
YAP — Yet Another Packager
io.github.M0Rf30由 GitHub 帳號 M0Rf30 發布v2.9.0更新於 Nov 7, 2026
Build native Linux packages (.deb/.rpm/.apk/.pkg.tar.zst) from a single PKGBUILD via MCP.
概覽
YAP 的配套 MCP 伺服器,讓助理在隔離容器中從單一 PKGBUILD 建置多種 Linux 原生套件(.deb、.rpm、.apk、.pkg.tar.zst)。
- 可以做什麼
- 從同一份 PKGBUILD 為多個發行版建置套件,支援依發行版與架構覆寫變數
- 在隔離的 Docker 或 Podman 容器中建置,並可為其他架構交叉編譯
- 清理、準備與拉取建置環境,並安裝已建置的產物
- 為套件簽章、產生 CycloneDX/SPDX SBOM 附屬檔案,並檢視相依關係圖
- 將建置完成的套件發佈到 OpenArtifact 儲存庫
- 適用情境
- 適合維護 Linux 套件、希望讓助理以 PKGBUILD 專案驅動建置、簽章、SBOM 與發佈流程,而不必手動輸入命令列參數的情境。
- 執行需求
- 以本機 stdio 程序執行,可使用 yap-mcp 執行檔或已發佈的 OCI 映像;容器建置需要安裝 Docker 或 Podman。發佈需要 OpenArtifact 位址與 API 權杖(YAP_OA_URL、YAP_OA_TOKEN 或 YAP_OA_TOKEN_FILE);簽章需要金鑰素材,可選用 YAP_SIGN_PASSPHRASE。YAP_VERBOSE 可開啟除錯記錄。
安裝
在 SourceWeft 中
- 開啟 儀表板中的 YAP — Yet Another Packager,將其新增到工作區。
- 為需要使用其工具的對話啟用該服務。
Desktop only,透過 STDIO。 STDIO 服務會啟動本機處理程序,因此需要 SourceWeft 桌面主機。
其他 MCP 客戶端
參照 儲存庫 中的啟動說明。
README
YAP — Yet Another Packager
[yap-logo][report card] [View examples] [License: GPL v3] [GitHub release]
YAP builds native packages for multiple GNU/Linux distributions from a single PKGBUILD specification. Write your package once; get .deb, .rpm, .apk, and .pkg.tar.zst out. All builds run in isolated OCI containers (Docker or Podman).
Features
- Multi-format output: DEB (Debian/Ubuntu), RPM (Fedora/RHEL/Rocky/openSUSE), APK (Alpine), TAR.ZST (Arch)
- Container isolation: reproducible builds, no host contamination, Docker and Podman supported
- PKGBUILD-based: familiar Arch Linux syntax extended with distribution and architecture overrides
- Cross-compilation: build for a different architecture than your host
- Dependency-aware builds: sequential by default; opt-in parallel topo-sort via
--parallel - Package signing: APK RSA + DEB/RPM/Pacman GPG (no
gpgbinary required) - SBOM generation: CycloneDX 1.5 and SPDX 2.3 sidecars
- Publishing:
yap publishuploads DEB/RPM (and APK/Pacman as raw files) to an OpenArtifact repository - Per-format compression:
zstd/gzip/xzfor DEB and RPM - Changelog support:
changelogPKGBUILD field renders to native format per distro - Pacman scriptlets: full 6-hook lifecycle (pre/post install/upgrade/remove)
- Structured logging: slog-based, tree rendering for long lines, zero external UI deps
Installation
One-liner (Linux/macOS, amd64/arm64):
Pin a version or install only one tool:
Manual download:
Build from source
Requires Docker or Podman:
Quick start
1. Project structure
Create yap.json:
2. PKGBUILD
Create my-package/PKGBUILD:
3. Build
4. Output
Project configuration (yap.json)
Build ordering between packages comes from the install flag and each
PKGBUILD's depends/makedepends — there is no yap.json-level depends
field. See yap.schema.json for the complete spec.
Editor validation (JSON Schema)
A JSON Schema for yap.json ships at the repo root: yap.schema.json.
It documents every supported field (compression, signing, repos, SBOM,
cross-compilation, etc.). Reference it from your yap.json for autocomplete and
inline validation in editors that support JSON Schema:
The schema is published on SchemaStore,
so editors (VS Code, JetBrains, Neovim, …) validate any yap.json by filename
automatically — no $schema line required.
PKGBUILD extensions
Distribution-specific variables
Use __ (double underscore) to override any variable per distribution. Priority (highest wins):
Architecture-specific variables
Supported architectures: x86_64, i686, aarch64, armv7h, armv6h, armv5, ppc64, ppc64le, s390x, mips, mipsle, riscv64, pentium4, any.
Checksum types
Supported (strongest to fastest): b2sums, sha512sums, sha384sums, sha256sums, sha224sums, cksums.
Changelog
- DEB:
usr/share/doc/<pkgname>/changelog.Debian.gz(Lintian-compliant) - RPM: native
%changelogentries embedded in package metadata - Pacman:
.CHANGELOGin the archive - APK: ignored (no Alpine convention)
Pacman scriptlets
Emitted to <pkgname>.install only when at least one hook is defined. pre/post_upgrade fall back to pre/post_install when absent.
Package manager-specific fields
Supported distributions
Model Context Protocol (MCP)
YAP ships a companion yap-mcp binary that exposes the same build pipeline
over the Model Context Protocol, so any
MCP-compatible LLM client (Claude Desktop, opencode, Cursor, Zed, Continue,
Goose, …) can drive yap directly.
Quickstart (release binary):
Or pull the standalone OCI image (also listed on the
MCP registry as io.github.M0Rf30/yap):
Claude Code plugin (server + skill in one)
Smithery
The full tool surface, per-client config snippets, security model, and
troubleshooting are in MCP.md. The shipped skill card at
skills/yap/SKILL.md follows the Anthropic Agent
Skills layout and gives agents a workflow cheatsheet for free. Distribution
channels and release steps are documented in PUBLISHING.md.
CLI reference
Commands
Build flags
Shell completion
Package signing
Signing uses github.com/ProtonMail/go-crypto/openpgp — no gpg binary required.
Key resolution (highest to lowest)
--sign-key <path>CLI flag- Format env:
YAP_APK_KEY,YAP_DEB_KEY,YAP_RPM_KEY,YAP_PACMAN_KEY - Global env:
YAP_SIGN_KEY yap.jsonfieldsigning.keyPath~/.config/yap/keys/<format>.{rsa,gpg}then~/.config/yap/keys/default.{rsa,gpg}
Passphrase resolution mirrors key resolution with _PASSPHRASE suffix.
yap.json signing config
Verifying signed packages
Publishing to OpenArtifact
yap publish uploads built packages to a hosted
OpenArtifact repository, which
serves the apt/dnf indexes (Release, Packages, repomd.xml) itself.
Settings resolve in this order (later wins): the publish object of
yap.json, the YAP_OA_* environment, command-line flags.
Other flags: --config <yap.json|dir> (default ./yap.json), --retries <n>
(attempts per request, default 3), --timeout <duration> (per request, default
30m), --insecure-http, --dry-run.
Behaviour:
- Token: an OpenArtifact API token with write permission on the target
repositories (a
deploytoken,oa_dep_…, is enough). It is sent asAuthorization: Bearer …, is never accepted fromyap.jsonor a flag value (so it stays out of the process list), and is redacted from logs and errors. The token is only sent overhttps, orhttpto a loopback host unless you pass--insecure-http. - Arguments: package files and/or directories. Without arguments the
outputdirectory ofyap.jsonis published. Packages found while scanning a directory whose format has no repository configured are skipped with a warning; an explicitly named file in that situation is an error. - Verification: the SHA-256 returned by the server (or
X-Checksum-Sha256for raw files) must equal the local file's, otherwise the publish fails. - Retries: connection errors and HTTP 408/429/5xx are retried with exponential backoff and jitter; other 4xx answers (bad token, wrong repository, invalid package) fail immediately.
- Idempotent: DEB/RPM packages are immutable on the server, which answers
409. yap then looks the SHA-256 up in the repository listing: identical bytes count as success ("unchanged"), different bytes under the same name and version fail. Raw files are skipped whenX-Checksum-Sha256already matches and replaced otherwise (unless the repository enforces immutable releases, which fails the publish). - Signatures: OpenArtifact signs repository indexes; yap's per-package
.ascfiles are not uploaded for DEB/RPM. For APK/Pacman raw repositories the.sig/.ascsidecars are uploaded next to the package.
Exit status is non-zero if any package failed; the remaining packages are still attempted.
SBOM generation
Output alongside each artifact:
Captured: name, version, license, runtime/build deps, source URLs and checksums, file hashes, DESCRIBES/DEPENDS_ON relationships.
Advanced usage
Cross-compilation
YAP installs the required cross-compilation toolchains and configures the build environment automatically.
Multi-package projects
Packages with "install": true are installed immediately after building so subsequent packages can use them as build-time dependencies.
Build environment preparation
CI/CD integration
GitHub Actions
GitLab CI
Examples
The examples directory contains complete, ready-to-build projects:
PKGBUILD examples
Simple C application
Python application
Web service with systemd
Development
Make targets
Testing
Tests must run sequentially (-p 1):
Internationalization
Supported languages: English (en), Italian (it).
Language is auto-detected from LANG/LC_ALL/LC_MESSAGES/LANGUAGE. Override with --language / -l:
To add a language: copy pkg/i18n/locales/en.yaml to pkg/i18n/locales/{code}.yaml, translate, add the code to SupportedLanguages in pkg/i18n/i18n.go, submit a PR.
Troubleshooting
Container runtime
Build failures
Permission issues
Performance
Contributing
- Fork the repository
- Create a feature branch:
git checkout -b feature/my-feature - Make changes and add tests
- Run
make fmt lint test - Commit and open a pull request
See CODE_OF_CONDUCT.md for community guidelines.
License
GNU General Public License v3.0. See LICENSE.md.
Credits
- Zachary Huff for contributions to Pacur, the project that inspired YAP
- The Arch Linux community for the PKGBUILD format
- All contributors
Built with Go, Cobra, Docker / Podman.
來源:README.md,提交 afd7417
工具
0版本歷史
9- v2.9.0最新Nov 7, 2026
- v2.8.0Oct 23, 2026
- v2.7.6Oct 21, 2026
- v2.7.2Oct 13, 2026
- v2.7.1Oct 5, 2026
- v2.7.0Oct 5, 2026
- v2.6.3Sep 24, 2026
- v2.6.2Sep 16, 2026
- v2.6.1Sep 16, 2026
評分
已滿足適用檢查項的 50%
該評分衡量此收錄條目的完整程度,依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價,也不表示伺服器安全或目前可用:可連通性是帶日期的檢查結果,評分也不包含安裝量或使用者評價。
- 近 30 天內可連通25 分
請保持端點能夠回應 MCP 握手;SourceWeft 每 30 天探測一次。
- 已宣告認證方式10 分
請在註冊中心條目中宣告憑證請求標頭,或保持端點能夠回應探測,以便判定其認證方式。
- 已列出工具15 分
請讓伺服器在無憑證時回應 tools/list,或發布可在沙箱中無憑證啟動的軟體包。
- 描述必需15 分
- 圖示10 分
- 文件15 分
- 授權條款10 分