Hi all, here is the progress report on Valve sponsored work in Q3 2026.
## Signstar Since last quarter, we have worked on the following: - Established the new YAML-based configuration file format.- Added support for the configuration, provisioning and use of YubiHSM2 devices. - Implemented a dedicated configuration file format for issuing signing requests.
- Added support for the download of OpenPGP certificates.We now have a basic working setup which encompasses provisioning YubiHSM2 backends using a config file, OpenPGP certificate retrieval and the generation of OpenPGP signatures for files. This setup can be run in a virtual machine, or tried on a hardware machine and has been showcased in a workshop at Arch Linux Summit 2026 in Hamburg, Germany.
Currently and in the near future we are working on:- Consolidate the amount of crates to reduce CI roundtrip time and streamline client and host installation.
- Add backup format and support for YubiHSM2 backends.- Add support for Shamir's Secret Sharing and download of administrative credentials.
To allow people without a physical HSM device to help us test the Signstar host and communication, we are currently working towards a fully virtualized setup. While this can be run locally, we are also now looking into pushing such a setup into a centralized dummy staging environment, which can be used by the buildbtw project.
Generally, you can follow our work on the [Signstar] and [Signstar OS] projects and currently more specifically the
[Virtual Test System milestone for Signstar] and the [Virtual Test System milestone for Signstar OS]. ## BuildbtwContinuing the work mentioned in the last report, we have finished these work items:
- Added bot API tokens so the GitLab executor can upload build artifacts to the buildbtw server - As an alternative to the local build functionality mentioned in the last report, the buildbtw server can now create GitLab pipelines to build packages
- More CLI subcommands:
- `bbtw stop` to stop open buildspaces
- `bbtw log` for getting and tailing a build's log
- `bbtw download` for downloading a buildspace's built packages
- The buildbtw server now serves pacman repos which are used by
subsequent builds in the same iteration
- Designed two boundary diagrams, one from a user perspective, and one
from a DevOps perspective
- Many other smaller work items :) Next steps and in-progress work: - Finish the threat modeling based on our boundary diagrams- Doing this will allow us to deploy a runner for production (we decided we wouldn't trust a production runner deployment before this is done) - Deploy the GitLab executor to more capable servers to increase build capacity - Dealing with loops during graph calculation so we can build almost any package graph
- Improve command user experience based on feedbackAt Arch Summit 2026, we held a workshop where we showed off a fully working GitLab pipeline build for our packagers. The workshop was a success and people seemed to generally like the direction of the new tooling.
As part of the conclusion of the summit, we closed [milestone 1] and have started work on [milestone 2]. As always, you can follow us over at GitLab [gitlab-buildbtw].
## Meeting Notes Meeting notes are available for staff in the [internal-notes] repository. [Signstar]: https://gitlab.archlinux.org/archlinux/signstar [Signstar OS]: https://gitlab.archlinux.org/archlinux/signstar-os[Virtual Test System milestone for Signstar]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/6 [Virtual Test System milestone for Signstar OS]: https://gitlab.archlinux.org/archlinux/signstar-os/-/milestones/2 [milestone 1]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/10 [milestone 2]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/13 [gitlab-buildbtw]: https://gitlab.archlinux.org/archlinux/buildbtw/-/boards/24162 [internal-notes]: https://gitlab.archlinux.org/archlinux/internal-notes/-/tree/main/valve
OpenPGP_signature.asc
Description: OpenPGP digital signature
