Arch: signed pacman repository (stable + beta) so updates come through pacman -Syu

sky_line commented

2026-10-05 10:01:18 +00:00

Owner

Host a signed pacman repository, so Arch / CachyOS / Manjaro / EndeavourOS users get Slipstream updates through plain sudo pacman -Syu: no AUR helper and no local build. This sits alongside the existing AUR slipstream-bin package, which stays.

Background

A pacman repo is static files: *.pkg.tar.zst + .sig per package, and a repo database made by repo-add (slipstream.db.tar.zst + .sig). Any HTTPS directory works.
We already have:
- the release signing key (fingerprint C28FDB4A40AA8360D8DF0470AD8E61526C06E929; the CI subkey in secrets LINUX_SIGNING_KEY / LINUX_SIGNING_KEY_ID, helper scripts/ci/signing_key.sh);
- the apt repo hosting pattern: starswirl /srv/apt.slipstreamviewer.org, served by the purplesmart nginx + cloudflared, deployed with an rrsync-restricted key;
- the PKGBUILD generator (scripts/packaging/aur/gen.sh, CI arch-package job).
New: actually building the package. makepkg must run on Arch; applejack is Ubuntu, and Ubuntu's makepkg crashed before (gen.sh has a fallback for .SRCINFO only).

Plan

CI build in an Arch container: archlinux:base-devel via podman on applejack (or the flatpak VM, if podman/rootless suits it better). Steps:
- run makepkg against the release tarball (same PKGBUILD as the AUR, from local sources);
- sign the .pkg.tar.zst with the CI subkey (--sign or a detached gpg --detach-sign);
- repo-add --sign (or sign the db after) to update the database.
Channels, matching apt and Flatpak:
- [slipstream]: stable releases (vX.Y.Z tags);
- [slipstream-beta]: betas (vX.Y.Z-beta.N tags).
Hosting: e.g. https://pkg.slipstreamviewer.org/arch/{stable,beta}/$arch, or a path under the apt domain (avoids a new DNS record). A new docroot on starswirl, an nginx location on purplesmart, and a deploy key restricted with rrsync. Server/DNS steps need the owner's approval.
Retention: keep the last N versions per channel (downgrades with pacman -U); prune older ones and re-run repo-add.
Keyring package (optional but nice): slipstream-keyring (pacman-key populate hook), the Arch equivalent of slipstream-archive-keyring, so key rotation flows through updates.
Docs / website:
- a wiki install section with the setup snippet;
- an Arch download card offering "repo (recommended)" next to the AUR and the tarball.

User setup (for the docs)

sudo pacman-key --recv-keys C28FDB4A40AA8360D8DF0470AD8E61526C06E929
sudo pacman-key --lsign-key C28FDB4A40AA8360D8DF0470AD8E61526C06E929
# /etc/pacman.conf
[slipstream]
Server = https://pkg.slipstreamviewer.org/arch/stable/$arch
sudo pacman -Syu slipstream-bin

Notes

Package name: keep slipstream-bin, consistent with the AUR. Make sure the repo package and an AUR-built one don't fight: same name and version scheme, so pacman treats them as the same package.
Dependencies come from the PKGBUILD, which now requires gst-plugins-base-libs / gst-plugins-good.
Check that the built package passes namcap (lint).
The release workflow should fail loudly if signing or repo-add fails, rather than publishing an unsigned db.

Done when

A fresh Arch machine can add the repo, install, and get an update via pacman -Syu on the next release (stable and beta channels).
Packages and the db are signed and verify with the published key.
Retention and pruning work; downgrade is possible.
Wiki and download page updated.

Host a signed **pacman repository**, so Arch / CachyOS / Manjaro / EndeavourOS users get Slipstream updates through plain `sudo pacman -Syu`: no AUR helper and no local build. This sits alongside the existing AUR `slipstream-bin` package, which stays. ## Background - A pacman repo is static files: `*.pkg.tar.zst` + `.sig` per package, and a repo database made by `repo-add` (`slipstream.db.tar.zst` + `.sig`). Any HTTPS directory works. - We already have: - the **release signing key** (fingerprint `C28FDB4A40AA8360D8DF0470AD8E61526C06E929`; the CI subkey in secrets `LINUX_SIGNING_KEY` / `LINUX_SIGNING_KEY_ID`, helper `scripts/ci/signing_key.sh`); - the **apt repo hosting pattern**: starswirl `/srv/apt.slipstreamviewer.org`, served by the purplesmart nginx + cloudflared, deployed with an rrsync-restricted key; - the **PKGBUILD generator** (`scripts/packaging/aur/gen.sh`, CI `arch-package` job). - New: actually **building** the package. `makepkg` must run on Arch; applejack is Ubuntu, and Ubuntu's makepkg crashed before (gen.sh has a fallback for .SRCINFO only). ## Plan 1. **CI build in an Arch container:** `archlinux:base-devel` via podman on applejack (or the flatpak VM, if podman/rootless suits it better). Steps: - run `makepkg` against the release tarball (same PKGBUILD as the AUR, from local sources); - sign the `.pkg.tar.zst` with the CI subkey (`--sign` or a detached `gpg --detach-sign`); - `repo-add --sign` (or sign the db after) to update the database. 2. **Channels**, matching apt and Flatpak: - `[slipstream]`: stable releases (`vX.Y.Z` tags); - `[slipstream-beta]`: betas (`vX.Y.Z-beta.N` tags). 3. **Hosting:** e.g. `https://pkg.slipstreamviewer.org/arch/{stable,beta}/$arch`, or a path under the apt domain (avoids a new DNS record). A new docroot on starswirl, an nginx location on purplesmart, and a deploy key restricted with rrsync. **Server/DNS steps need the owner's approval.** 4. **Retention:** keep the last N versions per channel (downgrades with `pacman -U`); prune older ones and re-run `repo-add`. 5. **Keyring package (optional but nice):** `slipstream-keyring` (pacman-key populate hook), the Arch equivalent of `slipstream-archive-keyring`, so key rotation flows through updates. 6. **Docs / website:** - a wiki install section with the setup snippet; - an Arch download card offering "repo (recommended)" next to the AUR and the tarball. ## User setup (for the docs) ``` sudo pacman-key --recv-keys C28FDB4A40AA8360D8DF0470AD8E61526C06E929 sudo pacman-key --lsign-key C28FDB4A40AA8360D8DF0470AD8E61526C06E929 # /etc/pacman.conf [slipstream] Server = https://pkg.slipstreamviewer.org/arch/stable/$arch sudo pacman -Syu slipstream-bin ``` ## Notes - Package name: keep `slipstream-bin`, consistent with the AUR. Make sure the repo package and an AUR-built one don't fight: same name and version scheme, so pacman treats them as the same package. - Dependencies come from the PKGBUILD, which now requires `gst-plugins-base-libs` / `gst-plugins-good`. - Check that the built package passes `namcap` (lint). - The release workflow should fail loudly if signing or `repo-add` fails, rather than publishing an unsigned db. ## Done when - [ ] A fresh Arch machine can add the repo, install, and get an update via `pacman -Syu` on the next release (stable and beta channels). - [ ] Packages and the db are signed and verify with the published key. - [ ] Retention and pruning work; downgrade is possible. - [ ] Wiki and download page updated.

sky_line added the

platform

feature

labels

2026-10-05 10:01:18 +00:00

sky_line referenced this issue

2026-10-05 11:03:23 +00:00

Auto-updater for Windows and Linux tarball installs (signed feed, background download, verified apply, rollback) #421

sky_line referenced this issue

2026-10-05 13:33:19 +00:00

Linux: publish an AUR package (slipstream-bin) with dependency handling #248

sky_line referenced this issue

2026-10-05 13:33:19 +00:00

Linux: signed releases (SHA256SUMS + signature), signed apt repo, signed Arch/Flatpak artifacts #288

sky_line added this to the Slipstream project

2026-10-06 15:04:13 +00:00

sky_line added the

status

up-next

label

2026-10-10 04:51:57 +00:00

sky_line referenced this issue from a commit

2026-10-10 10:17:52 +00:00

Signed pacman repositories (stable + beta) for slipstream-bin (#419)

sky_line referenced this issue from a commit

2026-10-10 10:17:53 +00:00

#419: pacman-seed workflow (manual dispatch) to add existing releases to the pacman repos

sky_line commented

2026-10-10 11:04:12 +00:00

Author

Owner

Live on 2026-10-10: https://arch.slipstreamviewer.org with [slipstream] and [slipstream-beta]. Seeded with 1.1.0, 1.2.0-beta.8 and 1.2.0 (pacman-seed run #306). Databases and packages are verified with gpg against the published key (C28F DB4A 40AA 8360 D8DF 0470 AD8E 6152 6C06 E929). New tags are added by the release workflow's pacman-repo job; 1.3.0-beta.1 is the first. Install instructions are on the wiki. Remaining test: pacman -S slipstream-bin from a clean Arch container.

Live on 2026-10-10: https://arch.slipstreamviewer.org with [slipstream] and [slipstream-beta]. Seeded with 1.1.0, 1.2.0-beta.8 and 1.2.0 (pacman-seed run #306). Databases and packages are verified with gpg against the published key (C28F DB4A 40AA 8360 D8DF 0470 AD8E 6152 6C06 E929). New tags are added by the release workflow's pacman-repo job; 1.3.0-beta.1 is the first. Install instructions are on the wiki. Remaining test: `pacman -S slipstream-bin` from a clean Arch container.

sky_line added

and removed

labels

2026-10-10 11:04:12 +00:00

sky_line commented

2026-10-11 13:25:05 +00:00

Author

Owner