Import, push, keys, adopt, disown, restore

A package base is a directory with a PKGBUILD and a .SRCINFO, stored as repos/<pkgbase>.git on branch master.

Import a directory you trust

taur --home /var/lib/taur import ./my-pkg --maintainer alice

Omit --maintainer to leave it orphaned. This reads .SRCINFO. It does not run the PKGBUILD.

Push

HTTP uses your account name and a session token as the password. SSH uses a key registered with taurctl key add. The server checks the branch, fast-forward, file size, and .SRCINFO. Simple pkgver= lines in the PKGBUILD must agree with .SRCINFO. Shell in the PKGBUILD is not executed unless TAUR_PKGBUILD_ISOLATION=bwrap.

git clone https://packages.taur.weirdbrains.com/hello-taur.git
git push https://alice:TOKEN@packages.taur.weirdbrains.com/hello-taur.git master

paru clones /{pkgbase} without .git. Both paths are the same repository.

Adopt and disown

Over SSH, adopt files an adoption request even for a site admin. On the HTTP API a site admin takes an orphan immediately; everyone else gets HTTP 202 and a request id. The maintainer's disown promotes the co-maintainer with the lowest user id. A co-maintainer who disowns only leaves the co-maintainer list.

Restore

taurctl request file hello-taur --kind deletion --comment "replaced"
# a site admin accepts it, then either the former maintainer or an admin:
curl -X POST -H "Authorization: Bearer $TOKEN" \
  https://packages.taur.weirdbrains.com/api/v1/packages/hello-taur/restore

The git history comes back from repos/.deleted/ and the package is an orphan. Metadata is the HEAD:.SRCINFO from that repository.