TL;DR
The Sovereign Tech Fund supported 15 months of development on the ALPM project, producing a set of Rust libraries, CLIs and specifications for Arch Linux package management. Work covered format specifications, OpenPGP verification, package handling, and system package management, with significant code and contributor activity recorded.
What happened
Beginning in 2024, the Sovereign Tech Fund financed 15 months of development on the ALPM project, a Rust-based framework focused on Arch Linux package management. The team tackled six defined milestones, including formal specs for packaging formats, basic OpenPGP verification, a Rust library for individual packages, Python bindings for alpm-srcinfo, a distribution-agnostic OpenPGP stack, and a Rust library for system package management. The effort produced a set of foundational crates (alpm-types, alpm-common), parser tooling built on the winnow combinator library and format-specific crates such as alpm-srcinfo, alpm-buildinfo, alpm-mtree and alpm-package. Utilities for compression, dependency solving (alpm-solve, based on resolvo) and running build steps without root (rootless-run) were also created. The project logged substantial activity: top committers and a large Rust codebase are shown in the public repository statistics. The STF funding period has ended.
Why it matters
- Provides a formal, shared specification set for many custom file formats used in Arch Linux, easing maintenance and experimentation.
- Delivers reusable Rust libraries and CLIs that can underpin new tooling across the package management stack.
- Adds basic cryptographic verification infrastructure for distribution artifacts, improving artifact security workflows.
- Creates tooling (BUILDINFO, ALPM-MTREE handling) that supports reproducible-build efforts and validated package metadata.
Key facts
- Sovereign Tech Fund began funding ALPM work in 2024 and supported a 15-month effort; the funding period has concluded.
- Project organized around six milestones including format specs, OpenPGP verification, package libraries, and system package management.
- Top contributors (since 2024-10-01) by commit count: David Runge 467, Arne Beer 252, Orhun Parmaksız 173, Jagoda Ślązak 117.
- Repository statistics (tokei): total 92,267 lines across 551 files; Rust accounted for 46,298 lines and 271 files.
- Core libraries created include alpm-types, alpm-common, alpm-parsers (using winnow), alpm-compress, alpm-package and alpm-solve.
- Format-specific crates and CLIs include alpm-srcinfo (SRCINFO from PKGBUILD), alpm-buildinfo (BUILDINFO) and alpm-mtree (ALPM-MTREE).
- alpm-solve implements a new dependency resolution approach for Arch Linux based on the generic resolvo library.
- rootless-run abstracts running commands as root for package creation using backends such as fakeroot and rootlesskit.
- alpm-mtree relies on bsdtar to write ALPM-MTREE files, treating that format as a meta-language subset of mtree(5).
What to watch next
- Whether these libraries and specifications are adopted into core Arch Linux tooling and workflows — not confirmed in the source
- Future maintenance, funding or follow-up development for the ALPM workspace now the STF grant has ended — not confirmed in the source
- Potential reuse of the distribution-agnostic OpenPGP stack by other distributions or projects — not confirmed in the source
Quick glossary
- ALPM: Arch Linux Package Management: the subsystem and associated formats/tools used to build, distribute and install packages on Arch Linux.
- crate: A package of Rust code that can be compiled and distributed; crates provide libraries or executables within the Rust ecosystem.
- SRCINFO / PKGBUILD: PKGBUILD is a script format used to build Arch packages; SRCINFO is a metadata file generated from PKGBUILD used by package build systems.
- OpenPGP: A family of standards for encrypting and signing data and verifying authenticity, commonly used to secure software distribution artifacts.
- mtree: A file-listing format used to express file metadata (ownership, permissions, checksums) for filesystem trees; ALPM-MTREE is a subset used in packages.
Reader FAQ
Who funded the ALPM work?
The Sovereign Tech Fund provided funding for the project starting in 2024.
How long did the funded work last?
The funded phase covered 15 months; the funding period has since ended.
Are the libraries written in Rust?
Yes. The project produces multiple Rust crates and uses Rust for the core tooling.
How can developers learn more or contribute?
The project invites developers to browse specifications and consult API documentation; specific contribution steps are not detailed in the source.
A year of work on the ALPM project 2026-01-10·27 min·Arne Christian Beer·David Runge·Heiko Schaefer·Jagoda Ślązak·Orhun Parmaksız Table of Contents In 2024 the Sovereign Tech Fund (STF) started funding work on…
Sources
- A Year of Work on the Arch Linux Package Management (ALPM) Project
- Sovereign Tech Agency funding for ALPM project
- Arch Linux Package Management (ALPM) gets funding …
- Sovereign Tech Agency Injects €562K into Arch Linux
Related posts
- Kodbox: Open-source web desktop with multi-cloud storage and web IDE
- Ferrite: Rust Markdown editor with native Mermaid diagram rendering
- Librario: an open-source book metadata API aggregating multiple sources