Project Status Update - week 9

Security work still occupies the majority of my time, but, I've been able to squeeze a lot of maintenance in this week.

New images will come in the next week

No new images this week. The next live-usb image will boot quietly, have lowerthird, and offer Plasma as a desktop choice in the installer. Should be within a few days.

This week's content releases (packages)

• The Buildroot-7.x cycle finished at Buildroot-7.4, with LLVM 23.1.4 and Rust 1.99.1. Sandcastle-Base is floored on it now, and every Rust-based package was rebuilt, over 1,100 of them in one go.
• Linux-kernel-stable 7.2.13 through 7.2.15 came out. The big IPv4 bug was already fixed in .10.
• DKMS 3.4.4, patched to work with our kernels in erofs images. See Out-of-tree kernel modules.
• New on the GTK side: GIMP, Darktable, Inkscape, FreeCAD, Impression, Resources, PDF Arranger, EasyEffects, Warehouse and Flatseal for Flatpak apps, Gear Lever for AppImages, Extension Manager, Video Downloader and Fedora Media Writer
• New on the Qt side: Kdenlive, qBittorrent, Remmina, HandBrake and OpenRGB
• Thunderbird, as mail, next to the browser, which is at 159.0
• Wine 11.0. Bare for now.
• Games and emulators: RetroArch, ScummVM, Dolphin, PPSSPP, melonDS and Supermodel, and Luanti 5.18
• New on the server side: PostgreSQL 18.6, MariaDB 13.1, PHP, Valkey, memcached, Mosquitto, OpenLDAP, Unbound, and Dovecot with Pigeonhole
• Python 3.15.2, systemd 262.1, mesa 26.2.6, pipewire 1.6.11, qemu 11.1.3, nodejs 24.22.2, OBS Studio 33.0.1, tzdata 2026f
• More of the stateless work, this time bash and the other shells

This week's bugs and issues

• The +plasma and +plasma-login sets had some inconsistencies, including a misnamed set. Fixed.
• pkg list | head and friends made pkg panic when the pipe closed. It now exits quietly, like any other command.
• pkg repair could write through a symlinked directory. It no longer does.
• pkg remove +a +b didn't remove +a when +b was already gone.
• Cloud images whose clock started behind the image's build time could hide what instance-setup wrote at first boot.
• The mouse cursor stayed on screen during shutdown. lowerthird now turns it off.
• boot-manager left cached initrds behind when it removed old kernels.

Reproducibility audit

Issues were found in pyside6-6.11.3-3 (patched), bash-5.3-20 (patched) and libb2-0.98.1-2 (patched). All were nondeterminism issues in their respective build chains, exposed by our audit runners.

A new cython-3.3.0-2 issue appeared this morning. It appears a generated code file isn't deterministic. We're investigating at this time.

The reproducibility audit runs 24/7 and continues to rebuild existing packages over and over to validate our reproducible builds promise. Verifying reproducible builds shows how to rebuild a package yourself, now with pkg-repo-buildroot-7-4 for newer Sandcastle-Base packages.

This week's dispatch changes (the builder and pkg)

• The CVE gate is live: every package needs a decided CVE identity before it can be promoted. A package with no identity is refused. The operator can also rule a vulnerability "not affected" for one package, and that ruling is published with it. See The CVE train never stops for why.
• Agents can suggest identities for a package, with sample records as evidence, but the operator decides. The opinion workers that do this (for CVE identities and for licenses) can now use any model.
• pkg trusts keys only forward from the root key it has pinned, and pkg repo add saves the older roots it checked. This follows the proxy fix in 0.0.104. --trust-key lets you trust an extra key for one install, upgrade or rollback.
• The root ceremony tooling refuses to co-sign anything it wouldn't have built itself, and requires the previous root.
• pkg build keeps the Buildroot packages and sources it downloads, so a second build doesn't fetch them again. pkg provenance caches are bounded.
• pkg shows a spinner while it applies an upgrade.
• The repo server can evict old builds from the published repos, and dispatch-tui has a new retention tab to plan and run that. dispatch-tui can also seal a finished repo.
• Ruby gems are now a build system the builder understands, with automatic dependencies from their gemspecs.
• The agent tools no longer assume Claude Code. There's an AGENTS.md for any coding agent, and the skills work with any harness.
• New fuzz tests for the parsers that read archives, tarballs and lock files.
• pkg 0.0.101 through 0.0.115 were released this week. Some of these were not released through the build system.

Booting quietly

The boot menu is hidden by default now, with a 2 second timeout. Press Esc to get it back (boot-manager.toml(5)). The same 2 seconds is how long the lowerthird text waits before the system continues. Desktop installs and the live medium boot quietly: no kernel messages, just the logo, one line of text, and then the login screen. The ISO images will not use this setup.

Documentation and website changes

• Out-of-tree kernel modules: a guide to DKMS.
• Supported hardware: the proprietary NVIDIA driver works through DKMS. We can't test it ourselves, for lack of hardware.
• The front page is simpler: only the newest post, and each of the four principles links to where it's explained.

What's next

Go outside and get some exercise! I am. Gotta take a break once in a while :)

I've been getting extremely good feedback from new users on our Discord. Please join and discover all the fun things we can do already. It is motivating and an exciting time. It is paying off that we greenfielded the distro designs and it is allowing us to approach problems with an open mind.

I'm going to focus on making the CVE system present vulnerability data directly to the end user. A pkg audit subcommand is the plan - it will fetch and retrieve data that specifically for your own system tells you whether you need to upgrade, and what your risk is. An informed user can make informed decisions, after all.

The test runners that use the exposed APIs to fetch test content and report results are getting an overhaul to be Lua scripted. This generic approach should allow for better testing coverage and allow people to quickly write their own (complex) testing tasks, while being supported by a rich framework that can handle containers, live images and other compositions alike.

This upcoming week we'll post new images with fresh content, and the plasma desktop install option, as well as the nicer boot/shutdown displays.

--sofar (aka Auke)