pkg.haus

Use the archive

Fetch the signing keyring and add the source. Pick the suite matching your Debian release:

sudo curl -fsSL -o /usr/share/keyrings/pkghaus-archive-keyring.gpg \
    https://apt.pkg.haus/pkghaus-archive-keyring.gpg

sudo tee /etc/apt/sources.list.d/pkghaus.sources > /dev/null <<EOF
Types: deb
URIs: https://apt.pkg.haus
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/pkghaus-archive-keyring.gpg
EOF

sudo apt update
sudo apt install pkghaus-archive-keyring <package>

pkghaus-archive-keyring takes over the manually fetched trust anchor: key rotations then arrive as ordinary signed package updates.

One release, three suites

Each upstream release is built three times - once per suite, against that suite's libraries. The version qualifier carries the suite; qualifiers order below the plain version, so upgrading your system from stable towards unstable upgrades these packages rather than fighting them.

amd64arm64 main

How it's built

• From source, at upstream tags. Each release triggers the ingest, which builds the packaging repository's newest tag with per-suite builder images and adds only what the archive lacks.
• Natively per architecture. amd64 and arm64 build on their own runners - nothing is emulated.
• Immutable pool. Published files never change; different bytes always mean a new version.
• Open end to end. Packaging repositories, the build action and the archive machinery are public - every package is reproducible from its tag.

Signing key

The archive is signed; APT verifies every release against the keyring fetched above. The key's primary fingerprint, for independent verification: