Ora — Omni Repository for Archives

A secure, decentralized package manager for pre-compiled binaries.

Ora is a package manager for installing and managing pre-compiled binaries from diverse sources including GitHub Releases, GitLab, custom APIs, webpage scraping, and direct URLs. It runs in userland by default (no root required), supports both decentralized git-based registries and direct HTTPS registries, and enforces comprehensive security configurations to protect against supply chain attacks.

Key features:

• Multi-source support — GitHub Releases, GitLab, custom APIs, webpage scraping, direct URLs
• Dual registry modes — Git-based collections or direct HTTPS endpoints
• Security-focused — Checksum verification, GPG signatures, SSRF prevention, zip bomb protection
• Zero root required — Installs to ~/.local by default
• Cross-platform — Automatic OS/architecture detection
• Flexible — Webpage scraping for software without APIs

• Language: Rust 2021 edition
• CLI: clap 4.x
• Async Runtime: tokio
• HTTP Client: reqwest
• Git: git2
• GPG: sequoia-openpgp (optional feature)
• Checksums: sha2
• Build System: Task (go-task)

# 1. Install Ora (requires Rust)
cargo install --git https://github.com/Altagen/Ora

# 2. Add a registry
ora registry add my-packages https://github.com/user/ora-packages.git

# 3. Sync the registry
ora registry sync

# 4. Install a package
ora install ripgrep

New to Ora? See the Getting Started Guide for a complete walkthrough.

Download the pre-compiled binary for your platform from the Releases page:

# Linux x86_64
curl -fsSL https://github.com/Altagen/Ora/releases/latest/download/ora-<version>-linux-amd64.tar.gz | tar xz
sudo install -m 755 ora-<version>-linux-amd64 /usr/local/bin/ora

# macOS (Apple Silicon)
curl -fsSL https://github.com/Altagen/Ora/releases/latest/download/ora-<version>-macos-arm64.tar.gz | tar xz
sudo install -m 755 ora-<version>-macos-arm64 /usr/local/bin/ora

git clone https://github.com/Altagen/Ora
cd Ora
cargo build --release
sudo cp target/release/ora /usr/local/bin/

# Install libclang first (Arch: clang, Ubuntu: libclang-dev, macOS: llvm)
cargo build --release --features gpg

# Add a Git registry (collection of packages)
ora registry add my-registry https://github.com/user/ora-packages.git

# Add a Direct URL registry (single package)
ora registry add windsurf https://example.com/packages/windsurf.repo

# List, sync, remove registries
ora registry list
ora registry sync
ora registry remove my-registry

ora search ripgrep
ora info ripgrep
ora install ripgrep
ora install ripgrep --version 14.1.0
ora install --repo ./package.repo

ora list
ora update
ora uninstall ripgrep

ora config show
ora config verify
ora config init

Ora uses TOML configuration files in XDG locations:

• Global config: ~/.config/ora/config.toml
• Security policies: ~/.config/ora/security.toml
• Package database: ~/.config/ora/installed.toml

Security is Ora's top priority. All downloads are verified with checksums, and the system includes protections against path traversal, zip bombs, SSRF attacks, and more.

For complete security details, see Security Configuration.

Reporting security vulnerabilities: Please use GitHub Security Advisories — do not open public issues.

ora/
├── src/
│   ├── main.rs             # CLI entry point
│   ├── commands/           # CLI subcommands
│   ├── registry/           # Registry management
│   ├── package/            # Package installation
│   └── security/           # Checksum & GPG verification
├── docs/
│   ├── GETTING_STARTED.md
│   ├── CREATING_REPO_FILES.md
│   └── SECURITY_CONFIGURATION.md
├── Cargo.toml
└── Taskfile.yaml

git clone https://github.com/Altagen/Ora
cd Ora

# Build
cargo build

# Run tests
cargo test

# Lint
cargo clippy --all-targets --all-features -- -D warnings

• Getting Started — Installation, first steps, daily usage
• Security Configuration — Security policies and options

• Quick Start: Create a .repo File — 5-minute guide
• Creating .repo Files — Complete packaging guide
• .repo Schema Reference — Full schema documentation

Issues and bug reports are welcome on GitHub.

Ora is dual-licensed under your choice of:

• MIT License — LICENSE-MIT
• Apache License 2.0 — LICENSE