.deb this repository serves
is built by a public GitHub Actions workflow, in a
public packaging repository, from
upstream's own source or release binary. The workflow file, the
build log, the debian/ directory and the resulting artifacts are all
readable without an account. The archive itself is signed with a single GPG key,
and every binary package has a matching source package. Nothing is built on a
laptop, and nothing reaches the mirror that did not come out of a build you can
open and read.
π The chain, end to end
There are two halves: the build, which happens on GitHub in the open, and the publish, which happens on the mirror's server. Both are automatic, and each package moves through them independently.
1. An hourly check against upstream
Each packaging repository runs a check-upstream workflow on a schedule.
It reads the newest stable release or tag from the upstream project, compares it with
the newest release this repository has already published, and does nothing at all if
they match. If upstream is strictly newer, it dispatches the build. Version comparison
is sort -V, and it only ever moves forward, so a retracted or re-tagged
upstream release cannot walk a package backwards.
2. A licence gate
Before anything is compiled, the build downloads the licence file for that exact release and checks it against an allowlist of licences that permit paid redistribution (MIT, Apache-2.0, the BSDs, the GPLs, MPL, EUPL and so on). The check fails closed: a licence that cannot be identified stops the build. This is why some upstream tools are not, and will not be, in the catalogue.
3. The build itself
Each suite is built in a container matching that suite, so a package built for
bookworm links against bookworm's libraries and a package built for
noble links against noble's. Three jobs run per release β Debian binaries,
Ubuntu binaries, and the source package β and the release job requires all three to
succeed. Debug symbols are packaged separately as -dbgsym.
The artifacts are published as a GitHub release tagged
<upstream version>+<build number>: the .deb files,
the .dsc, the .orig.tar.gz and the
.debian.tar.xz. Those files are public, permanent, and are exactly the
files the mirror ingests β the release page is the artifact, not a description of one.
4. Ingest and signing
The mirror polls every packaging repository for a newly published release
(drafts and prereleases are invisible to it), downloads the assets, and hands them to
reprepro, which builds the archive indexes for all eight suites. Each
suite's Release file is then signed with the repository key:
gpg --keyid-format LONG --fingerprint EA0F721D231FDD3A0A17B9AC7808B4DD62C41256The live tree is swapped in atomically once indexing and signing have both succeeded. A package's "last published" marker only advances after that swap, so a failed publish simply retries on the next pass instead of leaving a half-published version behind.
5. The site follows the archive
Every 30 minutes the site generator checks those same markers. When a package has shipped, the version badges, release pages, RSS feed and sitemaps are regenerated from the archive's own data. No page on this site claims a version that the mirror is not actually serving.
β Verify it yourself
None of the above has to be taken on trust. Every step has a command.
Check which repository a package would come from, and its exact version:
apt policy ghostty
apt-cache madison ghosttyCheck the key the archive is signed with:
gpg --show-keys /etc/apt/keyrings/deb.griffo.io.gpg
# fingerprint must be EA0F721D 231F DD3A 0A17 B9AC 7808 B4DD 62C4 1256Compare the .deb apt would install against the artifact GitHub built. Download both and hash them β same file, same digest:
apt-get download ghostty
sha256sum ghostty_*.deb
# then compare against the .deb attached to the matching release at
# https://github.com/dariogriffo/ghostty-debian/releasesRead the packaging, or rebuild it. Add the matching
deb-src line to your sources and the standard Debian tooling works:
apt-get source ghostty
sudo apt-get build-dep ghosttyapt-get source ghostty
apt-get build-dep ghosttyRead the build log. Every packaging repository's Actions tab keeps the full log of the run that produced each release, including the licence check and the container the package was built in.
π¦ Every package, and where it is built
One row per tool: the apt package name, the packaging repository that builds it β
build scripts, debian/ directory, workflow file and CI logs β and the
upstream project it is built from.
π§ What this is not
- Not bit-for-bit reproducible builds. The builds are public, scripted and repeatable, and you can rebuild from the source package β but this repository does not currently claim byte-identical rebuilds in the Reproducible Builds sense.
- Not official, and not endorsed. This is an unofficial repository. It is not part of Debian or Ubuntu, and no upstream project has endorsed it. Where a tool's own maintainers publish packages, use theirs.
- Not a fork. Nothing here patches upstream behaviour. The
packaging exists to put upstream's own release into a
.debwith correct dependencies and file locations, nothing more. Where a patch is unavoidable it lives indebian/patchesin the packaging repo, in the open. - Not a single point of trust you have to accept blindly. If any of it stops being verifiable, that is a bug β report it on the packaging repository.
π And it works the same way for free
The always-free mirror at deb-free.griffo.io serves the same artifacts, from the same builds, signed with the same key β just at a delay of at least two months, with security and patch fixes published immediately. How the free mirror works β