OM omapkg

Evidence and controls.

These pages describe the package request flow, security boundaries, and inputs used for reproducible Arch builds.

Security controls

How input inspection, agent tools, workers, signing, and public records are separated.

review before trust

Build policy

How the system handles immutable Git and download inputs, dependency bundles, offline builds, and promotion gates.

inputs before artifacts
For users and maintainers

Each request passes four checks.

  1. Request

    Submit a package name and upstream Git or direct download URL.

  2. Inspect

    The inspector records the input format, immutable digest, and source evidence.

  3. Build

    The factory generates a recipe; workers build from a sealed manifest in a disposable offline environment.

  4. Publish

    Signed binaries or recipe records enter dev before a maintainer decides on stable promotion.