ArtifactX — publish apt/yum repos from one static binary

Import first. Cut over when ready.

Pull packages from the repositories you already publish, build new ones when you need them, re-sign apt/yum metadata under your own key, and serve the result from one static Rust binary.

ArtifactX (arx) is for teams that ship Linux packages and are tired of operating Nexus, aptly, Pulp, S3 glue scripts, a custom signing job, and a web server just so users can run apt install or dnf install.

The repository is a directory you can inspect, back up, move, and rebuild. The service is one binary with no daemon state and no database.

arx init ./repo                        # repository layout + signing key
arx add dist --root ./repo             # your built .deb / .rpm files
arx publish --root ./repo              # sign and index apt + yum metadata
arx serve --root ./repo                # http://127.0.0.1:8080

arx serve listens on 127.0.0.1 only, so that example serves clients on the same host. Point a client at the repo first — trust the key and add the source, as shown in Install clients.

sudo apt-get update && sudo apt-get install myapp
# or
sudo dnf install myapp

Already publishing elsewhere? Migrate a slice first, verify clients, then cut over:

arx import https://packages.example.com --apt \
  --dist stable --component main --match-name myapp --limit 20 --root ./repo

Three things enter — an existing apt/yum repository, the .deb/.rpm files you already built, or a manifest that arx pack turns into packages. One thing leaves: signed apt/yum metadata plus a directory of static files that any dumb HTTP host can serve.

• Import first — pull packages from existing apt or yum/dnf repositories into your own signed repo, bounded by --match-name, --arch, and --limit.
• One binary — pack, add, import, publish, publish-dir, serve, push, promote, search, GC, rollback.
• Package output — .deb, .rpm, .apk, and Arch .pkg.tar.zst from a manifest or Rust Cargo.toml. It packages binaries you have already built — it does not run cargo build for you. Only .deb and .rpm feed the apt/yum index; the other two are artifacts for downstream channels.
• Signed repository metadata — apt InRelease / Release.gpg, yum repomd.xml.asc. Package payload signing stays in your build pipeline.
• Atomic publish + rollback — build metadata in staging, flip the live state, and return to a previous state when a bad release escapes.
• CI-friendly push — upload to arx serve with a token or GitHub OIDC.
• No daemon required — static binary, Docker image, or a GitHub Pages-hosted repo. Clients verify the signature, not the host.

The org's own package repository runs on this: artifactx-rs.github.io/artifactx is a signed apt/yum repo generated by the same binary, with no server behind it.

• artifactx — the arx CLI, packager, repository generator, server, and documentation.
• createrepo_rs — pure-Rust drop-in for createrepo_c; byte-identical dnf/yum repodata, no C dependencies.
• repo — the package repository and GitHub Pages feed.

GitHub is the live source of truth for planning state. The org profile stays version-neutral; milestones and issues update as work moves, and ROADMAP.md keeps the product narrative.

Project board · Open milestones · Backlog · Roadmap narrative