Arch Linux and Valve Collaboration

[uyzstvqs]

> Valve is generously providing backing for two critical projects that will have a huge impact on our distribution: a build service infrastructure and a secure signing enclave.

It sounds like Valve is investing in the security of Arch Linux's build infrastructure to prevent supply chain attacks.

[cyanmagenta]

I really hope Arch moves to a model like Debian where all packages are built by a central build server. The current strategy—having dozens of different developers compile stuff on their laptops, sign it personally, and then upload the binary blob—leaves a bit to be desired for obvious reasons.

[AmpsterMan]

As a novice Arch user, I never realized this is why I needed to update keys often

[wiktor-k]

That's exactly what's happening.

[tetris11]

If builds are reproducible, what's the issue?

[Sabinus]

It's incredible how, as a privately owned company, Valve avoids the profit chasing short termism of the publically traded companies.

[beeflet]

>secure signing enclave

wonder what this involves? TPM stuff?

[T3OU-736]

Usually, at that level, an HSM (Hatdware Security Module (ex: https://www.entrust.com/products/hsm), but also a fair number of processes and procedures around things like private key generation, key attestation, key verification, certificate renewals, etc etc etc).

There are some parallels with a TPM, but also a great deal of divergence (more so than in common, really).

[Foxboron]

Partially. David Runge held a talk about the Secure Signing enclave at All-Systems-Go.

https://media.ccc.de/v/all-systems-go-2024-263-boring-infras...

[brnt]

I hope a stable branch may result.

[RandomThoughts3]

Arch already has a stable branch. If you mean a branch which doesn’t update packages and where "maintainers" pretend they back port "essential" fixes by randomly patching what they ship, I hope it never happens because it would mean Arch is truly dead.

[Am4TIfIsER0ppos]

Stability is attained by never updating.