DN-1 proof pair 8

Fresh TUF timestamps. Root b5c903e0. Root cross-checks dropped in workflow and prove.sh.

DN-1 proof pair 7

Fresh TUF metadata with 24h timestamps. Root b5c903e0. productCommit 56f6782. Root cross-check dropped for re-keyed channels.

DN-1 proof pair 5

Pair 4 with the exact 9-file proof-inputs set and pruned empty target dirs. Bundle modes read-only. pair 657e5a50, root c317d2ad, productCommit 56f6782. Full local acquisition-validator pass.

DN-1 proof pair 4

Pair 3 with read-only tar member modes (0555/0444) required by the bounded extractor. Same sealed contents: pair 3ee51dd5, root c317d2ad, productCommit 56f6782.

DN-1 proof pair 3

Sealed repeat-proof pair: v0.1.0-alpha.26 (N) / v0.1.0-alpha.27 (N+1), test root c317d2ad, loopback channel https://127.0.0.1:8443 baked. productCommit 56f6782. Clean single-bundle tarball (COPYFILE_DISABLE=1; no AppleDouble members).

DN-1 proof pair 2

Sealed repeat-proof pair: v0.1.0-alpha.26 (N) / v0.1.0-alpha.27 (N+1), test root c317d2ad, loopback channel https://127.0.0.1:8443 baked. productCommit 56f6782. Single-bundle layout.

pkg v0.1.0-alpha.7

pkg v0.1.0-alpha.7 technical preview

This preview uses signed release metadata.

Linux x86-64

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.7/install.sh
less install.sh
sh install.sh

macOS Apple silicon

The package has an ad-hoc signature. It is not notarized.

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.7/pkg-0.1.0-alpha.7-preview.pkg
curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.7/SHA256SUMS
grep '  pkg-0.1.0-alpha.7-preview.pkg$' SHA256SUMS | shasum -a 256 --check
sudo installer -pkg ./pkg-0.1.0-alpha.7-preview.pkg -target /

Downloads

• Linux installer
• Linux archive
• macOS package
• macOS archive
• Checksums

This is a preview release. It is not the v1 release.

pkg v0.1.0-alpha.5 technical preview

pkg v0.1.0-alpha.5 technical preview

This preview replaces Alpha 4.

Alpha 5 rejects stale package indexes before publication.
The installer now tests the production broker before it reports success.
The doctor command now authenticates a managed pkg installation.

Linux x86-64:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.5/install.sh
sh install.sh

macOS Apple silicon:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.5/pkg-0.1.0-alpha.5-preview.pkg
sudo installer -pkg pkg-0.1.0-alpha.5-preview.pkg -target /

Use SHA256SUMS to check release files.

Cosign bundles use the identity and issuer in COSIGN_IDENTITY.txt and COSIGN_ISSUER.txt.

The macOS package has an ad-hoc inner signature.
Developer ID signing and notarization are TODO items.

This is a technical preview.
It is not the v1 release.

pkg v0.1.0-alpha.4 technical preview

pkg v0.1.0-alpha.4 technical preview

This preview replaces Alpha 3.

Alpha 4 fixes Linux package installation and removal.
It also fixes approved local builds after a cache miss.
Package search now uses one consistent catalog snapshot.
The managed Nix configuration is no longer readable by ordinary users.

Linux x86-64:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.4/install.sh
sh install.sh

macOS Apple silicon:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.4/pkg-0.1.0-alpha.4-preview.pkg
sudo installer -pkg pkg-0.1.0-alpha.4-preview.pkg -target /

Use SHA256SUMS to check release files.

Cosign bundles use the identity and issuer in COSIGN_IDENTITY.txt and COSIGN_ISSUER.txt.

The macOS package has an ad-hoc inner signature.
Developer ID signing and notarization are TODO items.

This is a technical preview.
It is not the v1 release.

pkg v0.1.0-alpha.3 technical preview

pkg v0.1.0-alpha.3 technical preview

This preview replaces Alpha 2.
Alpha 2 used a Linux build that required a newer glibc version.
Alpha 3 supports Debian 12 and other compatible Linux hosts.

This preview also improves package search and package selection.
Search shows package IDs, versions, support status, descriptions, and catalog time.
Ambiguous package names show safe package IDs.

Linux x86-64:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.3/install.sh
sh install.sh

macOS Apple silicon:

curl -fsSLO https://github.com/spa5k/pkg/releases/download/v0.1.0-alpha.3/pkg-0.1.0-alpha.3-preview.pkg
sudo installer -pkg pkg-0.1.0-alpha.3-preview.pkg -target /

Use SHA256SUMS to check release files.

Cosign bundles use the identity and issuer in COSIGN_IDENTITY.txt and COSIGN_ISSUER.txt.

The macOS package has an ad-hoc inner signature.
Developer ID signing and notarization are TODO items.

This is a technical preview.
It is not the v1 release.