SOW - Software Object Warehouse

sow is an open-source RPM / DEB repository manager from Pigsty. One self-contained binary turns a directory of packages into a working YUM / APT repository, and manages curated repositories with signing, snapshots, audit history, and incremental publication when you need more control.

"Software Object Warehouse": store once, serve everywhere, ship only what changed.

Website | Docs | Get Started | Download | Release Notes | Discuss | Pigsty | 中文

---

Get Started

sow ships in the Pigsty infra repository for mainstream Linux distros on amd64 / arm64:

# APT: Debian / Ubuntu and compatible platforms
sudo tee /etc/apt/sources.list.d/pigsty-infra.list > /dev/null <<'EOF'
deb [trusted=yes] https://repo.pigsty.io/apt/infra generic main
EOF
sudo apt update && sudo apt install -y sow

# YUM: RHEL / Rocky / Alma / Anolis and compatible platforms
sudo tee /etc/yum.repos.d/pigsty-infra.repo > /dev/null <<'EOF'
[pigsty-infra]
name=Pigsty Infra for $basearch
baseurl=https://repo.pigsty.io/yum/infra/$basearch
enabled=1
gpgcheck=0
module_hotfixes=1
EOF
sudo dnf makecache && sudo dnf install -y sow

For mainland China users: consider replacing repo.pigsty.io with repo.pigsty.cc.

Pinned RPM / DEB packages, installer-free tarballs for Linux and macOS, and source builds are covered on the download page and published on GitHub Releases.

Then point sow at a directory of packages:

sow create ./packages                       # emit YUM / APT repository metadata in place
sow create ./packages --sign-with <KEYID>   # also sign currently unsigned RPMs with a GPG key

That directory is now a repository. RPMs become a normal YUM/DNF repository, DEBs become a flat APT repository, and a mixed directory gets both. Serve it with any static web server; --pigsty enables the Pigsty layout conventions, and sow help create documents the complete option contract. Continue with the Quick Start.

---

Features

• Flat repositories: sow create replaces createrepo_c, dpkg-scanpackages, and reprepro. One command indexes RPM and DEB packages in place, with optional GPG signing.
• One pool, many views: a managed Repository stores each package body once and projects metadata-only Dists for EL, Debian, and Ubuntu, so neither disk nor object storage holds duplicate payloads.
• Explicit state: Desired membership is separate from Built state, every build publishes an immutable Generation, and sow check / status / changes / log keep validation and history inspectable.
• Incremental publication: sow changes reports the exact delta and sow publish uploads only that, to filesystem or Cloudflare R2 (S3-compatible) targets, with atomic pointer switches and fail-closed recovery.
• Self-contained: one static Go binary (CGO_ENABLED=0). No daemon, no database service, no language runtime. Linux and macOS, amd64 and arm64.

---

Managed workspaces

Plain sow create treats repository metadata as a deterministic result of the directory: change the inputs and run it again. A managed workspace is for repositories that SOW should own over time, with explicit membership, policy, signed metadata, immutable snapshots, audit history, and publication targets:

sow init ./lab
sow repo new local --workdir ./lab
sow dist new stable --format rpm --workdir ./lab --repo local
sow add ./packages/example.rpm --workdir ./lab --repo local --dist stable
sow check --workdir ./lab --repo local
sow status --workdir ./lab --repo local
sow changes --workdir ./lab --repo local
sow log --workdir ./lab --repo local

sow add and sow rm converge the selected Dist to a new Built Generation by default. Configure a filesystem or r2 target in sow.yml, then sow publish TARGET uploads the change set and sow gc collects unreachable local payloads. sow help COMMAND is the authoritative CLI reference shipped with the binary; machine consumers can rely on the closed --json envelopes and the documented exit-code contract.

Upgrading a workspace created by SOW v0.3? Run sow repo migrate REPOSITORY --workdir DIR once for each Repository before ordinary use; the v0.4.0 release notes explain what the migration repairs. Publication ordering, recovery, target rebinding, the one-copy boundary, and RPM leaf export are specified in Commands and Design Records.

---

Build

Building from source requires Go 1.27.0 or newer; repository signing additionally requires a usable GPG installation and key.

make build          # write the binary to bin/sow
make test-core      # focused repository-manager tests
make test           # all Go packages plus the patched RPM module
make check          # format, module, vet, staticcheck, deadcode, focused tests
make release-local  # GoReleaser snapshot archives and packages under dist/

GitHub Actions runs regular checks in CI and Docker-backed client / S3 coverage in Integration. Pushing an exact semantic-version tag creates a draft GitHub release after the tag is validated against main, the source version, and the changelog; publishing that draft is a separate manual decision. Maintainers can also run a read-only check against hosted Cloudflare R2 with make test-r2-live (see the SOW_REAL_R2_* variables in the Makefile).

---

About

The authoritative user documentation lives in SOW Docs; dated architecture decisions live in Design Records. Historical implementation and verification material remains attached to versioned source tags rather than a second documentation tree in this repository.

SOW is built by the Pigsty team (pgsty), alongside:

• pigsty — open-source PostgreSQL distribution with HA, PITR, IaC, monitoring, and hundreds of extensions
• pig — PostgreSQL and extension package manager for EL / Debian / Ubuntu
• silo — S3-compatible object storage, a community-maintained MinIO fork

SOW is licensed under the Apache License, Version 2.0. Bundled third-party components remain under their respective licenses.