libapg

Package management library for NurOS.

Dependencies

Dependency	Description
Meson	Build system
Ninja	Build tool
pkg-config	Helper tool for compiling
libarchive	Archive and compression library
lmdb	Embedded key-value database
yyjson	JSON library
gpgme or libsodium	Package signing
libseccomp (optional, Linux only)	Syscall filtering for install script sandbox

Signing backends

libapg supports two signing backends. The build system picks the first one available:

• gpgme (preferred) — PGP signing via GnuPG. Only ECC keys are accepted by default (Ed25519, ECDSA). RSA can be enabled explicitly by passing allow_rsa = true to sign_verify.
• libsodium (fallback) — Ed25519 signing. Always ECC, keys are read from /etc/apg/keys/.

Install-script sandbox

run_script() isolates pre/post-install scripts using the strongest primitive available on the host:

• Linux — unshare() with isolated network, mount, UTS, and IPC namespaces, plus optional libseccomp syscall filtering.
• FreeBSD — Capsicum capability mode (cap_enter()). The script binary is opened before entering capability mode and executed with fexecve(); once sandboxed, the process loses access to global namespaces (path-based lookups, most syscalls).
• Other POSIX platforms — no sandbox primitive is available; scripts run without isolation.

On Linux and FreeBSD, if the sandbox cannot be established the script is not executed (fail closed).

Building

With Nix

nix build

Without Nix

Arch Linux

sudo pacman -S meson ninja pkgconf libarchive lmdb yyjson gpgme

Ubuntu / Debian

sudo apt install meson ninja-build pkg-config libarchive-dev liblmdb-dev libyyjson-dev libgpgme-dev

Fedora / RHEL / CentOS

sudo dnf install meson ninja-build pkgconf libarchive-devel lmdb-devel yyjson-devel gpgme-devel

openSUSE

sudo zypper install meson ninja pkgconf libarchive-devel lmdb-devel yyjson-devel gpgme-devel

Alpine Linux

sudo apk add meson ninja pkgconf libarchive-dev lmdb-dev yyjson-dev gpgme-dev

Gentoo

sudo emerge dev-build/meson dev-build/ninja dev-util/pkgconf app-arch/libarchive dev-db/lmdb dev-libs/yyjson app-crypt/gpgme

Void Linux

sudo xbps-install meson ninja pkgconf libarchive-devel lmdb-devel gpgme-devel

FreeBSD

sudo pkg install meson pkgconf ninja lmdb libarchive yyjson gpgme

libseccomp is not available on FreeBSD; the install-script sandbox uses Capsicum instead (see Install-script sandbox). Default configuration paths follow FreeBSD's hier(7) and resolve under /usr/local/etc/apg/ instead of /etc/apg/.

Build

meson setup build --buildtype=release
meson compile -C build

Install

sudo meson install -C build

License

This project is licensed under the GNU General Public License v3.0 (GPL-3.0).

See the LICENSE file for details.