$ the-wire · showcase
ARCHWEB MATRIX ISOLATION TIGHTENS SECURITY POSTURE
By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology
Arch infrastructure locked down Matrix well-known directory to primary host only, closing a lateral exposure vector across mirror and secondary deployments.
The infrastructure team merged a critical change [1] [2] that restricts `.well-known/matrix` installation to the main archweb instance, preventing accidental or malicious matrix protocol exposure on distributed deployments. This closes a known work item and hardens the attack surface for services running on secondary infrastructure. On the packages side, python-requests bumped to 2.34.0 [3], bringing dependency freshness across the ecosystem. nvhpc updated to 26.3-3 [4] for users running NVIDIA HPC workflows. Stalwart mail stack received dual updates—webadmin to 1.0.4 and cli to 1.0.6 —addressing improvements in the mail server toolchain. Ruby tooling also moved forward with mixlib-config to 3.1.5 .
Action items
- → Review archweb deployment configuration to confirm matrix limitation is active archlinux/infrastructure [immediate]
- → Pull python-requests 2.34.0 in your next dependency refresh cycle archlinux/packages [plan]
- → Update nvhpc and stalwart tooling if running HPC or mail services archlinux/packages [plan]
References
- [1] Merge branch 'limit_matrix_archweb' ↗ archlinux/infrastructure
- [2] archweb: Limit installation of `.well-known/matrix` dir & files to main archweb host ↗ archlinux/infrastructure
- [3] update python-requests to 2.34.0-1 in extra-any archlinux/state ↗
- [4] update nvhpc to 26.3-3 in extra-x86_64 archlinux/state ↗
