Client-built. Client-signed.

Your first package.
Your own trust.

Install TPA from the signed bootstrap repository. Build locally, sign locally and publish finished repositories wherever you choose.

Install with APT Browse repository

One package. Three tools.

The published bootstrap reference is tpa 0.8.0, containing tpa, tpa-utils and tpa-release. This is the client toolchain, not the TPA.run hosting service.

Repository

Stable / main

APT selects the native architecture from the configured source and verifies signed metadata before installing.

View the package inventory

Trust

Public key, explicit trust

Review the source and independently confirm the publisher fingerprint. No account or private signing key is needed to install a public package.

Understand verification

Architecture-specific downloads

Published TPA 0.8.0 packages
Architecture	Package	Artifact
amd64	`tpa`	Download amd64 .deb
arm64	`tpa`	Download arm64 .deb
riscv64	`tpa`	Download riscv64 .deb

Prefer APT for signature verification and dependency resolution. Direct downloads do not replace verification. Consult the repository inventory and signed APT indexes for artifact sizes, hashes and full package metadata; this guide is not an APT trust anchor.

Install with APT

Review before running. The commands below configure a source only after you confirm the publisher's public key.

The published source is https://tpa.run/r/tparun/bootstrap/ (browse packages). The deb822 source file below contains an embedded PUBLIC signing key, not a private key or account credential.

curl -fsSL https://tpa.run/tparun.sources -o /tmp/tpa-bootstrap.sources
cat /tmp/tpa-bootstrap.sources
# Extract and inspect the embedded public key:
sed -n '/^ -----BEGIN PGP PUBLIC KEY BLOCK-----/,/^ -----END PGP PUBLIC KEY BLOCK-----/p' /tmp/tpa-bootstrap.sources \
  | sed 's/^ //; s/^\.$//' > /tmp/tpa-bootstrap.asc
gpg --show-keys --with-fingerprint /tmp/tpa-bootstrap.asc

# ONLY after independently confirming the publisher fingerprint:
sudo install -m 0644 /tmp/tpa-bootstrap.sources \
  /etc/apt/sources.list.d/tpa-bootstrap.sources
sudo apt update
sudo apt install tpa=0.8.0
tpa version

Expected bootstrap fingerprint: EDCEE63AA803737C8ABBC1E4A34190A2829D5E54. On arm64 or riscv64, change the source's Architectures: field to the output of dpkg --print-architecture before installation. Never use trusted=yes or disable HTTPS/signature verification.

The signature matters. The page is a guide.

APT verifies InRelease, the index hashes and the downloaded package bytes using the public key in Signed-By. Keep HTTPS and APT signature verification enabled.

The repository website and JSON inventory are convenience metadata, not an independent signing authority. This installation guide does not select a generation, rebuild a repository or replace any publisher-signed content.

Already have TPA? Inspect a repository before adding it, then verify it against an independently trusted publisher key. Read the inspection and verification guide.

From installation to publication.

Build your first package Publish a finished repository

TPA remains usable with an ordinary SSH/web server. Accounts and operator passkeys are separate hosting workflows, not prerequisites for using TPA.