pkg-dist

Central distribution repository for protibimbok tools.

This repo is the single source of truth for:

• Homebrew tap (Casks/)
• APT repository (apt/)
• Package signing key (public.gpg)
• Release packaging automation (.github/workflows/)

Application source code lives in the individual project repos (mgit, phnx, etc.).

User installation

Homebrew (macOS / Linux)

brew tap protibimbok/pkg-dist
brew install mgit
brew install phnx
# vpn is apt/AUR only (no macOS builds)

apt (Debian / Ubuntu)

# One-time: install the signing key
curl -fsSL \
  https://github.com/protibimbok/pkg-dist/raw/master/public.gpg \
  | sudo gpg --dearmor \
  -o /usr/share/keyrings/protibimbok.gpg

# One-time: add the repository
echo "deb [signed-by=/usr/share/keyrings/protibimbok.gpg] \
  https://protibimbok.github.io/pkg-dist/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/protibimbok.list

sudo apt update
sudo apt install mgit
sudo apt install phnx
sudo apt install vpn

Maintainer workflow

mgit/phnx/vpn-tui tag push
    → GitHub Release (binaries + .deb)
    → repository_dispatch to pkg-dist
    → update Casks/ (skipped when no darwin builds)
    → add .deb to apt repo (reprepro)
    → sign Release
    → commit + push

Required GitHub secrets (pkg-dist repo)

Secret	Purpose
GPG_PRIVATE_KEY	APT repo signing subkey (armored, for CI) — optional until Phase 4
GPG_PASSPHRASE	Passphrase for the signing subkey

Required GitHub secrets (source repos: mgit, phnx, vpn-tui)

Secret	Purpose
PKG_DIST_TOKEN	Trigger pkg-dist workflow (PAT with contents: write on pkg-dist)
AUR_KEY	AUR updates (unchanged, stays in source repos)

Creating a release

From the source repo:

git tag v1.0.0
git push origin v1.0.0

The source repo builds binaries and publishes a GitHub Release. pkg-dist is notified automatically.

Manual trigger

gh workflow run publish.yml \
  -f package=mgit \
  -f tag=v1.0.1

Repository layout

pkg-dist/
├── Casks/
│   ├── mgit.rb
│   └── phnx.rb
├── apt/
│   ├── conf/
│   │   └── distributions
│   ├── dists/          # generated by reprepro
│   └── pool/           # generated by reprepro
├── public.gpg          # exported public signing key
├── scripts/
│   ├── update-cask.sh
│   ├── update-apt.sh
│   └── package-metadata.json
└── .github/workflows/
    └── publish.yml

GPG key structure

Primary Key (offline, backed up as master-backup.gpg)
└── Signing Subkey (exported as ci-subkey.asc → GitHub Secret)

Generate keys locally (see docs/gpg-setup.md), never commit private key material.