RepoJournal
Arch Linux @archlinux
124 wires and counting
$ status: archived — this briefing has stopped; the archive stays readable. browse live briefings →

$ status

wire 2026-08-19
stories 58
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SIGNSTAR PATCHES CRITICAL H2 VULNERABILITY

By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology

Wiktor Kwapisiewicz Caleb Maclennan Sven-Hendrik Haase Maxime Gauduin George Hu Jan Alexander Steffens (heftig)
6 people shipped this
Wiktor Kwapisiewicz @wiktor-k 4 cited Caleb Maclennan @alerque 2 cited Sven-Hendrik Haase @svenstaro 2 cited Maxime Gauduin @alucryd 1 cited George Hu @Integral-Tech 1 cited Jan Alexander Steffens (heftig) @heftig 1 cited

Wiktor Kwapisiewicz pushed a fix to signstar that updates the `h2` crate to a non-vulnerable version, closing a security hole that could have compromised your signing infrastructure.

The signstar team dropped everything to patch a critical dependency: the `h2` update [1] addresses a vulnerability in the hyperium advisory GHSA-q83h-524g-xf6h, and while the same crate's 0.3 warning is suppressed for tests only [2], this is the kind of fix you verify before your next signing run. Meanwhile, the archlinux infrastructure desk merged SSH keys for buildbtw service accounts [3] and followed up by copying private keys into the container [4], a move that tightens access control but warrants a quick audit of who holds those keys. Synapse jumped to 1.159.0 [5], a routine upgrade but one that keeps your Matrix federation healthy. On the package front, mise moved from extra-testing to extra [6], and luajit got a bump [7] alongside praat and zeroclaw updates [8][9], all standard but worth a glance if you depend on them. The docs for `CryptographicKeyContext::openpgp_cert_size` also got a polish [10], and the new return type for certificate size estimation [11] signals a cleaner API. Across 58 commits in three repos, this is the security patch that stands out.

Action items

References

  1. [1] fix(deps): Update `h2` to non-vulnerable version ↗ archlinux/signstar
  2. [2] chore(deps): Suppress `h2` 0.3 warning ↗ archlinux/signstar
  3. [3] buildbtw: Add SSH keys to service accounts ↗ archlinux/infrastructure
  4. [4] buildbtw: Copy SSH private keys and mount them into container ↗ archlinux/infrastructure
  5. [5] matrix: Update synapse to 1.159.0 ↗ archlinux/infrastructure
  6. [6] move mise from extra-testing-x86_64 to extra-x86_64 archlinux/state ↗
  7. [7] update luajit to 2.1.1787058514+27f169c-1 in extra-x86_64 archlinux/state ↗
  8. [8] update praat to 7.0.01-1 in extra-x86_64 archlinux/state ↗
  9. [9] update zeroclaw to 0.8.4-1 in extra-x86_64 archlinux/state ↗
  10. [10] docs: Improve `CryptographicKeyContext::openpgp_cert_size` documentation ↗ archlinux/signstar
  11. [11] feat: Return `Result<Option<usize>, Error>` for certificate size estimation ↗ archlinux/signstar

$ ls archlinux/reviews/ # the step-back reads

the week in review Kernel v7.2.4-arch1 ships with userns sysctl the month in review August's Arch: AUR hardening, kernel churn, and steady package flow
Full archive → Weekly reviews →

Quick answers

What shipped in Arch Linux on August 19, 2026?
Wiktor Kwapisiewicz pushed a fix to signstar that updates the `h2` crate to a non-vulnerable version, closing a security hole that could have compromised your signing infrastructure. In total, 58 commits landed.
Who contributed to Arch Linux on August 19, 2026?
6 developers shipped this update, including Maxime Gauduin, Caleb Maclennan, George Hu, Sven-Hendrik Haase, Jan Alexander Steffens (heftig), and Wiktor Kwapisiewicz.
What were the notable Arch Linux updates?
fix(deps): Update `h2` to non-vulnerable version, chore(deps): Suppress `h2` 0.3 warning, and buildbtw: Add SSH keys to service accounts.
♥

$ log @archlinux --recent

Felix Yan promotes the xmonad stack to extra, moor lands at 2.19.2 50 shipped Synapse 1.161.0 lands in infrastructure, anki promoted to extra 70 shipped Arch ships a CLONE_NEWUSER kill switch in v7.2.6-arch2 59 shipped mise and asusctl land in extra, tracexec hits 1.0 50 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.