Semi-automated package updating mechanism via pacman for dependencies which want or need bleeding edge updates from repo/source.

Austin Schaefer bf46cbf073 First working iteration: check -> fetch -> verify for a real package ... Rust PoC (cargo, packages.d/*.toml config) that checks astral-sh/uv's GitHub Atom feed for a new release, fetches the matching asset via the GitHub API, and verifies it. Confirmed live against the real repo: uv actually ships GitHub build-provenance attestations (sigstore bundle) on every release, so it's a tier-2 package, not the tier-4 same-origin-sha256 guessed in the original spec draft. Verified via `gh attestation verify` rather than reimplementing sigstore in Rust. State persists across runs so a second run correctly reports "up to date." Also folds the finding back into SPEC.md: updates the uv example to tier 2, derives tier from verification method instead of storing both (avoids a tier/method mismatch that would mean nothing), marks the packages.d/ layout question resolved, and updates Architecture/Status to say what's actually implemented vs. still sketch (build/publish/review queue, same-origin-sha256 against a live repo, scheduling, non-GitHub sources, minisign are all still open). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A2FEut5tVMNjeVjqhgVZbr		2026-09-11 10:04:48 +02:00
packages.d	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00
src	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00
.gitignore	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00
Cargo.lock	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00
Cargo.toml	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00
SPEC.md	First working iteration: check -> fetch -> verify for a real package	2026-09-11 10:04:48 +02:00