- Shell 100%
riomoo
ccec73daf7
### What does this change? - [X] New package - [X] Version bump - [ ] Recipe fix ### Checklist - [X] `commit` is the full commit the upstream release tag points to, and `tag` is set - [X] I read the upstream changes CI printed, especially the build and dependency files - [X] Any `sha256` for a prebuilt binary matches upstream's *published* checksum, not just my own download - [x] `axiom lint` passes locally, and `axiom verify` reproduces the build - [X] The source repository is the project's official one Upstream release notes or changelog: - Axiom 0.1.10 - Added librewolf 159.0-1 Reviewed-on: #10 |
||
|---|---|---|
| .forgejo | ||
| assets | ||
| axiom | ||
| ci | ||
| go | ||
| gopherbook | ||
| gopherbook-desktop | ||
| libpng | ||
| librewolf | ||
| lua | ||
| ninja | ||
| zig | ||
| zlib | ||
| .gitattributes | ||
| allowed_signers | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| maintainers.asc | ||
| README.md | ||
| SECURITY.md | ||
Package recipes for Axiom: pinned to exact upstream commits, built in a sandbox, reproducible, and with no shell scripts anywhere.
Every folder here is one package: <name>/<name>.axiom, plus any .patch
files that recipe references. Nothing else is allowed in a package folder, and
CI enforces it.
Use it
mkdir -p ~/.config/axiom
# 1. Trust the maintainers' signing keys (do this once).
base=https://git.jester-designs.com/riomoo/matrix/raw/branch/master
curl -fsSL -o ~/.config/axiom/matrix.allowed_signers "$base/allowed_signers"
curl -fsSL -o ~/.config/axiom/matrix.asc "$base/maintainers.asc"
ssh-keygen -lf ~/.config/axiom/matrix.allowed_signers
gpg --show-keys ~/.config/axiom/matrix.asc
# ^ compare these fingerprints with ones a maintainer gave you some other way
# (website, chat, in person). This is the only step where you trust the network.
# 2. Add the repository.
cat >> ~/.config/axiom/axiom.conf <<'EOF'
[repo.matrix]
git = "https://git.jester-designs.com/riomoo/matrix.git"
branch = "master"
allowed_signers = "matrix.allowed_signers"
gpg_keys = "matrix.asc"
EOF
# Keep only the lines for the key files this repository has:
# allowed_signers (SSH keys) and/or maintainers.asc (GPG keys).
# 3. Fetch recipes and install something.
axiom update
axiom install gopherbook
axiom update refuses to update if the newest commit isn't signed by one of
those keys, or if the repository's history was rewritten. Only these two
files count: other keys in your own GnuPG keyring are ignored.
If you use more than one recipe repository, you can always be exact:
axiom install matrix/gopherbook. If a plain name exists in more than one
repository, Axiom asks which one you mean (or, in scripts, stops and asks you
to name it), and an installed package never silently switches to a same-named
recipe from a different repository.
Packages
| Package | Kind | Notes |
|---|---|---|
| gopherbook | source (Go) | Self-hosted comic library and reader |
| gopherbook-desktop | source (Go, cgo) | Desktop app; needs gcc and OpenGL/X11 headers on the host |
| go | binary | Official Go toolchain; build-only, removed after builds |
| zig | binary | Official Zig 0.17.0 toolchain; build-only, removed after builds |
| zlib | source | |
| libpng | source | Needs ninja to build, zlib at run time |
| ninja | source | |
| lua | source |
Contributing
See CONTRIBUTING.md. To report a malicious or compromised recipe, see SECURITY.md.