Build. Sign. Ship. No FreeBSD Builder

Write 30 lines of YAML, run one command, and get a signed FreeBSD package repository that stock pkg understands. PkgOps cross-compiles your Go project on Linux or macOS (or on a GitHub Actions runner), writes the same .pkg files and catalogs FreeBSD's own tools write, and leaves installs and upgrades to the pkg your servers already have.

Go cross-compiles for FreeBSD with CGO_ENABLED=0. No ports tree, no build jail, no FreeBSD machine in your CI.

Real .pkg files, pkg-compatible catalogs, RSA signatures. Tampered catalogs and packages are refused by stock pkg.

Two builds of the same inputs are byte-identical, binary included, so a package is something you can inspect and re-create.

A repository is a directory of files: nginx, any static host, GitHub, or the small optional registry that takes uploads from CI.

Pure Go with zstd and YAML, shipped as a CLI and an importable Go package. It shares no code with JailOps.

rc.d scripts, service users, owned directories and @config files that survive upgrades, all from the manifest.

The right tool for each job. About 95% of packaging work is a small daemon, a CLI tool, some config and an rc.d script: that is PkgOps. The heavy 5%, such as large builds from the ports tree, software that needs CGO or native libraries, custom port options and bulk builds across jails, belongs to poudriere, and PkgOps does not try to replace it. The two coexist: a PkgOps repository is one more entry in /usr/local/etc/pkg/repos.

Laptop or CILinux, macOS, Actionspkgops build

Signed repository.pkg files and catalogpkgops repo, verify

Hostingnginx, registry, GitHubstatic files over HTTPS

FreeBSDpkg installpkg upgrade Optional registry: pkgops servetoken-protected upload, re-sign, retention; web UI built in

The signing key stays with you; FreeBSD hosts only need the public key.

Walkthrough

A Go daemon with an rc.d script.

$ git clone https://github.com/jailops/jailops-pkgops && cd pkgops $ go install ./cmd/pkgops $ pkgops key generate --out repo.key --bits 4096 $ pkgops build --abi FreeBSD:15:amd64 -o dist $ pkgops build --abi FreeBSD:15:aarch64 -o dist $ pkgops repo --repo site --key repo.key dist//.pkg $ pkgops verify site/FreeBSD:15:amd64/latest --pubkey repo.pub $ pkgops publish --from site --to /var/www/pkg

pkgops.yaml, abridged

name: hello version: 0.1.0 comment: A tiny HTTP daemon www: https://example.org maintainer: you@example.org license: BSD2CLAUSE build: {type: go, package: ./cmd/hello} files:

• {source: build/${ARCH}/hello, destination: bin/hello} services:
• {name: hello, source: packaging/rc.d-hello}

on the FreeBSD host, as root

$ fetch -o /usr/local/etc/pkg/keys/hello.pub https://pkg.example.org/repo.pub $ pkgops conf --name hello --url 'https://pkg.example.org/${ABI}/latest'
--pubkey /usr/local/etc/pkg/keys/hello.pub > /usr/local/etc/pkg/repos/hello.conf $ pkg update $ pkg install hello $ sysrc hello_enable=YES $ pkg upgrade # later, after a new release

The complete manifest reference, a runnable example and the format notes are in the PkgOps repository.