pkgwatch

Watches upstream releases of tools the Arch/Manjaro repos lag on, verifies them, and rebuilds them into a local pacman repo that pacman -Syu installs from. Design: docs/SPEC.md. Code layout: docs/ARCHITECTURE.md. Changes per release: CHANGELOG.md.

Install

Needs Arch or Manjaro. pkgwatch packages itself: a downloaded release binary bootstraps it once, then updates arrive via pacman -Syu.

1. From a clone of this repo, fetch and verify a release binary (newest tag on the releases page):

   base=https://code.austinschaefer.com/schaefera/pkgwatch/releases/download/v0.5.0
   curl -fLO "$base/pkgwatch-linux-amd64" -fLO "$base/SHA256SUMS" &&
     sha256sum -c SHA256SUMS && chmod +x pkgwatch-linux-amd64
   

2. Set up the machine once (safe to re-run; asks for sudo): ./pkgwatch-linux-amd64 setup. It checks prerequisites, creates the config dir and the local repo ~/.local/share/pkgwatch/repo, and registers that repo first in pacman.conf: a drop-in /etc/pacman.d/pkgwatch.conf plus one Include line, shown as a diff before anything changes. Then sudo pacman -Syu.

3. Declare packages as ~/.config/pkgwatch/packages.d/*.toml (see example.toml.sample there, and SPEC.md > Config schema), including pkgwatch itself as pkgwatch.toml:

   [package.pkgwatch]
   repo = "schaefera/pkgwatch"
   source = "forgejo-release"
   base_url = "https://code.austinschaefer.com"
   asset_pattern = "pkgwatch-linux-amd64"
   
   [package.pkgwatch.verification]
   method = "same-origin-sha256"
   checksum_asset_pattern = "SHA256SUMS"
   

4. Install the packaged binary, then drop the bootstrap one:

   ./pkgwatch-linux-amd64 check && ./pkgwatch-linux-amd64 review pkgwatch --approve &&
     sudo pacman -Syu pkgwatch && rm pkgwatch-linux-amd64 SHA256SUMS
   

5. Enable the timer (at login, then hourly), which runs /usr/bin/pkgwatch:

   mkdir -p ~/.config/systemd/user && cp systemd/* ~/.config/systemd/user/ &&
     systemctl --user daemon-reload && systemctl --user enable --now pkgwatch.timer
   

Hacking on pkgwatch itself: cargo build --release and run target/release/pkgwatch directly; the timer keeps using the packaged one.

Use

• pkgwatch (or pkgwatch check): one pass over all packages — what the timer runs.
• pkgwatch review: step through releases whose verification needs a human (tiers 4–6), answering y/n to approve each. --list only lists them; review <name> [--approve] inspects or approves one.
• pkgwatch cache clear: delete downloads and build trees (~/.cache/pkgwatch); the next run re-fetches what it needs.
• Published builds install with sudo pacman -Syu.

Uninstall

systemctl --user disable --now pkgwatch.timer; then, as root, delete /etc/pacman.d/pkgwatch.conf and its Include line in /etc/pacman.conf (setup kept the original as /etc/pacman.conf.pkgwatch-backup). Packages already installed from the repo stay installed.