dist.hewpkg.com

Signed apt, dnf/zypper and pacman repository for amd64/x86_64 and arm64/aarch64. Suites: stable, testing.

Add the repository

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://dist.hewpkg.com/keyring.gpg | sudo tee /etc/apt/keyrings/hew.gpg >/dev/null
gpg --show-keys --with-fingerprint /etc/apt/keyrings/hew.gpg
curl -fsSL https://dist.hewpkg.com/hew.sources | sudo tee /etc/apt/sources.list.d/hew.sources >/dev/null
sudo apt update && sudo apt install hew-archive-keyring

The fingerprint printed by gpg must be:

7234 F4E4 38BF F98C FB14 DF92 F6C1 28EB DDDD 497A

Installing hew-archive-keyring moves the key into the package, so future key rotations arrive through apt upgrade. Edit Suites: in the sources file to testing to follow pre-release builds.

Fedora, RHEL and openSUSE (dnf, zypper)

sudo curl -fsSL https://dist.hewpkg.com/hew.repo -o /etc/yum.repos.d/hew.repo   # openSUSE: /etc/zypp/repos.d/
sudo dnf install <package>                                  # first use asks you to trust the key; check the fingerprint above

The repository metadata is signed (repo_gpgcheck=1); each package is verified by the hash that metadata carries. Edit baseurl to use testing instead of stable. Installing hew-release moves the key and the repo file into a package, so key rotations arrive through dnf upgrade.

Arch Linux (pacman)

curl -fsSL https://dist.hewpkg.com/keyring.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key 7234F4E438BFF98CFB14DF92F6C128EBDDDD497A
# append to /etc/pacman.conf
[hew]
SigLevel = DatabaseRequired PackageNever
Server = https://dist.hewpkg.com/pacman/stable/$arch

The database is signed and checked; packages are verified against the hashes it holds. Use testing in place of stable for pre-releases. Installing hew-keyring (sudo pacman -S hew-keyring) registers the key through the package, so rotations arrive with pacman -Syu.

Downloading a package directly

curl -fsSLO https://dist.hewpkg.com/SHA256SUMS -O https://dist.hewpkg.com/SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS

Publish (maintainer)

sudo apt install apt-push
apt-push --repo hewpkg --suite testing package_1.0_amd64.deb package-1.0-1.x86_64.rpm package-1.0-1-x86_64.pkg.tar.zst