stemma

module

v0.2.0 Latest Latest Go to latest Published: Sep 13, 2026 License: Apache-2.0, MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/woodleighschool/stemma

Links

Open Source Insights

README ¶

stemma 🌿

Stemma is a cross-platform software artifact pipeline.

It downloads software, prepares installers and publishes them to Munki, Intune, Jamf or a destination provided by a plugin. Catalogs describe the software and its destination settings in YAML.

[!WARNING] This project may be unstable or have bugs, use with caution. Also expect breaking changes between releases for now.

🌱 What's inside

Build macOS packages and Intune intunewin files on macOS, Linux or Windows
Download software and lock its inputs
Extract application metadata and icons
Publish to Munki, Intune and Jamf
Preview destination changes before applying them
Add sources, builders and destinations through plugins

🚀 Usage

Start with stemma-catalog. Follow its setup instructions, then run from the catalog:

stemma prepare
stemma plan

prepare downloads and prepares the software; plan shows what would be published. Use stemma apply to publish after reviewing the result.

📖 Documentation

🧑‍💻 Development

mise install
mise run deps
mise run build

See development for checks, generation and the docs preview.

📄 License

Licensed under the Apache License 2.0.

🙏 Credits

WrapTune-MacOS — Windows packaging and verification reference
Fleet — XAR package writer
mholt/archives — archive handling
AutoPkg — inspiration for software packaging workflows

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
stemma command Stemma is a finite, reproducible software artifact pipeline.	Stemma is a finite, reproducible software artifact pipeline.
internal
apple Package apple inspects macOS artifacts and verifies explicitly bounded signature scopes.	Package apple inspects macOS artifacts and verifies explicitly bounded signature scopes.
archive Package archive extracts a bounded portable subset of ZIP and TAR into leased workspaces.	Package archive extracts a bounded portable subset of ZIP and TAR into leased workspaces.
artifactname Package artifactname names published installers independently of their input paths.	Package artifactname names published installers independently of their input paths.
cas Package cas owns immutable downloaded and derived objects in the disposable cache.	Package cas owns immutable downloaded and derived objects in the disposable cache.
config Package config loads project and resource documents and resolves local composition.	Package config loads project and resource documents and resolves local composition.
diskimage Package diskimage reads selected installer payloads from portable HFS+ and APFS DMGs.	Package diskimage reads selected installer payloads from portable HFS+ and APFS DMGs.
engine Package engine orchestrates locked preparation and independent destination reconciliation.	Package engine orchestrates locked preparation and independent destination reconciliation.
fileio Package fileio provides durable replacement and cancellable streaming for local state.	Package fileio provides durable replacement and cancellable streaming for local state.
icon Package icon exports optional application icons as retained, portable PNGs.	Package icon exports optional application icons as retained, portable PNGs.
inspect Package inspect collects static artifact facts while retaining the input.	Package inspect collects static artifact facts while retaining the input.
intune Package intune reconciles native Windows and macOS Microsoft Graph app contracts.	Package intune reconciles native Windows and macOS Microsoft Graph app contracts.
intune/graph/beta
intune/graph/beta/deviceappmanagement
intune/graph/stable
intune/graph/stable/deviceappmanagement
intunecontent Package intunecontent implements the shared ProfileVersion1 transport encryption.	Package intunecontent implements the shared ProfileVersion1 transport encryption.
intunewin Package intunewin writes and verifies portable Intune Win32 content envelopes.	Package intunewin writes and verifies portable Intune Win32 content envelopes.
jamf Package jamf reconciles immutable packages and their native Jamf deployment links.	Package jamf reconciles immutable packages and their native Jamf deployment links.
lockfile Package lockfile separates update resolution from preparation of reviewed inputs.	Package lockfile separates update resolution from preparation of reviewed inputs.
macpkg Package macpkg builds declared filesystem layouts as portable component PKGs.	Package macpkg builds declared filesystem layouts as portable component PKGs.
macsoftware Package macsoftware prepares macOS installers and their selected application evidence.	Package macsoftware prepares macOS installers and their selected application evidence.
msi Package msi inspects the Property table and package code of Windows installers.	Package msi inspects the Property table and package code of Windows installers.
munki Package munki builds native pkginfo for an explicitly supported writable subset.	Package munki builds native pkginfo for an explicitly supported writable subset.
munkirepo Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs.	Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs.
pkgbuild Package pkgbuild creates unsigned component packages from declared local files.	Package pkgbuild creates unsigned component packages from declared local files.
plugins Package plugins snapshots local executables and acquires pinned OCI bundles.	Package plugins snapshots local executables and acquires pinned OCI bundles.
source Package source resolves opaque declarations into immutable cached content.	Package source resolves opaque declarations into immutable cached content.
testdiskimage Package testdiskimage builds portable disk image fixtures from synthetic files.	Package testdiskimage builds portable disk image fixtures from synthetic files.
testproject Package testproject writes multi-document test fixtures as individual files.	Package testproject writes multi-document test fixtures as individual files.
windowssoftware Package windowssoftware prepares vendor installers and their accompanying files.	Package windowssoftware prepares vendor installers and their accompanying files.
plugin Package plugin defines versioned contracts for built-in and executable operations.	Package plugin defines versioned contracts for built-in and executable operations.