{"id":13509262,"url":"https://github.com/chainguard-dev/melange","last_synced_at":"2026-04-02T13:55:24.586Z","repository":{"id":37053499,"uuid":"467239260","full_name":"chainguard-dev/melange","owner":"chainguard-dev","description":"build APKs from source code","archived":false,"fork":false,"pushed_at":"2026-01-19T00:24:36.000Z","size":21701,"stargazers_count":552,"open_issues_count":236,"forks_count":161,"subscribers_count":6,"default_branch":"main","last_synced_at":"2026-01-19T10:49:27.233Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chainguard-dev.png","metadata":{"files":{"readme":"README.md","changelog":"NEWS.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-03-07T19:53:27.000Z","updated_at":"2026-01-18T17:12:31.000Z","dependencies_parsed_at":"2024-01-30T17:43:38.330Z","dependency_job_id":"b817086b-c896-45c1-bc46-4ea100cb395c","html_url":"https://github.com/chainguard-dev/melange","commit_stats":null,"previous_names":[],"tags_count":195,"template":false,"template_full_name":null,"purl":"pkg:github/chainguard-dev/melange","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chainguard-dev%2Fmelange","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chainguard-dev%2Fmelange/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chainguard-dev%2Fmelange/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chainguard-dev%2Fmelange/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chainguard-dev","download_url":"https://codeload.github.com/chainguard-dev/melange/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chainguard-dev%2Fmelange/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28764757,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-26T00:37:26.264Z","status":"online","status_checked_at":"2026-01-26T02:00:08.215Z","response_time":59,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T02:01:05.358Z","updated_at":"2026-01-26T02:09:32.533Z","avatar_url":"https://github.com/chainguard-dev.png","language":"Go","readme":"# melange\n\nBuild apk packages using declarative pipelines.\n\nCommonly used to provide custom packages for container images built with [apko][apko]. The majority\nof apks are built for use with either the [Wolfi](https://github.com/wolfi-dev) or [Alpine Linux](https://www.alpinelinux.org/) ecosystems.\n\nKey features:\n\n - **Pipeline-oriented builds.** Every step of the build pipeline is defined and\n   controlled by you, unlike traditional package managers which have distinct\n   phases.\n - **Multi-architecture by default.** QEMU is used to emulate various\n   architectures, avoiding the need for cross-compilation steps.\n\n## Why\n\nSecure software factories are the evolution of DevOps, allowing a\nuser to prove the provenance of all artifacts incorporated\ninto a software appliance.  By building and capturing software\nartifacts into packages, DevOps teams can manage their software\nartifacts as if they were any other component of an image.\n\nThis is especially useful when building software appliances in\nthe form of OCI container images with [apko][apko].\n\n   [apko]: https://github.com/chainguard-dev/apko\n\n## Installation\n\nYou can install Melange from Homebrew:\n\n```shell\nbrew install melange\n```\n\nYou can also install Melange from source:\n\n```shell\ngo install chainguard.dev/melange@latest\n```\n\nYou can also use the Melange container image:\n\n```shell\ndocker run cgr.dev/chainguard/melange version\n```\n\nTo use the examples, you'll generally want to mount your current directory into the container and provide elevated privileges, e.g.:\n\n```shell\ndocker run --privileged -v \"$PWD\":/work cgr.dev/chainguard/melange build examples/gnu-hello.yaml\n```\n\nRunning outside of a container requires [Docker](https://docs.docker.com/get-docker/), but should also work with other runtimes such as [podman](https://podman.io/getting-started/installation).\n\n## Quickstart\n\nA melange build file looks like:\n\n```yaml\npackage:\n  name: hello\n  version: 2.12\n  epoch: 0\n  description: \"the GNU hello world program\"\n  copyright:\n    - attestation: |\n        Copyright 1992, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2005,\n        2006, 2007, 2008, 2010, 2011, 2013, 2014, 2022 Free Software Foundation,\n        Inc.\n      license: GPL-3.0-or-later\n  dependencies:\n    runtime:\n\nenvironment:\n  contents:\n    repositories:\n      - https://dl-cdn.alpinelinux.org/alpine/edge/main\n    packages:\n      - alpine-baselayout-data\n      - busybox\n      - build-base\n      - scanelf\n      - ssl_client\n      - ca-certificates-bundle\n\npipeline:\n  - uses: fetch\n    with:\n      uri: https://ftp.gnu.org/gnu/hello/hello-${{package.version}}.tar.gz\n      expected-sha256: cf04af86dc085268c5f4470fbae49b18afbc221b78096aab842d934a76bad0ab\n  - uses: autoconf/configure\n  - uses: autoconf/make\n  - uses: autoconf/make-install\n  - uses: strip\n\nsubpackages:\n  - name: \"hello-doc\"\n    description: \"Documentation for hello\"\n    dependencies:\n      runtime:\n        - foo\n    pipeline:\n      - uses: split/manpages\n    test:\n      pipeline:\n        - uses: test/docs\n\ntest:\n  environment:\n    contents:\n      packages:\n        - bar\n  pipeline:\n    - runs: |\n        hello\n        hello --version\n```\n\nWe can build this with:\n\n```shell\nmelange build examples/gnu-hello.yaml\n```\n\nor, with Docker:\n\n```shell\ndocker run --privileged --rm -v \"${PWD}\":/work \\\n  cgr.dev/chainguard/melange build examples/gnu-hello.yaml\n```\n\nThis will create a `packages` folder, with an entry for each architecture supported by the package. If you only want to build for the current architecture, you can add `--arch $(uname -m)` to the build command. Inside the architecture directory you should find apk files for each package built in the pipeline.\n\nIf you want to sign your apks, create a signing key with the `melange keygen` command:\n\n```shell\nmelange keygen\n```\n```\n generating keypair with a 4096 bit prime, please wait...\n wrote private key to melange.rsa\n wrote public key to melange.rsa.pub\n```\n\nAnd then pass the `--signing-key` argument to `melange build`.\n\n## Debugging melange Builds\n\nTo include debug-level information on melange builds, edit your `melange.yaml` file and include `set -x` in your pipeline. You can add this flag at any point of your pipeline commands to further debug a specific section of your build.\n\n```yaml\n...\npipeline:\n  - name: Build Minicli application\n    runs: |\n      set -x\n      APP_HOME=\"${{targets.destdir}}/usr/share/hello-minicli\"\n...\n```\n\n## Default Substitutions\n\nMelange provides the following default substitutions which can be referenced in the build file pipeline:\n\n| **Substitution**            | **Description**                                                          |\n|-----------------------------|--------------------------------------------------------------------------|\n| `${{package.name}}`         | Package name                                                             |\n| `${{package.version}}`      | Package version                                                          |\n| `${{package.epoch}}`        | Package epoch                                                            |\n| `${{package.full-version}}` | `${{package.version}}-r${{package.epoch}}`                               |\n| `${{package.description}}`  | Package description                                                      |\n| `${{package.srcdir}}`       | Package source directory (`--source-dir`)                                |\n| `${{subpkg.name}}`          | Subpackage name                                                          |\n| `${{context.name}}`         | main package or subpackage name\n| `${{targets.outdir}}`       | Directory where targets will be stored                                   |\n| `${{targets.contextdir}}`   | Directory where targets will be stored for main packages and subpackages |\n| `${{targets.destdir}}`      | Directory where targets will be stored for main                          |\n| `${{targets.subpkgdir}}`    | Directory where targets will be stored for subpackages                   |\n| `${{build.arch}}`           | Architecture of current build (e.g. x86_64, aarch64)                     |\n| `${{build.goarch}}`         | GOARCH of current build (e.g. amd64, arm64)                              |\n\nAn example build file pipeline with substitutions:\n\n```yaml\npipeline:\n  - name: 'Create tmp dir'\n    runs: mkdir ${{targets.destdir}}/var/lib/${{package.name}}/tmp\n```\n\n[More detailed documentation](./docs/)\n\n## Usage with apko\n\nTo use a melange built apk in apko, either upload it to a package repository or use a \"local\" repository. Using a local repository allows a melange build and apko build to run in the same directory (or GitHub repo) without using external storage.\nAn example of this approach can be seen in the [nginx-image-demo repo](https://github.com/chainguard-dev/nginx-image-demo/).\n","funding_links":[],"categories":["Go","Build tools","others"],"sub_categories":["Observability"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchainguard-dev%2Fmelange","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchainguard-dev%2Fmelange","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchainguard-dev%2Fmelange/lists"}