RPM roadmap update 2024

[pmatilai]

We've just published our roadmap for the next three years: https://rpm.org/roadmap

Of course the big thing there is the looming RPM v6.0 on which we can now shed a lot more light on, so copying it here:

RPM 6.0 release in 2025

• Introducing RPM v6 package format
• Compatibility
  • v6 format is widely compatible with modern rpm 4.x versions
  • Can produce both v4 and v6 packages
  • Full support for v4 and v6 packages
  • Support for v3 packages is dropped
• Security
  • Enforced signature-checking by default
  • Legacy crypto algorithms disabled by default
  • Use full OpenPGP key fingerprints everywhere
• Hand-free packaging
  • Automatic signing on package build
• Compiled with C++
  • Gradual transition towards C++ internally
  • C API will be preserved going forward

Everybody is of course concerned with compatibility. As the v6 format is practically built from extensions to the v4 format, it is largely compatible with all remotely modern rpm 4.x versions. Roughly, v6 format packages can be:

• read and queried by rpm >= 4.6
• unpacked by rpm >= 4.12
• verified by rpm >= 4.14.2
• installability varies by the used feature set (tracked by rpmlib dependencies), but the bare minimum is around 4.12 to 4.14.2

As mentioned above, rpm 6.x can produce both v4 and v6 packages, so distributors can migrate to the new format on their own schedules without having to hang back to older rpm versions.

As usual, the crystal ball grows hazier the further you look, we'll be updating the roadmap along the way.
We cannot promise that everything in the roadmap will be implemented, however we do promise that everything in there will be at least investigated. Sometimes things just get rescheduled, such as some things planned for 4.20 got postponed to 6.0, and vice versa.