odio-apt-repo

Automated APT repository for the odio ecosystem.

Part of the odio project — full documentation.

Odio APT Repository

Automated APT repository for the Odio ecosystem, served via GitHub Pages.

Packages

User Install

Stable releases

# Add GPG key
curl -fsSL https://apt.odio.love/key.gpg \
  | sudo gpg --dearmor -o /usr/share/keyrings/odio.gpg

# Add repository
echo "deb [signed-by=/usr/share/keyrings/odio.gpg] https://apt.odio.love stable main" \
  | sudo tee /etc/apt/sources.list.d/odio.list

# Install
sudo apt update
sudo apt install go-odio-api go-mpd-discplayer spotifyd mympd mpd2mpris

Testing (release candidates)

# Add testing repo (after adding the GPG key above)
echo "deb [signed-by=/usr/share/keyrings/odio.gpg] https://apt.odio.love testing main" \
  | sudo tee /etc/apt/sources.list.d/odio-testing.list

sudo apt update
sudo apt install go-odio-api

Tags containing -rc, -beta, or -alpha go to testing. Everything else goes to stable.

Rename note: mpDris2 was renamed to mpd2mpris. New installs should use mpd2mpris; the mpdris2 package stays in the repo (pinned at v0.11.1, the last release shipping mpdris2_*.deb) so existing apt install mpdris2 setups keep resolving. The two carry different package names, so both coexist.

How it works

1. A source project (go-odio-api, go-mpd-discplayer, spotifyd, odio-mympd, or mpd2mpris) publishes a GitHub Release with .deb artifacts
2. Its CI triggers a repository_dispatch on this repo
3. This repo’s CI downloads the .deb from each source project’s latest stable and prerelease tags, skipping any release already fetched in a previous run (a cached debs/ keyed on the resolved versions)
4. reprepro builds the APT repository metadata for both stable and testing suites
5. GitHub Pages serves the result

A scheduled rebuild (Monday and Thursday 04:00 UTC) catches any missed releases and keeps the .deb cache warm (GitHub evicts caches after 7 days without access). Thanks to the cache, a rebuild with no new releases re-downloads nothing — keeping source projects’ GitHub download counters honest. No binaries stored in git — source projects remain the single source of truth.

Setup (one-time)

1. GPG signing key

# Generate a key (no passphrase for CI)
gpg --batch --gen-key <<EOF
%no-protection
Key-Type: RSA
Key-Length: 4096
Name-Real: Odio APT Repository
Name-Email: apt@odio.love
Expire-Date: 2y
%commit
EOF

# Export private key → GitHub secret GPG_PRIVATE_KEY
gpg --armor --export-secret-keys "apt@odio.love"

2. GitHub secrets

3. Enable GitHub Pages

In apt-repo → Settings → Pages → Source: GitHub Actions.

4. Add trigger to source projects

Add the job from trigger-snippet.yml to the release workflow of each source project.

Manual rebuild

gh workflow run update-repo.yml

Or with specific versions (any subset of inputs):

gh workflow run update-repo.yml \
  -f odio_version=v0.9.0 \
  -f discplayer_version=v0.8.0 \
  -f spotifyd_version=v0.3.5 \
  -f mympd_version=v25.0.1 \
  -f mpd2mpris_version=v0.12.0

If a manually supplied version contains -rc, -beta, or -alpha, it is routed to testing and the latest stable for that package is kept in stable.

Build script

The repository-build logic lives in scripts/build-apt-repo.sh (called by the workflow):

./scripts/build-apt-repo.sh configure --gpg-key-id "$GPG_KEY_ID"
./scripts/build-apt-repo.sh resolve [--odio-version vX.Y.Z ...] >> "$GITHUB_ENV"
./scripts/build-apt-repo.sh download
./scripts/build-apt-repo.sh build --gpg-key-id "$GPG_KEY_ID"

Run ./scripts/build-apt-repo.sh --help for full subcommand documentation.

License

BSD 2-Clause — see LICENSE.