Signed package repository

TomTonic package repository

One apt/dnf/zypper/pacman/apk source for the TomTonic command-line tools.

GPG signed

AA9C 6D63 B7B6 C0BC 18A8
9693 E372 5F71 EDDA EC03

This page and every index below are rebuilt automatically by a GitHub Actions workflow in TomTonic/pkg-repo, pulling signed release assets straight from each tool's own GitHub repository. Nothing here is hand-uploaded.

Currently served tools

extract-sbom github → Standardized incoming inspection for software deliveries — produces an SBOM plus an auditable report.

prune_backups github → Prunes incremental backup directories on an hourly/daily/monthly retention schedule.

Debian / Ubuntu and derivatives

apt amd64 · arm64

sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://pkg.tomtonic.de/pubkey.gpg | sudo tee /etc/apt/keyrings/tomtonic.gpg >/dev/null
echo "deb [signed-by=/etc/apt/keyrings/tomtonic.gpg] https://pkg.tomtonic.de/apt stable main" | \
  sudo tee /etc/apt/sources.list.d/tomtonic.list
sudo apt update && sudo apt install extract-sbom

The keyring file must end in .gpg, not .asc. apt's internal signature check treats any .asc-named keyring as ASCII-armored and tries to re-armor this (already binary) key — that silently produces an empty keyring and breaks verification on every architecture, amd64 included, not just arm64.

Fedora / RHEL / CentOS / Rocky / Alma / openSUSE

dnf / zypper x86_64 · aarch64

sudo curl -fsSL -o /etc/yum.repos.d/tomtonic.repo https://pkg.tomtonic.de/rpm/tomtonic.repo
sudo dnf install extract-sbom   # or: sudo zypper install extract-sbom

Arch Linux and derivatives

pacman x86_64 · aarch64

# add to /etc/pacman.conf:
#   [tomtonic]
#   SigLevel = Optional TrustedOnly DatabaseRequired
#   Server = https://pkg.tomtonic.de/pacman/$arch
curl -fsSL https://pkg.tomtonic.de/pubkey.gpg | sudo pacman-key --add -
sudo pacman-key --lsign-key AA9C6D63B7B6C0BC18A89693E3725F71EDDAEC03
sudo pacman -Sy extract-sbom

Alpine

apk x86_64 · aarch64

sudo curl -fsSL -o /etc/apk/keys/tomtonic.rsa.pub https://pkg.tomtonic.de/alpine/tomtonic.rsa.pub
echo "https://pkg.tomtonic.de/apk" | sudo tee -a /etc/apk/repositories
sudo apk update && sudo apk add extract-sbom