Skip to content

Usage Pacman

Jump to bottom
Alexander Birkner edited this page Aug 30, 2026 · 2 revisions

Usage: pacman (Arch Linux)

Publishing

silo publish ./hello-1.0-1-x86_64.pkg.tar.zst --repo myrepo --channel arch

The format is inferred from the file extension; pass --format pacman to be explicit. Publishing is gRPC/CLI-only — there is no HTTP publish path for pacman.

Consuming — public repo only

# /etc/pacman.conf
[myrepo]
SigLevel = PackageOptional DatabaseRequired
Server = http://silo.internal:8080/myrepo/stable/pacman/$arch

$arch is expanded by pacman itself, the same as $repo in the section name above it. silo just needs a Server = line ending in /pacman, one directory per architecture underneath.

pacman cannot authenticate reads. Unlike the yum/apk examples on the other pages, there is no user:pass@ form here: pacman's downloader does not send credentials embedded in the URL, so a token placed there is silently never sent — this isn't a silo limitation, pacman simply presents no repo credential at all. A repo consumed by pacman therefore must be public:

silo repo set myrepo --mode=public

A private repo just 404s for pacman, the same way it would for any caller with no credential. If you need pacman to authenticate anyway, point XferCommand at a wrapper script that adds the credential yourself — pacman.conf has no other hook for it.

Publishing still requires a write-scoped token regardless of repo mode; only reads are affected by pacman's inability to send credentials.

any packages

Like apk's noarch, an any-architecture package needs no special handling: pacman only ever fetches its own architecture's database, so silo answers for any content under whichever architecture asks.

Signing

If the server has signing.pacman configured (see Setup), the repo database (db.tar.gz) is signed with a detached binary signature (db.tar.gz.sig) — the shape pacman-key/repo-add -s produce and expect. This is a separate key from RPM's signing.gpg, so the two can be signed independently.

curl -fsS https://silo.example.com/pacman-signing-key | pacman-key --add -
pacman-key --lsign-key <fingerprint>

GET /pacman-signing-key is unauthenticated, the same reasoning as RPM's /RPM-GPG-KEY-silo. Note SigLevel = PackageOptional DatabaseRequired above: silo signs the repo database, not individual packages. Drop DatabaseRequired (or set SigLevel = Never) if signing.pacman isn't configured.

Clone this wiki locally