Repositories
| Repository | For | Packages |
|---|---|---|
evalgo-nginx-stable.repo | Oracle Linux 10, EL10 | nginx (stable channel) with ngx_http_substitutions_filter_module (subs_filter) compiled in |
evalgo-nginx-mainline.repo | Oracle Linux 10, EL10 | nginx (mainline channel), the same with subs_filter |
evalgo-openvox8.repo | EL9 | openvox-agent (OpenVox 8, bundled runtime with current OpenSSL) |
evalgo-laminar.repo | EL9 | laminar (Laminar CI) |
Install, for example nginx with subs_filter on Oracle Linux 10:
curl -o /etc/yum.repos.d/evalgo-nginx-stable.repo https://repo.evalgo.org/evalgo/evalgo-nginx-stable.repo
dnf install nginxdnf asks to import the key on first use: check that the fingerprint matches the one below. Source RPMs: the …-source repositories in the same files (disabled by default), or the SRPMS/ directories.
Signing key
Packages and repository metadata are signed with the evalgo package key:
RPM-GPG-KEY-evalgo · evalgo package signing <packages@evalgo.org>
fingerprint 496F 7E15 C10B FCDE 474D 6869 9C76 3426 E71D 3482 (RSA 4096, valid until 2029-10-25)
dnf checks both with gpgcheck=1 and repo_gpgcheck=1 (set in the repository files), so a changed package or tampered metadata is refused.
Catalog: SBOMs and security status
Every published version has a page in the artifact catalog: the SBOM (CycloneDX and SPDX), the bundled and compiled-in components, the known vulnerabilities with their fix state, our assessments, the changes since the previous version, and signed checksums of all files. The status is checked again every night against a fresh vulnerability database. Machine-readable: catalog.json, feed of new versions.