Packslip

Pacvamp consumes packslip 1.x from crates.io. The manifest format and verifier are maintained in jdx/packslip; this repository does not ship the packslip CLI.

A release is one signed packslip.sigstore.json bundle. The verifier checks the signature, signer policy, document validity, and any supplied artifact files. Pacvamp adds repository policy: evidence floors, minimum release age, and persistent rollback protection.

See the vendor pipeline for package declarations, signed release lists, monorepos, and repackager attestations, and the tool channel for publishing verified tools to mise.

Separate CLI

Install the separate CLI with cargo install packslip --version '=1.0.0' --locked. Its CLI reference and publishing guide are upstream.

For the source of the upstream format, see the packslip specification. Pacvamp's architecture describes the client and publisher boundaries.