Support us on Patreon
PayPalSeems like Arch Linux is going from strength to strength lately. Not only have Valve begun funding parts of the Linux distribution but now the Sovereign Tech Agency are as well.
Writing in an announcement on the Arch Linux development mailing list developer David Runge shared the news that Sovereign Tech Agency provided funding for developers Arne Christian Beer, Heiko Schäfer, Orhun Parmaksız and David Runge to work on ALPM part time over 15 months. Work started back in October, with it expected to continue through until the end of 2025.
The announcement mentions the funding supports multiple milestones for the project, which I've noted below:
Article taken from GamingOnLinux.com.Formal specifications for packaging data formats
The Arch Linux packaging ecosystem uses underspecified/undocumented file and metadata types, yet we need to be able to use them reliably in other contexts such as package creation, build and package repository management tooling.
Therefore this milestone involves developing versioned specifications for all low-level descriptor file and implementing Rust libraries based on them. These will be based on the existing ad-hoc reference implementations in
makepkg and pacman.Basic OpenPGP verification of artifacts
Signature verification in Arch Linux package management currently hinges on a stateful GnuPG keyring. This solution is brittle and has already caused various issues related to the Arch Linux keyring in the past.
To simplify signature verification - while at the same time enabling the use of a more diverse set of cryptographic technologies - a specification for the UAPI group will be written. An accompanying Rust library will be provided as a simple and stateless integration, not limited to use in Arch Linux.
Rust library for handling of individual packages
The structure of Arch Linux package files is currently not explicitly defined. This milestone focuses on providing a formal specification of what an ALPM-based package contains, how it is created and handled. A dedicated Rust library and tool will facilitate package creation, validation and installation.
These new Rust libraries will also expose a C API for possible integration into the C-based libalpm library.
Rust library for system package management
This milestone revolves around the use of the previously implemented components by providing a library for package download, validation, verification, installation and state handling similar to pacman's libalpm and will handle sets of individual packages on user systems.
A C-API will be provided for compatibility with libalpm-based applications.
One specific concern of this milestone is modernizing the OpenPGP integration.
Current package management tooling does not allow for scoping signature verifiers (e.g. OpenPGP certificates) for a specific purpose, such as "only packages" or "only repository metadata".
The new system will rely on a stateless approach such as the one to be proposed as specification to the UAPI group.
Distribution-agnostic OpenPGP stack for the verification of distribution artifacts
This milestone will focus on a set of foundational libraries, based on a UAPI specification from a previous milestone.
These libraries will add support for PGPKI (aka the “Web of Trust”) in the generic directory structure for OpenPGP certificates used for the verification of distribution artifacts.The libraries mentioned above will be integrated into the ALPM context to allow for example the full verification of packages and repository metadata.
A Rust-based solution will be provided as a modern alternative to the current
GnuPG-based approach.The outcome(s)
The ALPM project strives to build a modern, sustainable, maintainable and memory-safe framework for the Arch Linux packaging ecosystem. This framework will enable robust and predictable integration for all package
related tooling and libraries.The project goals are intentionally ambitious while being constrained to a relatively short period of time.
The work is organized so that real world benefits will happen early and often. Several infrastructure related projects have already reached out with a concrete interest to make use of libraries created in the first phase of the project.
The work will be done in the open, on the Arch Linux GitLab.
Everyone and anyone is welcome to join in and help out!
Arehandoro a day ago
Quoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:
Me too :D I had to google it. Apparently it's a german federal tech agency.
Quoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:
It's EU politico speak.
I think it's best translated to American with "America first!"
If European governments try to rid themselves of dependencies of goods and services from parties, whose reliability and stability they're too polite to question they call it a push for sovereignty.
France pleads for an EU army for this reason.
Germany maintains a pretty big military industry for it.
The EU is importing lots extra expensive gass from the USA for this reason.
Its why the EU sometimes tries to get an internal mining industry(until they discover that the reason they don't have one is, because they care about human rights, environmental protections, etc)
Most of the time it means moving away from USA provided goods and services, but not always.
Quoting: LoudTechieQuoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:
It's EU politico speak.
I think it's best translated to American with "America first!"
If European governments try to rid themselves of dependencies of goods and services from parties, whose reliability and stability they're too polite to question they call it a push for sovereignty.
France pleads for an EU army for this reason.
Germany maintains a pretty big military industry for it.
The EU is importing lots extra expensive gass from the USA for this reason.
Its why the EU sometimes tries to get an internal mining industry(until they discover that the reason they don't have one is, because they care about human rights, environmental protections, etc)
Most of the time it means moving away from USA provided goods and services, but not always.
Can't say I blame them. I'd be trying to move away from dependency on the US too, especially with that POS Trump assuming office next month. He's extremely hostile towards Europe, so If I were them I'd cut ties as quickly as possible.
Linux_Rocks 19 hours ago
redneckdrow 17 hours ago
Quoting: Leahi84Quoting: LoudTechieQuoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:
It's EU politico speak.
I think it's best translated to American with "America first!"
If European governments try to rid themselves of dependencies of goods and services from parties, whose reliability and stability they're too polite to question they call it a push for sovereignty.
France pleads for an EU army for this reason.
Germany maintains a pretty big military industry for it.
The EU is importing lots extra expensive gass from the USA for this reason.
Its why the EU sometimes tries to get an internal mining industry(until they discover that the reason they don't have one is, because they care about human rights, environmental protections, etc)
Most of the time it means moving away from USA provided goods and services, but not always.
Can't say I blame them. I'd be trying to move away from dependency on the US too, especially with that POS Trump assuming office next month. He's extremely hostile towards Europe, so If I were them I'd cut ties as quickly as possible.
Hey, don't look at me; I didn't vote for him! But 66% of my state did, for some God forsaken reason.
Also, be careful using the phrase "America First" around a US history buff. It was the name of Lindbergh's isolationist party just prior to WW2. His few modern fans like to forget his ties to Nazi Germany.
America First had nothing to do with actually expanding domestic reliability, and would have destroyed the New Deal and the Lend-Lease Act. Thereby preventing our rise out of the Great Depression.
no_information_here 12 hours ago
Quoting: BrokattI had to google it. Apparently it's a german federal tech agency.
Yes, my first question was Sovereign to which country?
It would have been great to have more context:
https://en.wikipedia.org/wiki/Sovereign_Tech_Fund
Even their website avoids saying anything about Germany on most pages. Weird.
https://www.sovereign.tech/about
CyborgZeta 9 hours ago
Quoting: Leahi84I wish them luck with that. Europe is extremely reliant on the US for defense. Especially Germany.Quoting: LoudTechieQuoting: ArehandoroThis is the only thing that comes to mind each time I read Sovereign:
It's EU politico speak.
I think it's best translated to American with "America first!"
If European governments try to rid themselves of dependencies of goods and services from parties, whose reliability and stability they're too polite to question they call it a push for sovereignty.
France pleads for an EU army for this reason.
Germany maintains a pretty big military industry for it.
The EU is importing lots extra expensive gass from the USA for this reason.
Its why the EU sometimes tries to get an internal mining industry(until they discover that the reason they don't have one is, because they care about human rights, environmental protections, etc)
Most of the time it means moving away from USA provided goods and services, but not always.
Can't say I blame them. I'd be trying to move away from dependency on the US too, especially with that POS Trump assuming office next month. He's extremely hostile towards Europe, so If I were them I'd cut ties as quickly as possible.
ElectricPrism 8 hours ago
Quoting: WorMzyHopefully the user-facing packaging system remains as simple as it is currently. The PKGBUILD+makepkg way of creating packages is one of the main strengths of Arch.
Strongly Agree. PKGBUILD is amazing, I hope Arch doesn't do anything to complicate -- this is just like Prime Numbers and Exponents -- there is a optimal amount of complexity and a optimal amount of simplicity -- otherwise we would all program exclusively in assembly.
What I could get behind:
1. Optionally compile every package from source, and steal all the good ideas from Gentoo (Flags, Patches in etc)
2. LAN Mirrors. It would be nice if it were possible for Arch to ask LAN computers to also act as Mirrors -- then instead of downloading the same package 3-16 times it could be transferred locally similar to how Steam allows LAN to reduce bandwidth load and increase update speed on games.
3. Roll-back -- undoing the last software update in-case it has a problem or you just don't like it.
4. Set a target installation date where installed packages don't exceed X date and pull from the Arch Archive. (AFAIK this is presently possible to an extent)
5. More target architectures to compile against, ARM, RISCV
6. Warnings of new Arch News __prior__ to important updates which introduce breakage, eg: Pacman 6 => 7
See more from me