July 2026 - Arch-dev-public - lists.archlinux.org

glibc 2.44 in testing - moving to stable repos affected
by Frederik Schwan 25 Jul '26

25 Jul '26

I'm about to push glibc 2.44 to testing. Do not move packages linked against 2.44 to extra or core until glibc itself moves. Otherwise the package will probably break. Best regards, Frederik

1 0

News draft: virtualbox-ext-vnc >= 7.2.12-2 requires manual intervention
by Christian Hesse 17 Jul '26

17 Jul '26

Hello everybody, I am about to clean up and fix the virtualbox-ext-vnc package, which is a split package of virtualbox. This requires manual intervention, so about to publish a news item. David and I came up with this. Please speak up if you have any improvements. --- 8< --- virtualbox-ext-vnc >= 7.2.12-2 requires manual intervention Previously, we installed its contents in a way that made `pacman` not aware of the files (using `VBoxManage extpack install ...` from an install script). To mitigate issues during upgrade, you can use one of the following methods: - Uninstall `virtualbox-ext-vnc` before upgrading the system, then installing it again. - Run `VBoxManage extpack uninstall 'VNC'` as root before upgrading the system. - Instruct `pacman` once to overwrite the existing files: ```bash pacman -Syu --overwrite '/usr/lib/virtualbox/ExtensionPacks/VNC/*' ``` --- 8< --- -- main(a){char*c=/* Schoene Gruesse */"B?IJj;MEH" "CX:;",b;for(a/* Best regards my address: */=0;b=c[a++];) putchar(b-1/(/* Chris cc -ox -xc - && ./x */b/42*2-3)*42);}

1 0

GCC: libatomic and libstdc++ link precendence screwed
by Frederik Schwan 14 Jul '26

14 Jul '26

I've screwed up the latest gcc change. Please be aware that anything that links against libatomic or libstdc++ is linked against its static variant atm which may cause trouble. 1. Do not remove libatomic or libstdc++ dependencies from dependency arrays. 2. If possible refrain from building packages with those dependencies. Sorry for the inconvenience, I'm (or rather the build server is) working as fast as possible to get a fix out. Frederik

1 1

Update on Valve sponsored work in Q2 2026
by Sven-Hendrik Haase 03 Jul '26

03 Jul '26

Hi all, Here is the progress report on Valve sponsored work in Q2 2026. ## Signstar Since last quarter, we have worked on the following: - YubiHSM backup (wrap) functionality - Encryption of ed25519 keys. - Validation of encrypted form. - Compatibility with Yubico's tooling and the real YubiHSM2 hardware. - CLI tooling for dumping and creating backup files. - Documentation for the YubiHSM Wrap (YHW) format. - Fixes for several issues in the [yubihsm.rs upstream] project. - New YAML-based Signstar configuration file format, covering multiple possible HSM backends. - Simplified/Unified state handling for HSM backend and host data. - Improved key handling for backup (wrap) keys of the YubiHSM2 backend. - Documentation improvements on internal formats, community and media pages on the [Signstar website]. - Separate repository for the `mkosi` based Signstar OS. - New, more robust configuration file format for the `signstar-request-signature` executable with support for configuring multiple target hosts. - Improvements to signstar-yubihsm2 as library for automatable YubiHSM2 provisioning. - Safer abstractions around YubiHSM2 capabilities, domains, passphrases and keys; better error handling when querying backend data. - Talk about the project at [foss-north] (see [youtube video] and [slides]). Currently and in the near future we are working on: - Finishing the provisioning module for the YubiHSM2 backend. - Extending tests for automatable workflows against the YubiHSM2. - Adding integration for and setting up the virtual test system. Generally, you can follow our work on the [Signstar GitLab] and [Signstar-OS GitLab] projects. Until the end of next quarter we are working on finishing the [basic YubiHSM2 integration] and the [virtual test system]. ## Buildbtw Continuing the work mentioned in the last report, we have finished these work items: - Added bbtw CLI subcommands: `bbtw new` for creating buildspaces (collections of packages that should land in the same rebuild), `bbtw show` for listing builds, and `bbtw auth login` for logging in - The buildbtw server now has a mode for running builds directly on the local machine using vmexec. This is particularly handy for folks wanting to set up their own build server, to experiment, develop, or self-host - Deployed GitLab Executor - Packages are now added to per-buildspace pacman repos when built - Better local secret handling - CLI snapshot testing - Many other maintenance changes: better CI, more extensive docs, refactorings Next steps and in-progress work - Adding bot API tokens so the GitLab Executor can authenticate against the buildbtw server - GitLab pipeline scheduling (this got pushed back in favor of the server's local build mode) - More CLI subcommands: `bbtw list`, `bbtw cancel`, `bbtw resume` - Comprehensive threat modeling (plus boundary diagram) - Serve pacman repos - Lots of testing to make sure everything is actually working together - Separate out the repo-updater crate into its own project - API docs: we've decided to hold off on making a stable and documented API until the rate of change has slowed down somewhat We have done some fairly strict prioritization on the remaining issues for this milestone and are trying to only work in issues marked as **must** to make sure we can get buildbtw into the hands of testers and maintainers as quickly as possible. We cannot promise anything, but our goal is to get a beta version into your hands at the Arch Linux Summit in October to gather feedback and ideas. As always, you can follow us over at GitLab [gitlab-buildbtw] and specifically the current milestone [buildbtw-milestone]. ## Meeting Notes Meeting notes are available for staff in the [internal-notes] repository. [Signstar GitLab]: https://gitlab.archlinux.org/archlinux/signstar [Signstar-OS GitLab]: https://gitlab.archlinux.org/archlinux/signstar-os [buildbtw-milestone]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/10 [gitlab-buildbtw]: https://gitlab.archlinux.org/archlinux/buildbtw/-/boards/24162 [internal-notes]: https://gitlab.archlinux.org/archlinux/internal-notes/-/tree/main/valve [yubihsm.rs upstream]: https://github.com/iqlusioninc/yubihsm.rs/pulls?q=is%3Apr+author%3Awiktor-k [youtube video]: https://youtu.be/mEF-6sftu4E [slides]: https://pkgbuild.com/~dvzrv/presentations/foss-north-2026/ [foss-north]: https://foss-north.se/ [Signstar website]: https://signstar.archlinux.page/ [basic YubiHSM2 integration]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/12 [virtual test system]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/6

1 0

RFC: Improve Rust builds with better release profile defaults
by Caleb Maclennan 03 Jul '26

03 Jul '26

A new RFC (request for comment) has been opened here: https://gitlab.archlinux.org/archlinux/rfcs/-/merge_requests/69 Please visit the above link for discussion. Summary: Add support to `makepkg` for passing Cargo/Rust specific environment variables. Include defaults suited to Arch packaging.

1 0

On vacation in July
by Morten Linderud 02 Jul '26

02 Jul '26

Yo, I'll be off and/or less active during July for summer vacation and chilling. Heading for Manchester, EMF camp and Edinburgh between 12th and 26th of July if anyone wanna meet. If any packages needs to be updated, feel free. I also won't be looking at mkinitcpio and arch-install-scripts. If there is an emergency there please patch the package and submit merge requests to the upstream repositories :) I will be reachable over signal and/or/possibly/maybe Matrix if there is something super important. I'll be be back August. Side note for more vacation stuff: For September/October I'll be attending All-Systems-Go, Linux Plumbers and possibly Linux Security Summit in Berlin and Prague, and Chaos Communication Congress in December. -- Morten Linderud PGP: 9C02FF419FECBE16

1 0

archlinux.org status update
by Jelle van der Waa 01 Jul '26

01 Jul '26

Hi all, I've just rolled out a new updated archlinux.org, notable changes are: * Developer reports now contain a link to a list of pkgbases * bumpbuddy out of date data import support The bumpbuddy import has now been deployed and is running. See for example aws-vault being flagged by bumpbbuddy. Note that the automatic import doesn't send any email notification like the manual flagging out of date does. [1] In the future the flag out of date button will be disabled in favor of importing bumpbuddy out of date data. Note that we still lack nvchecker integration in packages in this To-Do. [2] [1] https://archlinux.org/packages/extra/x86_64/aws-vault/ [2] https://archlinux.org/todo/add-nvchecker-integration/

4 6