$ the-wire · showcase
PGP LIBRARY OVERHAUL FORCES SIGNSTAR CODE REWRITE
By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology
Arch's package signing infrastructure absorbed a breaking change in the pgp crate that required immediate adjustments to Ed25519 key handling.
The signstar project updated its Rust dependency to pgp 0.20 [1], which introduced breaking changes to how the library handles legacy Ed25519 secret key parameters. The migration forced code adjustments in the core package signing layer to accommodate the new PlainSecretParams API [1]. Meanwhile, across the broader repository state, routine maintenance continued with GNOME ecosystem updates: gnome-maps bumped to 50.2-1 [2], gnome-sudoku to 50.2.1-1 [3], and libshumate to 1.6.2-1 [4] to maintain compatibility with the latest GNOME 50 stack. miniflux, the lightweight feed reader, shipped 2.3.2-1 [5] with its own set of improvements. These ecosystem updates are solid but routine. The real story is signstar's forced adaptation: it's the kind of upstream breaking change that catches package maintainers mid-cycle, and Arch handled it cleanly.
Action items
- → Verify signstar builds cleanly in your test environment against pgp 0.20 archlinux/signstar [immediate]
- → Plan GNOME ecosystem upgrades if you maintain packages in the 50.x stack archlinux/svntogit-extra [plan]
References
- [1] fix(deps): Update Rust crate pgp to 0.20 ↗ archlinux/signstar
- [2] update gnome-maps to 50.2-1 in extra-x86_64 archlinux/state ↗
- [3] update gnome-sudoku to 50.2.1-1 in extra-x86_64 archlinux/state ↗
- [4] update libshumate to 1.6.2-1 in extra-x86_64 archlinux/state ↗
- [5] update miniflux to 2.3.2-1 in extra-x86_64 archlinux/state ↗
