Previously, we worked at other startups building open source developer tools that ran on our customers’ CI and development machines. For many of them, being able to `apt-get install` our tools was a requirement.

When we went to actually set up APT repositories, we were really surprised by the state of tooling around package publishing. The open source tools we found were old, slow, and difficult to figure out how to run in CI. The commercial tools we found were not much better. The cloud-hosted vendors required us to provide our signing keys to a cloud vendor (which was a non-starter), while the self-hosted vendors required us to operate our own specialized hosting servers.

We just wanted something simple: sign locally, run quickly, be easy to use, and deploy to managed object storage.

We couldn’t find it, so we built it. If you want to try it out, you can create a repository with three commands:

    attune repo create --uri https://apt.releases.example.com
    attune repo pkg add --repo-id 123 package.deb
    attune repo sync --repo-id 123

It’s fully open source under Apache 2. We’re also working with some early customers to build enterprise features like audit logging, RBAC, and HSM integrations, and we’re thinking about building a managed cloud hosting service as well.

We’d love your feedback on whether this is useful for you, and what you’d like to see next. We’re well aware that publishing is a small piece of CI/CD, but we think a lot of the tooling in this area (publishing, artifact registries, package repositories) could really use some love.

What do you think? Comment here, or email us at [email protected].