring back to life! The repository structure is pretty simple, we have one directory per package containing patches as well as eventual documentation, in the form of a README, if relevant (e.g. to document upstreaming efforts or any meaningful information). Bernhard added most Reproducible Builds related patches from OpenSUSE to the repo. I did the same with some Arch Linux patches (but some might be missing). As said at the beginning of this mail, we hope that this repository could serve as a central place for people from various project to share, document and fetch patches (rather than storing and maintaining them on our own respective side). This would facilitate progress regarding our common goal of getting reproducible builds for our respective packages. If anyone else from the Arch team wants to get push access to this repository, please contact and give me your GitHub username. I'll collect all requests and relay them to Bernhard so he can send invites. Additionally, if you have downstream reproducible builds related patches applied to your packages that are not present in this repo yet, please consider pushing them to it (and eventually fetching them from it afterwards in your PKGBUILDs) or feel free to ping me so I can push them for you (in case you don't have push access yet). [1] https://reproducible-builds.org/events/gothenburg2026/ [2] https://github.com/bmwiedemann [3] https://github.com/distropatches/reproducible-builds -- Regards, Robin Candau / Antiz

1 0

Update on Valve sponsored work in Q3 2026
by Sven-Hendrik Haase 08 Oct '26

08 Oct '26

Hi all, here is the progress report on Valve sponsored work in Q3 2026. ## Signstar Since last quarter, we have worked on the following: - Established the new YAML-based configuration file format. - Added support for the configuration, provisioning and use of YubiHSM2 devices. - Implemented a dedicated configuration file format for issuing signing requests. - Added support for the download of OpenPGP certificates. We now have a basic working setup which encompasses provisioning YubiHSM2 backends using a config file, OpenPGP certificate retrieval and the generation of OpenPGP signatures for files. This setup can be run in a virtual machine, or tried on a hardware machine and has been showcased in a workshop at Arch Linux Summit 2026 in Hamburg, Germany. Currently and in the near future we are working on: - Consolidate the amount of crates to reduce CI roundtrip time and streamline client and host installation. - Add backup format and support for YubiHSM2 backends. - Add support for Shamir's Secret Sharing and download of administrative credentials. To allow people without a physical HSM device to help us test the Signstar host and communication, we are currently working towards a fully virtualized setup. While this can be run locally, we are also now looking into pushing such a setup into a centralized dummy staging environment, which can be used by the buildbtw project. Generally, you can follow our work on the [Signstar] and [Signstar OS] projects and currently more specifically the [Virtual Test System milestone for Signstar] and the [Virtual Test System milestone for Signstar OS]. ## Buildbtw Continuing the work mentioned in the last report, we have finished these work items: - Added bot API tokens so the GitLab executor can upload build artifacts to the buildbtw server - As an alternative to the local build functionality mentioned in the last report, the buildbtw server can now create GitLab pipelines to build packages - More CLI subcommands: - `bbtw stop` to stop open buildspaces - `bbtw log` for getting and tailing a build's log - `bbtw download` for downloading a buildspace's built packages - The buildbtw server now serves pacman repos which are used by subsequent builds in the same iteration - Designed two boundary diagrams, one from a user perspective, and one from a DevOps perspective - Many other smaller work items :) Next steps and in-progress work: - Finish the threat modeling based on our boundary diagrams - Doing this will allow us to deploy a runner for production (we decided we wouldn't trust a production runner deployment before this is done) - Deploy the GitLab executor to more capable servers to increase build capacity - Dealing with loops during graph calculation so we can build almost any package graph - Improve command user experience based on feedback At Arch Summit 2026, we held a workshop where we showed off a fully working GitLab pipeline build for our packagers. The workshop was a success and people seemed to generally like the direction of the new tooling. As part of the conclusion of the summit, we closed [milestone 1] and have started work on [milestone 2]. As always, you can follow us over at GitLab [gitlab-buildbtw]. ## Meeting Notes Meeting notes are available for staff in the [internal-notes] repository. [Signstar]: https://gitlab.archlinux.org/archlinux/signstar [Signstar OS]: https://gitlab.archlinux.org/archlinux/signstar-os [Virtual Test System milestone for Signstar]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/6 [Virtual Test System milestone for Signstar OS]: https://gitlab.archlinux.org/archlinux/signstar-os/-/milestones/2 [milestone 1]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/10 [milestone 2]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/13 [gitlab-buildbtw]: https://gitlab.archlinux.org/archlinux/buildbtw/-/boards/24162 [internal-notes]: https://gitlab.archlinux.org/archlinux/internal-notes/-/tree/main/valve

1 0

Heads up: Qt 6.12 in [extra-testing]
by Antonio Rojas 01 Oct '26

01 Oct '26

As usual, this means anything compiled against it will depend on it and has to stay in testing until Qt itself moves.

1 0