← System

Packaging & updates

Updates run on two planes. The base OS (kernel, drivers, core libraries) updates by re-imaging — a whole tested image, not piecemeal. Applications and userspace tools update through wgpkg from a network repo, so the day-to-day update surface is small and low-risk.

Signed index: the repo’s wgpkg.index.toml is OpenPGP-signed. wgpkg update fetches the detached signature and verifies it (pure-Rust, no gpg binary) against the release key baked into the image; the key’s fingerprint is also pinned in the wgpkg binary, so swapping the on-disk key does not defeat the check. An index that fails verification is refused and the previously-cached index is left untouched (fail closed). Each package is then checked by sha256 against the verified index.

The repo lives at https://www.webgen.com.au/linux/; the client’s repos are in /etc/wgpkg/repos.conf.