pacvamp-repo sign

• Usage: pacvamp-repo sign <FLAGS>

Sign packages with the repository key after checking provenance

For every package in the directory without a .sig (or the packages given), verify its provenance envelope with an allowlisted build key and that the subject digest matches the file; optionally require a transparency log entry and consistency with the index. Only then run gpg to produce the detached signature pacman checks. A package that fails any check is refused and the command exits 1. Separate signer custody is an operator responsibility; provenance does not prove a builder is honest.

Flags

• -d --dir <DIR> — The repository directory

• --package <PACKAGE> — Only these package files (relative to the directory)

• --build-key <BUILD_KEY> — Allowlisted build key public files, repeatable

• --gpg-key <GPG_KEY> — The GPG key id to sign with

• --gpg <GPG> — The gpg program

  Default: gpg

• --require-rekor — Require a stored transparency log entry about the envelope, with an inclusion proof that reaches its root

• --rekor-pubkey <REKOR_PUBKEY> — The log's public key (SPKI PEM) to verify checkpoints with

• --index <INDEX> — Require the package to be listed with this digest in the index

• -n --dry-run — Check and report without signing

• -J --json — Print the report as JSON; still signs unless --dry-run is also given

• -h --help — Print help