pacvamp-repo vendor

• Usage: pacvamp-repo vendor [FLAGS]

Generate a vendor-built package from the vendor's packslip

Reads vendor.toml beside the PKGBUILD, fetches the vendor's signed release list and picks the newest release older than the minimum release age (or --version), fetches and verifies that release's packslip against the pinned key, enforces the evidence floor and no-downgrade against vendor.lock, then rewrites pkgver, pkgrel and the checksum arrays in the PKGBUILD and writes <pkgbase>.vendor.json for the built package to ship. Without --write it reports what it would do.

Flags

• -p --pkgdir <PKGDIR> — The package directory holding PKGBUILD and vendor.toml

  Default: .

• --version <VERSION> — Use this release instead of the newest eligible one

• --allow-downgrade — Accept a lower evidence level than vendor.lock records

• -w --write — Apply the changes

• -J --json — Print the report as JSON

• -h --help — Print help