stemma

module

v0.11.2 Latest Latest Go to latest Published: Oct 22, 2026 License: Apache-2.0, MIT

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/woodleighschool/stemma

Links

Open Source Insights

README ¶

stemma 🌿

Stemma is a cross-platform software artifact pipeline for preparing and publishing software.

Build macOS packages from Windows, create Intune intunewin files from macOS or Linux, and publish software to Munki, Intune or Jamf. Catalogs define the software Stemma manages, while plugins can extend the pipeline with additional sources, processing and destinations.

[!WARNING] This project may be unstable or have bugs, use with caution. Also expect breaking changes between releases for now.

🌱 What's inside

Build macOS packages and Intune intunewin files on macOS, Linux or Windows
Download software from upstream sources and lock resolved inputs
Extract application metadata, versions and icons
Prepare artifacts for different deployment platforms
Publish to Munki, Intune and Jamf
Preview destination changes before applying them
Reconcile a catalog on a schedule, publishing reviewed changes and proposing upstream updates as pull requests
Extend sources, processing and destinations through plugins

🚀 Usage

Start with stemma-catalog. Follow its setup instructions, then run from the catalog:

stemma prepare
stemma plan

prepare downloads and prepares the software; plan shows what would be published. Use stemma apply to publish after reviewing the result.

📖 Documentation

🧑‍💻 Development

mise install
mise run deps
mise run build

See development for checks, generation and the docs preview.

📄 License

Licensed under the Apache License 2.0.

🙏 Credits

WrapTune-MacOS - Windows packaging and verification reference
Fleet - XAR package writer
mholt/archives - archive handling
AutoPkg - inspiration for software packaging workflows

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
stemma command Stemma is a finite, reproducible software artifact pipeline.	Stemma is a finite, reproducible software artifact pipeline.
internal
apple Package apple inspects macOS artifacts and verifies their code signatures.	Package apple inspects macOS artifacts and verifies their code signatures.
archive Package archive reads and writes bounded, portable archive trees.	Package archive reads and writes bounded, portable archive trees.
artifactname Package artifactname names published installers independently of their input paths.	Package artifactname names published installers independently of their input paths.
authenticode Package authenticode verifies Windows installer signatures against an expected publisher.	Package authenticode verifies Windows installer signatures against an expected publisher.
cas Package cas owns immutable downloaded and derived objects in the disposable cache.	Package cas owns immutable downloaded and derived objects in the disposable cache.
changes Package changes renders semantic differences for command reports and review descriptions.	Package changes renders semantic differences for command reports and review descriptions.
config Package config loads project and resource documents and resolves local composition.	Package config loads project and resource documents and resolves local composition.
contents Package contents opens leased inputs without changing their source identity.	Package contents opens leased inputs without changing their source identity.
diskimage Package diskimage reads selected installer payloads from portable HFS+ and APFS DMGs and writes application DMGs.	Package diskimage reads selected installer payloads from portable HFS+ and APFS DMGs and writes application DMGs.
engine Package engine orchestrates locked preparation and independent destination reconciliation.	Package engine orchestrates locked preparation and independent destination reconciliation.
expression Package expression evaluates CEL expressions in decoded configuration values.	Package expression evaluates CEL expressions in decoded configuration values.
fileio Package fileio provides durable replacement and cancellable streaming for local state.	Package fileio provides durable replacement and cancellable streaming for local state.
git Package git reads and drives the checkout holding a project, and its origin.	Package git reads and drives the checkout holding a project, and its origin.
icon Package icon owns the catalog icon namespace.	Package icon owns the catalog icon namespace.
inspect Package inspect collects static artifact facts while retaining the input.	Package inspect collects static artifact facts while retaining the input.
intune Package intune reconciles native Windows and macOS Microsoft Graph app contracts.	Package intune reconciles native Windows and macOS Microsoft Graph app contracts.
intune/graph/beta
intune/graph/beta/deviceappmanagement
intunecontent Package intunecontent implements the shared ProfileVersion1 transport encryption.	Package intunecontent implements the shared ProfileVersion1 transport encryption.
intunewin Package intunewin writes and verifies portable Intune Win32 content envelopes.	Package intunewin writes and verifies portable Intune Win32 content envelopes.
jamf Package jamf reconciles packages, install and patch policies, and retention with Jamf Pro.	Package jamf reconciles packages, install and patch policies, and retention with Jamf Pro.
lockfile Package lockfile separates update resolution from preparation of reviewed inputs.	Package lockfile separates update resolution from preparation of reviewed inputs.
macpkg Package macpkg builds declared filesystem layouts as portable component PKGs.	Package macpkg builds declared filesystem layouts as portable component PKGs.
macsoftware Package macsoftware prepares macOS installers and their selected application evidence.	Package macsoftware prepares macOS installers and their selected application evidence.
mcpserver Package mcpserver serves one Stemma project to agents over the Model Context Protocol: what the project can declare, trial preparation, lock updates, icons and the checks pull requests run.	Package mcpserver serves one Stemma project to agents over the Model Context Protocol: what the project can declare, trial preparation, lock updates, icons and the checks pull requests run.
msi Package msi inspects the Property and File tables and package code of Windows installers.	Package msi inspects the Property and File tables and package code of Windows installers.
munki Package munki builds native pkginfo for an explicitly supported writable subset.	Package munki builds native pkginfo for an explicitly supported writable subset.
munkirepo Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs.	Package munkirepo reconciles native pkginfo, installers and shared Munki catalogs.
pkgbuild Package pkgbuild creates unsigned component packages from declared local files.	Package pkgbuild creates unsigned component packages from declared local files.
plugins Package plugins selects local executables and pinned OCI bundles and installs them in the cache.	Package plugins selects local executables and pinned OCI bundles and installs them in the cache.
reconcile Package reconcile publishes the reviewed branch of the repository holding a project and proposes lock updates as pull requests, in one finite run.	Package reconcile publishes the reviewed branch of the repository holding a project and proposes lock updates as pull requests, in one finite run.
reconcile/sourcecontrol Package sourcecontrol defines what reconciliation needs from the host that reviews a repository: credentials for its git remote, pull requests and commit statuses.	Package sourcecontrol defines what reconciliation needs from the host that reviews a repository: credentials for its git remote, pull requests and commit statuses.
reconcile/sourcecontrol/github Package github is the source-control provider for GitHub and GitHub Enterprise Server.	Package github is the source-control provider for GitHub and GitHub Enterprise Server.
signature Package signature defines the publisher signature policy shared by resource kinds.	Package signature defines the publisher signature policy shared by resource kinds.
source Package source resolves opaque declarations into immutable cached content.	Package source resolves opaque declarations into immutable cached content.
testutil/testarchive Package testarchive builds archive fixtures from synthetic files.	Package testarchive builds archive fixtures from synthetic files.
testutil/testbundle Package testbundle generates a portable application workload for benchmarks.	Package testbundle generates a portable application workload for benchmarks.
testutil/testdiskimage Package testdiskimage builds disk image fixtures from synthetic files.	Package testdiskimage builds disk image fixtures from synthetic files.
testutil/testgit Package testgit creates Git repositories for tests.	Package testgit creates Git repositories for tests.
testutil/testproject Package testproject writes project fixtures for tests.	Package testproject writes project fixtures for tests.
treefs Package treefs reads confined trees through directory-scoped handles.	Package treefs reads confined trees through directory-scoped handles.
windowssoftware Package windowssoftware prepares vendor installers and their accompanying files.	Package windowssoftware prepares vendor installers and their accompanying files.
plugin Package plugin defines versioned contracts for built-in and executable operations.	Package plugin defines versioned contracts for built-in and executable operations.