Skip to content

Usage Pacman

Jump to bottom
Alexander Birkner edited this page Sep 1, 2026 · 2 revisions

Usage: pacman (Arch Linux)

Publishing

silo publish ./hello-1.0-1-x86_64.pkg.tar.zst --repo myrepo --channel arch

The format is inferred from the file extension; pass --format pacman to be explicit. Publishing is gRPC/CLI-only — there is no HTTP publish path for pacman.

Consuming — public repo only

# /etc/pacman.conf
[myrepo]
SigLevel = PackageOptional DatabaseRequired
Server = http://silo.internal:8080/myrepo/stable/pacman/$arch

$arch is expanded by pacman itself, the same as $repo in the section name above it. silo just needs a Server = line ending in /pacman, one directory per architecture underneath.

pacman cannot authenticate reads. Unlike the yum/apk examples on the other pages, there is no user:pass@ form here: pacman's downloader does not send credentials embedded in the URL, so a token placed there is silently never sent — this isn't a silo limitation, pacman simply presents no repo credential at all. A repo consumed by pacman therefore must be public:

silo repo set myrepo --mode=public

A private repo just 404s for pacman, the same way it would for any caller with no credential. If you need pacman to authenticate anyway, point XferCommand at a wrapper script that adds the credential yourself — pacman.conf has no other hook for it.

Publishing still requires a write-scoped token regardless of repo mode; only reads are affected by pacman's inability to send credentials.

any packages

Like apk's noarch, an any-architecture package needs no special handling: pacman only ever fetches its own architecture's database, so silo answers for any content under whichever architecture asks.

Signing

If the server has signing.pacman configured (see Setup), the repo database (db.tar.gz) is signed with a detached binary signature (db.tar.gz.sig) — the shape pacman-key/repo-add -s produce and expect. This is a separate key from RPM's signing.gpg, so the two can be signed independently.

curl -fsS https://silo.example.com/pacman-signing-key | pacman-key --add -
pacman-key --lsign-key <fingerprint>

GET /pacman-signing-key is unauthenticated, the same reasoning as RPM's /RPM-GPG-KEY-silo. Note SigLevel = PackageOptional DatabaseRequired above: silo signs the repo database, not individual packages. Drop DatabaseRequired (or set SigLevel = Never) if signing.pacman isn't configured.

Silo never signs the .pkg.tar.zst file itself — whatever you silo publish is stored and served as-is. PackageOptional above means that's fine by default. If your clients instead set SigLevel = PackageRequired, you have to sign each package before publishing it — with makepkg --sign (or gpg --detach-sign --output foo.pkg.tar.zst.sig) — and you should use the same OpenPGP key as the server's signing.pacman. Signing with a different key would mean pacman clients need to import and trust two separate keys instead of the one already fetched from /pacman-signing-key.

Clone this wiki locally