pkg.haus

Use the archive

Fetch the signing keyring and add the source. Pick the suite matching your Debian release:

sudo curl -fsSL -o /usr/share/keyrings/pkghaus-archive-keyring.gpg \
    https://apt.pkg.haus/pkghaus-archive-keyring.gpg

sudo tee /etc/apt/sources.list.d/pkghaus.sources > /dev/null <<EOF
Types: deb
URIs: https://apt.pkg.haus
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/pkghaus-archive-keyring.gpg
EOF

sudo apt update
sudo apt install pkghaus-archive-keyring <package>

pkghaus-archive-keyring takes over the manually fetched trust anchor: key rotations then arrive as ordinary signed package updates.

One release, three suites

Each upstream release is built three times - once per suite, against that suite's libraries. The version qualifier carries the suite; qualifiers order below the plain version, so upgrading your system from stable towards unstable upgrades these packages rather than fighting them.

amd64arm64 main

How it's built

• From source, at upstream tags. Each release triggers the ingest, which builds that package's newest tag with per-suite builder images and adds only what the archive lacks.
• Natively per architecture. amd64 and arm64 build on their own runners - nothing is emulated.
• Immutable pool. Published files never change; different bytes always mean a new version.
• Open end to end. The packaging, the build action and the archive machinery are public - every package is reproducible from its tag.
• Checkable builds. Every published version's build record and the source package it was built from are at buildinfos.pkg.haus, so the line above is something you can test rather than something we assert.

Signing key

The archive is signed; APT verifies every release against the keyring fetched above. The key's primary fingerprint, for independent verification: