libapg

Package management library for NurOS.

Note

Repository Mirrors

• git.nuros.org (core/libapg): primary, self-hosted Forgejo instance, accounts restricted to the core team.
• GitHub (NurOS-Linux/libapg): mirror for external contributors. Issues and Pull Requests opened here are welcome and are reviewed and processed by the core team.

Dependencies

Dependency	Description
Meson	Build system
Ninja	Build tool
pkg-config	Helper tool for compiling
libarchive	Archive and compression library
lmdb	Embedded key-value database
yyjson	JSON library
gpgme and libsodium	Package signing
libseccomp (optional, Linux only)	Syscall filtering for install script sandbox

Signing backends

libapg builds in both signing backends side by side; callers pick which one to use:

• libsodium (sign_verify, sign_file, keyring_load, ...; the default): Ed25519 signing. Always ECC, keys are read from /etc/apg/keys/.
• gpgme (sign_verify_gpgme, sign_file_gpgme, keyring_load_gpgme, ...): PGP signing via GnuPG. Only ECC keys are accepted by default (Ed25519, ECDSA). RSA can be enabled explicitly by passing allow_rsa = true.

install_policy.backend (SIGN_BACKEND_SODIUM by default, or SIGN_BACKEND_GPGME) selects which one trans_commit() verifies package signatures against.

Install-script sandbox

run_script() isolates pre/post-install scripts using the strongest primitive available on the host:

• Linux — unshare() with isolated network, mount, UTS, and IPC namespaces, plus optional libseccomp syscall filtering.
• FreeBSD: chroot() into the alternate install root, when one is given. Capsicum capability mode is not used here, since it forbids the kernel from resolving an interpreter path, which any #!-script exec requires.
• Other POSIX platforms — no sandbox primitive is available; scripts run without isolation.

On Linux and FreeBSD, if the sandbox cannot be established the script is not executed (fail closed).

Building

With Nix

nix build

Without Nix

Arch Linux

sudo pacman -S meson ninja pkgconf libarchive lmdb yyjson gpgme libsodium

Ubuntu / Debian

sudo apt install meson ninja-build pkg-config libarchive-dev liblmdb-dev libyyjson-dev libgpgme-dev libsodium-dev

Fedora / RHEL / CentOS

sudo dnf install meson ninja-build pkgconf libarchive-devel lmdb-devel yyjson-devel gpgme-devel libsodium-devel

openSUSE

sudo zypper install meson ninja pkgconf libarchive-devel lmdb-devel yyjson-devel gpgme-devel libsodium-devel

Alpine Linux

sudo apk add meson ninja pkgconf libarchive-dev lmdb-dev yyjson-dev gpgme-dev libsodium-dev

Gentoo

sudo emerge dev-build/meson dev-build/ninja dev-util/pkgconf app-arch/libarchive dev-db/lmdb dev-libs/yyjson app-crypt/gpgme dev-libs/libsodium

Void Linux

sudo xbps-install meson ninja pkgconf libarchive-devel lmdb-devel gpgme-devel libsodium-devel

FreeBSD

sudo pkg install meson pkgconf ninja lmdb libarchive yyjson gpgme libsodium

libseccomp is not available on FreeBSD; the install-script sandbox falls back to chroot() only there (see Install-script sandbox). Default configuration paths follow FreeBSD's hier(7) and resolve under /usr/local/etc/apg/ instead of /etc/apg/.

Build

meson setup build --buildtype=release
meson compile -C build

Install

sudo meson install -C build

License

This project is licensed under the GNU General Public License v3.0 (GPL-3.0).

See the LICENSE file for details.