README
¶
stemma 🌿
A reproducible software artifact pipeline, run locally or in CI as one binary.
στέμμα (stémma) — “wreath; lineage”
🌱 What's inside
- Locked HTTP, GitHub and local inputs, organised by software family
- Shared preparation, portable PKG and Intune Windows packaging
- Native Intune, Jamf and Munki destinations
- Executable plugins, including Woodstar's separately owned integration
🚀 Usage
cp stemma.example.yaml stemma.yaml
stemma update
stemma plan
stemma apply
Commit stemma.yaml, software files and stemma.lock.yaml.
| Option | Purpose |
|---|---|
--frozen-lockfile |
Require a matching lockfile; default in CI |
--no-frozen-lockfile |
Permit missing or changed inputs |
--refresh |
Refresh sources during a run |
--no-lockfile |
Ignore the source lockfile without writing it |
--offline |
Require cached source inputs |
--output json |
Machine-readable reports |
prepare stops before publication; inspect reads artifact facts.
Use package --help for standalone packaging and completion for shell setup.
stemma icon App.app --out icons/App.png retains a macOS-rendered PNG;
--refresh explicitly replaces it.
⚙️ Configuration
The generated schema provides editor validation and hover descriptions from Go definitions.
Keep shared settings in the root and import software/**/stemma.yaml for
software families and their assets. Components apply defaults; named artifacts
share builds across destinations. Included local file changes invalidate the lock.
Package timestamps use the source's recorded lock time.
Native metadata retains field ownership: omission preserves existing values,
null clears supported fields, and lists replace whole collections.
Omitted fields inside objects remain unmanaged.
Declare trusted plugin binaries, then run stemma plugins install or
stemma plugins update. Woodstar owns its plugin.
Persist .stemma/state separately from the disposable cache, or set
STEMMA_STATE_DIR. Credentials are referenced by environment-variable name.
🧑💻 Development
mise install
mise run build
mise run generate
mise run test
mise run lint
📄 License
Apache-2.0, with MIT-licensed portions identified in their source headers.
🙏 Credits
- WrapTune-MacOS — Windows packaging and verification reference
- Fleet — BOM and XAR package writers
- mholt/archives — archive handling
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
stemma
command
Stemma is a finite, reproducible software artifact pipeline.
|
Stemma is a finite, reproducible software artifact pipeline. |
|
internal
|
|
|
apple
Package apple inspects macOS artifacts and verifies explicitly bounded signature scopes.
|
Package apple inspects macOS artifacts and verifies explicitly bounded signature scopes. |
|
archive
Package archive extracts a bounded portable subset of ZIP and TAR into leased workspaces.
|
Package archive extracts a bounded portable subset of ZIP and TAR into leased workspaces. |
|
cas
Package cas owns immutable downloaded and derived objects in the disposable cache.
|
Package cas owns immutable downloaded and derived objects in the disposable cache. |
|
config
Package config loads strict project configuration and resolves local recipe composition.
|
Package config loads strict project configuration and resolves local recipe composition. |
|
engine
Package engine orchestrates locked preparation and independent destination reconciliation.
|
Package engine orchestrates locked preparation and independent destination reconciliation. |
|
fileio
Package fileio provides durable replacement and cancellable streaming for local state.
|
Package fileio provides durable replacement and cancellable streaming for local state. |
|
icon
Package icon exports optional application icons as retained, portable PNGs.
|
Package icon exports optional application icons as retained, portable PNGs. |
|
intune
Package intune reconciles native Windows and macOS Microsoft Graph app contracts.
|
Package intune reconciles native Windows and macOS Microsoft Graph app contracts. |
|
intunecontent
Package intunecontent implements the shared ProfileVersion1 transport encryption.
|
Package intunecontent implements the shared ProfileVersion1 transport encryption. |
|
intunewin
Package intunewin writes and verifies portable Intune Win32 content envelopes.
|
Package intunewin writes and verifies portable Intune Win32 content envelopes. |
|
jamf
Package jamf reconciles package records and content using the Jamf Pro v1 API.
|
Package jamf reconciles package records and content using the Jamf Pro v1 API. |
|
lockfile
Package lockfile separates update resolution from preparation of reviewed inputs.
|
Package lockfile separates update resolution from preparation of reviewed inputs. |
|
msi
Package msi inspects the Property table and package code of Windows installers.
|
Package msi inspects the Property table and package code of Windows installers. |
|
munkirepo
Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs.
|
Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs. |
|
pkgbuild
Package pkgbuild creates unsigned component packages from declared local files.
|
Package pkgbuild creates unsigned component packages from declared local files. |
|
source
Package source resolves provider inputs into digest-pinned downloads.
|
Package source resolves provider inputs into digest-pinned downloads. |
|
Package munki builds native pkginfo for an explicitly supported writable subset.
|
Package munki builds native pkginfo for an explicitly supported writable subset. |
|
Package plugin defines Stemma's versioned executable destination protocol.
|
Package plugin defines Stemma's versioned executable destination protocol. |