pacvamp-repo repack

• Usage: pacvamp-repo repack <FLAGS>

Sign a packslip about a vendor's artifacts on the vendor's behalf

For a package whose vendor publishes no packslip. Reads the PKGBUILD's sources and checksums (from .SRCINFO, or makepkg --printsrcinfo), downloads every remote source, refuses any digest mismatch, and writes <pkgbase>.vendor.json holding a packslip signed with the repository's repackager key, marked attested_by repackager and listing the evidence declared in vendor.toml's [attest] table plus the PKGBUILD checksums themselves. Also writes vendor.lock. The key is a dedicated one: never the build key, whose meaning is "this host built this package file".

Flags

• -p --pkgdir <PKGDIR> — The package directory holding PKGBUILD and vendor.toml

  Default: .

• -k --key <KEY> — The repackager secret key (from packslip keygen)

• --no-log — Do not record the signature in Rekor

• --srcinfo <SRCINFO> — A .SRCINFO to read instead of <pkgdir>/.SRCINFO or makepkg's output

• --cache <CACHE> — Where downloaded sources go; defaults to <pkgdir>/.repack

• --allow-downgrade — Accept a lower evidence level or a different signer than vendor.lock records

• -J --json — Print the report as JSON

• -h --help — Print help