Seems like Arch Linux is going from strength to strength lately. Not only have Valve begun funding parts of the Linux distribution but now the Sovereign Tech Agency are as well.
Writing in an announcement on the Arch Linux development mailing list developer David Runge shared the news that Sovereign Tech Agency provided funding for developers Arne Christian Beer, Heiko Schäfer, Orhun Parmaksız and David Runge to work on ALPM part time over 15 months. Work started back in October, with it expected to continue through until the end of 2025.
The announcement mentions the funding supports multiple milestones for the project, which I've noted below:
Article taken from GamingOnLinux.com.Formal specifications for packaging data formats
The Arch Linux packaging ecosystem uses underspecified/undocumented file and metadata types, yet we need to be able to use them reliably in other contexts such as package creation, build and package repository management tooling.
Therefore this milestone involves developing versioned specifications for all low-level descriptor file and implementing Rust libraries based on them. These will be based on the existing ad-hoc reference implementations in
makepkg and pacman.Basic OpenPGP verification of artifacts
Signature verification in Arch Linux package management currently hinges on a stateful GnuPG keyring. This solution is brittle and has already caused various issues related to the Arch Linux keyring in the past.
To simplify signature verification - while at the same time enabling the use of a more diverse set of cryptographic technologies - a specification for the UAPI group will be written. An accompanying Rust library will be provided as a simple and stateless integration, not limited to use in Arch Linux.
Rust library for handling of individual packages
The structure of Arch Linux package files is currently not explicitly defined. This milestone focuses on providing a formal specification of what an ALPM-based package contains, how it is created and handled. A dedicated Rust library and tool will facilitate package creation, validation and installation.
These new Rust libraries will also expose a C API for possible integration into the C-based libalpm library.
Rust library for system package management
This milestone revolves around the use of the previously implemented components by providing a library for package download, validation, verification, installation and state handling similar to pacman's libalpm and will handle sets of individual packages on user systems.
A C-API will be provided for compatibility with libalpm-based applications.
One specific concern of this milestone is modernizing the OpenPGP integration.
Current package management tooling does not allow for scoping signature verifiers (e.g. OpenPGP certificates) for a specific purpose, such as "only packages" or "only repository metadata".
The new system will rely on a stateless approach such as the one to be proposed as specification to the UAPI group.
Distribution-agnostic OpenPGP stack for the verification of distribution artifacts
This milestone will focus on a set of foundational libraries, based on a UAPI specification from a previous milestone.
These libraries will add support for PGPKI (aka the “Web of Trust”) in the generic directory structure for OpenPGP certificates used for the verification of distribution artifacts.The libraries mentioned above will be integrated into the ALPM context to allow for example the full verification of packages and repository metadata.
A Rust-based solution will be provided as a modern alternative to the current
GnuPG-based approach.The outcome(s)
The ALPM project strives to build a modern, sustainable, maintainable and memory-safe framework for the Arch Linux packaging ecosystem. This framework will enable robust and predictable integration for all package
related tooling and libraries.The project goals are intentionally ambitious while being constrained to a relatively short period of time.
The work is organized so that real world benefits will happen early and often. Several infrastructure related projects have already reached out with a concrete interest to make use of libraries created in the first phase of the project.
The work will be done in the open, on the Arch Linux GitLab.
Everyone and anyone is welcome to join in and help out!
Quoting: no_information_hereQuoting: BrokattI had to google it. Apparently it's a german federal tech agency.
Yes, my first question was Sovereign to which country?
It would have been great to have more context:
https://en.wikipedia.org/wiki/Sovereign_Tech_Fund
Even their website avoids saying anything about Germany on most pages. Weird.
https://www.sovereign.tech/about
It's not immediately clear, but they don't exactly hide it either: https://www.sovereign.tech/faq.
ElectricPrism 8 hours ago
Quoting: CyborgZetaI wish them luck with that. Europe is extremely reliant on the US for defense. Especially Germany.
I would seem not everyone knows that USA heavily subsidizes the military costs of the world which allows them to use their own resources on health care and other things.
When I open up a Linux Blog to read the cool new things going on and I find US Politics in the comments and 100% emotional arguments it makes me feel like we're not a serious people -- and that we can't stay pragmatic and keep our criticisms on point. It's really discouraging to see.
Also, as it should be obvious too -- this hyper-emotionalism is no longer popular. If it were these arguments would have worked. But they are democratically considered unpopular.
Quoting: AdutchmanQuoting: no_information_hereQuoting: BrokattI had to google it. Apparently it's a german federal tech agency.
Yes, my first question was Sovereign to which country?
It would have been great to have more context:
https://en.wikipedia.org/wiki/Sovereign_Tech_Fund
Even their website avoids saying anything about Germany on most pages. Weird.
https://www.sovereign.tech/about
It's not immediately clear, but they don't exactly hide it either: https://www.sovereign.tech/faq.
No they don't hide hit. This page is a little bit better.
https://www.sovereign.tech/news/stf-part-of-new-sovereign-tech-agency
Patreon
PayPal
See more from me