rpm on SOW

Download SOW

Mon, 01 Jan 0001 00:00:00 +0000

Install SOW from the Pigsty infra repository with apt install sow or dnf install sow, from a pinned RPM or DEB package, from a tar.gz archive for Linux or macOS on amd64 and arm64, or from a source build of a tagged release. Every route installs the same self-contained executable, and every published artifact carries a SHA-256 digest listed against SHA256SUMS. After installing, run sow version and sow help, then point sow create at a directory of packages.

Why SOW Uses One Payload Tree per Repository

Wed, 05 Aug 2026 00:00:00 +0000

This decision was drafted on 2026-08-05 during the pre-v0.2 release design consolidation and shipped in SOW v0.2.0 on 2026-08-08. It remains the layout contract in v0.3 and v0.4. It records an architecture choice, not a blanket compatibility claim: protocol closure, ordinary package clients, mirror tools, static hosting, and object storage are verified as separate evidence layers.

Decision

Each SOW Repository owns one public tree:

<repository>/
  pool/                         # canonical package bytes
  dists/
    <dist>/
      <architecture>/           # protocol metadata only

A Package Object has one canonical payload path inside one Repository. Adding the same object to several Dists or architecture views adds membership and metadata references; it does not create another canonical package file.

Build a YUM Repository

Mon, 01 Jan 0001 00:00:00 +0000

This tutorial creates a new Managed RPM repository. You need a writable directory, and one or more RPM files.

1. Create the workspace

mkdir -p /srv/sow
cd /srv/sow
sow init .
sow repo new pigsty
sow dist new el9 --format rpm -r pigsty

The Dist name is an identifier chosen by you. SOW does not infer an operating-system release from el9.

sow create

Mon, 01 Jan 0001 00:00:00 +0000

sow create turns a directory that already contains .rpm and .deb files into a flat repository by writing indexes next to the packages. It is the whole of Plain mode: no sow.yml, no SQLite, no Workspace discovery. This page covers the one-pass scan contract, the --pigsty completion gate, and RPM signing with --sign-with.

Synopsis

sow create [DIR] [-j N] [--pigsty] [-S KEY [--overwrite]] [-T DUR | -N] [--json]

DIR defaults to the current directory.

Installation

Mon, 01 Jan 0001 00:00:00 +0000

SOW is one executable: there is no service to enable and no runtime language environment. Release builds target Linux and macOS on amd64 and arm64; Linux also gets RPM and DEB packages. Windows is not supported.

Use the Download page to select the archive or Linux package that matches your operating system and architecture. It links each published artifact, its source tag, and SHA256SUMS.

Install an archive

Download one archive plus SHA256SUMS, then verify the matching line before extraction:

Plain Flat Repositories

Mon, 01 Jan 0001 00:00:00 +0000

sow create takes a directory that already contains .rpm and .deb files and writes flat repository indexes beside them. Plain mode has no workspace, configuration file, database, desired state, or operation journal. The package directory is the authority; every index is a disposable projection of its current contents.

That distinction is intentional. Managed repositories retain state and recover transactions. Plain repositories are cheap to recreate: if a run fails or is interrupted, run the same command again and overwrite the derived metadata.

Quick Start

Mon, 01 Jan 0001 00:00:00 +0000

Plain mode builds a flat repository in one directory. It does not read sow.yml, create a workspace, or keep a database.

Prepare a directory

Put RPM and/or DEB files at the directory top level. sow create does not recurse and does not move or rename package files.

mkdir -p /srv/repo
cp /path/to/packages/*.rpm /path/to/packages/*.deb /srv/repo/

If one glob has no matches, copy the formats you actually have instead.

Package References

Mon, 01 Jan 0001 00:00:00 +0000

sow rm, sow show, and sow where all take a PACKAGE argument. This page defines what you may write there. The same grammar applies to all three commands; only the handling of an ambiguous name differs.

Nothing here applies to sow add, which takes filesystem paths, not references.

The five forms

Form	Example	Matches
Content digest	`sha256:d06d7f23b9cf...b98b1229`	Exactly one package object
RPM coordinate	`rpm:pev2-0:1.23.0-1.noarch`	Exactly one RPM
DEB coordinate	`deb:libpq5=18.3-1.pgdg12+1:amd64`	Exactly one DEB
Filename	`pev2-1.23.0-1.noarch.rpm`	The package stored under that filename
Bare name	`pev2`	Every version and architecture of that name

The first three are exact: they name one object and either hit it or fail. The last two are conveniences that may match more than one object.

Pool & Metadata Views

Mon, 01 Jan 0001 00:00:00 +0000

The invariant

Within one Repository, every live Package Object has one canonical payload path under pool/. Dists and architecture views own metadata, not aliases of package bytes:

<repo>/pool/...                              canonical package payloads
<repo>/dists/<rpm-dist>/<arch>/repodata/... RPM metadata only
<repo>/dists/<deb-dist>/main/binary-*/...   APT metadata only

The same digest in another Repository or publication prefix is a separately owned object. SOW deliberately does not turn local deduplication into shared distributed ownership.

Build the pigsty-infra Repository

Mon, 01 Jan 0001 00:00:00 +0000

pgsty/infra-pkg is the upstream build source for Pigsty Infra packages. This tutorial assumes the dual-architecture RPMs and DEBs already exist and covers the second half of the job: turning that pile of packages into a real, consumable, maintainable SOW repository named infra.

1. Put the packages under ~/repo

This tutorial uses the fixed path ~/repo throughout. Copy the existing packages into two input directories:

mkdir -p ~/repo/packages/rpm ~/repo/packages/deb
cp ~/pgsty/infra-pkg/dist/rpm/*.rpm ~/repo/packages/rpm/
cp ~/pgsty/infra-pkg/dist/deb/*.deb ~/repo/packages/deb/

Confirm that all four format-by-architecture cells contain real payloads:

Signing Model

Mon, 01 Jan 0001 00:00:00 +0000

There are two different questions a client can ask about a repository, and SOW answers them with two separate mechanisms. Confusing them is the most common source of “I signed it but dnf still complains”, so this page starts by pulling them apart.

Two independent trust chains

	Metadata signing	RPM package signing
Question answered	“Is this index really from you, and unmodified?”	“Is this `.rpm` file really from you?”
Configured by	`signing.rpm.metadata`, `signing.deb.metadata`	`signing.rpm.packages`
Produces	`repodata/repomd.xml.asc`, `InRelease`, `Release.gpg`	an OpenPGP signature embedded in the package
Changes package bytes	no	yes
Client setting	dnf `repo_gpgcheck=1`, apt `Signed-By`	dnf `gpgcheck=1`
Available in Plain mode	no	yes, via `create -S KEY`

They are configured separately and can be used separately. Metadata signing alone is usually the right starting point: it authenticates the whole index in one place and requires no change to the packages you received from upstream.

Platforms & Integrations

Mon, 01 Jan 0001 00:00:00 +0000

This page defines the environments SOW ships for, the storage semantics it requires, and the exact scope of its automated integrations. Repository generation happens inside the SOW binary; a real package manager remains the final check for a deployed repository.

Release targets

Operating system	`amd64`	`arm64`	Artifact
Linux	yes	yes	archive, RPM, DEB
macOS	yes	yes	archive
Windows	no	no	not supported

Release binaries use CGO_ENABLED=0 and require no language runtime. The 0.4.0 artifacts were built with Go 1.27.0; the source module requires Go 1.27.0 or newer. Archives include README.md, CHANGELOG.md, and the Apache-2.0 LICENSE; Linux packages install the same license with the binary. Use sow version to print the product version, target OS/architecture, and build toolchain.

sow export

Mon, 01 Jan 0001 00:00:00 +0000

SOW provides one export subcommand: sow export rpm-leaf. It creates an external, standalone RPM repository whose repodata uses local pool/... hrefs.

Synopsis

sow export rpm-leaf DIST ARCH DIR [--hardlink] [-C|--workdir DIR] [-r|--repo NAME] [--json]

Argument	Requirement
`DIST`	Canonical configured RPM Dist name
`ARCH`	`x86_64` or `aarch64`
`DIR`	Absent or empty destination outside Repository, private-state, and filesystem-target roots

Flag	Meaning	Default
`--hardlink`	Use hard links for trusted, same-filesystem, read-only output	copy files
`-C, --workdir DIR`	Workspace discovery start directory	current directory
`-r, --repo NAME`	Select a Repository	selection rules
`--json`	Emit the `sow.cli/v1` envelope	false

The command accepts no --dist, jobs, timeout, or lock option.