Update on Valve sponsored work in Q2 2026

[Sven-Hendrik Haase]

Hi all,

Here is the progress report on Valve sponsored work in Q2 2026.

## Signstar

Since last quarter, we have worked on the following:

- YubiHSM backup (wrap) functionality
  - Encryption of ed25519 keys.
  - Validation of encrypted form.
  - Compatibility with Yubico's tooling and the real YubiHSM2 hardware.
  - CLI tooling for dumping and creating backup files.
  - Documentation for the YubiHSM Wrap (YHW) format.
- Fixes for several issues in the [yubihsm.rs upstream] project.

- Simplified/Unified state handling for HSM backend and host data.
- Improved key handling for backup (wrap) keys of the YubiHSM2 backend.

- Separate repository for the `mkosi` based Signstar OS.

- Talk about the project at [foss-north] (see [youtube video] and [slides]).

Currently and in the near future we are working on:

- Finishing the provisioning module for the YubiHSM2 backend.
- Extending tests for automatable workflows against the YubiHSM2.
- Adding integration for and setting up the virtual test system.



## Buildbtw




- Deployed GitLab Executor
- Packages are now added to per-buildspace pacman repos when built
- Better local secret handling
- CLI snapshot testing


Next steps and in-progress work

- More CLI subcommands: `bbtw list`, `bbtw cancel`, `bbtw resume`
- Comprehensive threat modeling (plus boundary diagram)
- Serve pacman repos
- Lots of testing to make sure everything is actually working together
- Separate out the repo-updater crate into its own project








## Meeting Notes

Meeting notes are available for staff in the [internal-notes] repository.

[Signstar GitLab]: https://gitlab.archlinux.org/archlinux/signstar
[Signstar-OS GitLab]: https://gitlab.archlinux.org/archlinux/signstar-os

- New YAML-based Signstar configuration file format, covering multiple possible HSM backends. - Documentation improvements on internal formats, community and media pages on the [Signstar website]. - New, more robust configuration file format for the `signstar-request-signature` executable with support for configuring multiple target hosts. - Improvements to signstar-yubihsm2 as library for automatable YubiHSM2 provisioning. - Safer abstractions around YubiHSM2 capabilities, domains, passphrases and keys; better error handling when querying backend data. Generally, you can follow our work on the [Signstar GitLab] and [Signstar-OS GitLab] projects. Until the end of next quarter we are working on finishing the [basic YubiHSM2 integration] and the [virtual test system]. Continuing the work mentioned in the last report, we have finished these work items: - Added bbtw CLI subcommands: `bbtw new` for creating buildspaces (collections of packages that should land in the same rebuild), `bbtw show` for listing builds, and `bbtw auth login` for logging in - The buildbtw server now has a mode for running builds directly on the local machine using vmexec. This is particularly handy for folks wanting to set up their own build server, to experiment, develop, or self-host - Many other maintenance changes: better CI, more extensive docs, refactorings - Adding bot API tokens so the GitLab Executor can authenticate against the buildbtw server - GitLab pipeline scheduling (this got pushed back in favor of the server's local build mode) - API docs: we've decided to hold off on making a stable and documented API until the rate of change has slowed down somewhat We have done some fairly strict prioritization on the remaining issues for this milestone and are trying to only work in issues marked as **must** to make sure we can get buildbtw into the hands of testers and maintainers as quickly as possible. We cannot promise anything, but our goal is to get a beta version into your hands at the Arch Linux Summit in October to gather feedback and ideas. As always, you can follow us over at GitLab [gitlab-buildbtw] and specifically the current milestone [buildbtw-milestone]. [buildbtw-milestone]: https://gitlab.archlinux.org/archlinux/buildbtw/-/milestones/10 [gitlab-buildbtw]: https://gitlab.archlinux.org/archlinux/buildbtw/-/boards/24162 [internal-notes]: https://gitlab.archlinux.org/archlinux/internal-notes/-/tree/main/valve [yubihsm.rs upstream]: https://github.com/iqlusioninc/yubihsm.rs/pulls?q=is%3Apr+author%3Awiktor-k

[youtube video]: https://youtu.be/mEF-6sftu4E
[slides]: https://pkgbuild.com/~dvzrv/presentations/foss-north-2026/
[foss-north]: https://foss-north.se/
[Signstar website]: https://signstar.archlinux.page/

[basic YubiHSM2 integration]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/12 [virtual test system]: https://gitlab.archlinux.org/archlinux/signstar/-/milestones/6

OpenPGP_signature.asc
Description: OpenPGP digital signature