
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
kpmx
Advanced tools

Kevin's Package Manager (PKGMGR) is a multi-distro package manager and workflow orchestrator. It helps you develop, package, release and manage projects across multiple Linux-based operating systems (Arch, Debian, Ubuntu, Fedora, CentOS, …).
PKGMGR is implemented in Python and uses Nix (flakes) as a foundation for distribution-independent builds and tooling. On top of that it provides a rich CLI that proxies common developer tools (Git, Docker, Make, …) and glues them together into repeatable development workflows.
Traditional distro package managers like apt, pacman or dnf focus on a
single operating system. PKGMGR instead focuses on your repositories and
development lifecycle. It provides one configuration for all repositories,
one unified CLI to interact with them, and a Nix-based foundation that keeps
tooling reproducible across distributions.
Native package managers are still used where they make sense. PKGMGR coordinates the surrounding development, build and release workflows in a consistent way.
In addition, PKGMGR provides Docker images that can serve as a reproducible system baseline. These images bundle the complete PKGMGR toolchain and are designed to be reused as a stable execution environment across machines, pipelines and teams. This approach is specifically used within Infinito.Nexus to make complex systems distribution-independent while remaining fully reproducible.
PKGMGR enables multi-distro development and packaging by managing multiple repositories from a single configuration file. It drives complete release pipelines across Linux distributions using Nix flakes, Python build metadata, native OS packages such as Arch, Debian and RPM formats, and additional ecosystem integrations like Ansible.
All functionality is exposed through a unified pkgmgr command-line interface
that works identically on every supported distribution. It combines repository
management, Git operations, Docker and Compose orchestration, as well as
versioning, release and changelog workflows. Many commands support a preview
mode, allowing you to inspect the underlying actions before they are executed.
PKGMGR is not just a helper around Git commands. Combined with its release and versioning features it can drive end-to-end workflows:
make or Nix.The following diagram gives a full overview of:

Diagram status: 12 December 2025
Always-up-to-date version: https://s.veen.world/pkgmgrmp
make.
The setup mode defines which runtime layers are prepared.git clone https://github.com/kevinveenbirkenbach/package-manager.git
cd package-manager
System dependencies required before running any make commands are installed via:
scripts/installation/dependencies.sh
The script detects and normalizes the OS and installs the required system-level dependencies accordingly.
git clone https://github.com/kevinveenbirkenbach/package-manager.git
cd package-manager
make install
| Command | Prepares | Use case |
|---|---|---|
| make setup | Python venv and Nix | Full development & CI |
| make setup-venv | Python venv only | Local user setup |
make setup
Use this for CI, servers, containers and full development workflows.
make setup-venv
source ~/.venvs/pkgmgr/bin/activate
Use this if you want PKGMGR isolated without Nix integration.
Alles klar 🙂 Hier ist der RUN-Abschnitt ohne Gedankenstriche, klar nach Nix, Docker und venv getrennt:
PKGMGR can be executed in different environments. All modes expose the same CLI and commands.
nix run github:kevinveenbirkenbach/package-manager#pkgmgr -- --help
Two container types are available.
| Image type | Contains | Typical use |
|---|---|---|
| Virgin | Base OS + system dependencies | Clean test environments |
| Stable | PKGMGR + Nix (flakes enabled) | Ready-to-use workflows |
Example images:
pkgmgr-arch-virginghcr.io/kevinveenbirkenbach/pkgmgr:stableUse virgin images for isolated test runs, use the stable image for fast, reproducible execution.
docker run --rm -it \
-v "$PWD":/src \
-w /src \
ghcr.io/kevinveenbirkenbach/pkgmgr:stable \
pkgmgr --help
After activating the venv:
pkgmgr --help
This allows you to choose between zero install execution using Nix, fully prebuilt Docker environments or local isolated venv setups with identical command behavior.
This project is licensed under the MIT License. See the LICENSE file for details.
Kevin Veen-Birkenbach https://www.veen.world
FAQs
Kevin's package-manager tool (pkgmgr)
We found that kpmx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.