Tags: signing

SOW 0.4.0 is an integrity and recovery release for Managed repositories. It makes the deep checker’s I/O contract explicit, prevents RPM trust from being assembled across unrelated keys, adds an audited way to correct mutable publication-target …

SOW 0.2.0 is a self-contained RPM and DEB repository manager from Pigsty. Release artifacts target Linux and macOS as single Go executables. Two operating modes Plain mode indexes RPM and DEB files already present at one directory’s top level: sow …

sow check is the deep read-only gate for a managed Repository. It hashes bytes, validates state, reconstructs expected views, and verifies declared signatures. It never repairs, builds, recovers an Operation, or takes the write lock. Synopsis sow …

sow show resolves one package reference in the selected Repository and prints the complete Package Object. It is read-only and takes no write lock. Synopsis sow show PACKAGE [-C|--workdir DIR] [-r|--repo NAME] [-d|--dist NAME]... [--json] Flag …

There are two different questions a client can ask about a repository, and SOW answers them with two separate mechanisms. Confusing them is the most common source of “I signed it but dnf still complains”, so this page starts by pulling them apart. …

SOW has two independent signing paths: Path Output Client control RPM metadata repodata/repomd.xml.asc repo_gpgcheck=1 APT metadata InRelease and Release.gpg Signed-By RPM package body embedded RPM signature gpgcheck=1 APT trusts package hashes …

SOW has two isolated execution paths. Plain mode is a stateless rebuild of one directory; Managed mode records package membership and immutable repository generations in a workspace. Neither path silently adopts state from the other. Capability …

Each tutorial starts from a new workspace. Commands are intended to be run in order; replace uppercase placeholders and package paths for your environment. If you have not installed SOW yet, start with Installation and Quick Start. The tutorials …