Build, sign and publish Linux packages — in pure MoonBit

One JSON file becomes a deb, rpm, Arch and Alpine package. Sign them, make apt, dnf, pacman and apk repositories, and check packages from any distribution. No dpkg, no rpmbuild, no root; it runs on Windows, macOS, Linux and in this page.

Try it online Install GitHub

Everything happens in your browser. Files you drop here are never uploaded.

Inspect and verify a package

Drop a .deb, .rpm, .apk or .pkg.tar.* file. You get the metadata, the file list, a check of every checksum and the signature state.

Drop packages here, or click to choose

Or load a sample built right now by linuxpkg:

Check a signature (optional): paste a public key

Build a package

Edit the configuration, add your files, and get all four formats. The bytes are identical to what the command line writes for the same input.

linuxpkg.json

Files (the config names them under "src")

Compression Formats

Install

linuxpkg is published as a signed package in its own repositories, built by linuxpkg itself. Pick your family; the commands are the real ones, checked in CI in each distribution.

Debian, Ubuntu

sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://pxgt.github.io/linuxpkg/linuxpkg.asc | sudo tee /etc/apt/keyrings/linuxpkg.asc >/dev/null
echo "deb [signed-by=/etc/apt/keyrings/linuxpkg.asc] https://pxgt.github.io/linuxpkg/apt ./" | sudo tee /etc/apt/sources.list.d/linuxpkg.list
sudo apt update && sudo apt install linuxpkg

Fedora, openEuler, RHEL family

sudo curl -fsSL https://pxgt.github.io/linuxpkg/rpm/linuxpkg.repo -o /etc/yum.repos.d/linuxpkg.repo
sudo dnf install linuxpkg

Arch Linux

curl -fsSL https://pxgt.github.io/linuxpkg/linuxpkg.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key D6298A33CA44D77415DC1187ECDA980444350858
printf '
[linuxpkg]
SigLevel = Required DatabaseRequired
Server = https://pxgt.github.io/linuxpkg/arch/$arch
' | sudo tee -a /etc/pacman.conf
sudo pacman -Sy linuxpkg

Alpine Linux

sudo curl -fsSL https://pxgt.github.io/linuxpkg/linuxpkg.rsa.pub -o /etc/apk/keys/linuxpkg.rsa.pub
echo https://pxgt.github.io/linuxpkg/alpine | sudo tee -a /etc/apk/repositories
sudo apk add linuxpkg

Signing key fingerprint: D629 8A33 CA44 D774 15DC 1187 ECDA 9804 4435 0858

Other ways

The command line is one static binary (Linux x86_64 and aarch64) or moonx Xpeng/linuxpkg/cmd/main anywhere MoonBit runs; as a library: moon add Xpeng/linuxpkg.

moon add Xpeng/linuxpkg
moonx Xpeng/linuxpkg/cmd/main -- build linuxpkg.json --format all --sign-key release.key

GitHub Action: build and sign packages in your own workflow

Checked by the real tools

Every claim is run in CI against the official tools, in the distributions' containers.

	Debian 12 Ubuntu 24.04	Fedora 41 openEuler 24.03	Arch Linux	Alpine 3.20
package	dpkg -i, lintian	rpm -K, rpm -V	pacman -U, -Qkk	apk add, apk audit
repository	apt (InRelease)	dnf (repomd.xml.asc)	pacman -Sy (repo-add)	apk (apk index)
signature	gpgv, signed-by	rpm -Kv, gpgcheck=1	SigLevel Required	no --allow-untrusted

See the latest CI run