Package Forge is rethinking package management for Unix systems. We carry statically compiled binaries and portable packages in AppImage and other formats, taken from upstream wherever upstream already ships them and built by us where nobody does, along with a package manager that installs them without root.
| Project | Description |
|---|---|
| soar | A modern, lightweight, distro-independent package manager built in Rust. |
| soarpkgs | Declarative package manifests. Each one says where a package comes from and pins the artifact by checksum, rather than building it. Browse it at soarpkgs.qaidvoid.dev. |
| builds | Builds the packages upstream does not ship itself, published as releases that soarpkgs pins like any other source. |
| sbuilder | The sbuild toolchain: resolve current versions, pin and hash artifacts, validate the tree, and generate metadata. |
| Project | Description |
|---|---|
| aeris | A GUI that drives the package managers already installed, soar included. Experimental. |
| aeris-registry | Adapter manifests, so teaching aeris a new package manager means writing TOML rather than code. |
| aeris-metadata | Icons and package name mappings, for managers that ship neither. |
| Organization | Purpose |
|---|---|
| PkgForge-Dev | Portable builds, mostly AppImages, for software that ships none of its own. One repository per project, and soarpkgs pins what they release like any other upstream. |
| PkgForge-Security | Security tools and research. |
Most of what we need is small and self-contained. Pick whichever fits what you feel like doing:
- Add a package. A manifest in soarpkgs is a short TOML file saying where the thing lives and what its checksum is. The format fits on one page, and
sbuildfills in the hashes for you. - Package something nobody has. If upstream ships no portable build, pkgforge-dev is where a new AppImage repo goes.
- Teach aeris a package manager. An adapter in aeris-registry is TOML declaring which commands to run. No Rust required.
- Find a missing icon. Plenty of packages in aeris-metadata still have none, and tracking one down in the project's own repository takes a couple of minutes. Every one is checked before it ships.
- Tell us what broke. Bug reports on the repo it happened in are worth more than a star.
AI-assisted contributions are welcome. We do not ask what wrote your patch, and the answer is not held against you. What matters is whether it is correct, whether you understand it, and whether you ran it. That is the same standard a hand-written patch meets.
It does rule out four things:
- Read what you send. A pull request you have not reviewed, cannot explain, and did not test is not a contribution. Volume does not substitute for any of the three.
- Do not open issues you have not reproduced. A generated bug report costs more time than a bad patch, because the behaviour it describes may never have happened.
- Do not send generated security reports. A plausible vulnerability that does not exist takes attention away from one that does. Report what you have confirmed, through SECURITY.md.
- Never invent a URL, a hash, or a version. In soarpkgs every one of those is checked against the real artifact, so a guessed value fails
sbuild validaterather than shipping. Run the tooling first and it will tell you what it would tell us.
None of this is specific to AI, and we would ask it of anyone. AI is just what made it cheap to produce work that skipped all four, which is the only reason it needs saying.
Join the conversation on Discord:
PkgForge Discord
`➼` https://discord.gg/djJUs48Zbu
