Blog
Blog: Show HN: Orbital Package System (Ops)
Last verified:
What is Blog?
Blog is Orbital Package System (OPS) is an open-source package manager designed to simplify packaging and delivering filesystems wrapped in cryptographically verifiable archives. It is a reboot of ZPS, a project that was never fully realized, built on the philosophy that every existing package system is too hard to use and too painful to deal with. The system backs plugin and update delivery for formae via the public hub at https://hub.platform.engineering.
Key features include cryptographic security with signed archives and signed metadata, public key fetching from DNS, an embeddable architecture that can be used without Pkl dependency to create software updaters for Go apps, and the Opkg fast random access signed archive format with Zstd compression. It includes a build system-friendly DSL called Opkgfile, version time components for CI builds, and repository support for publishing to S3 and fetching from HTTPS/S3.
Orbital is designed for platform engineers, DevOps teams, and developers who need to ship software packages with cryptographic verification. It is particularly useful for teams building software updaters, managing plugin systems, or delivering updates across multiple platforms. The tool is open-source under the Apache 2.0 license and is developed by Platform Engineering Labs.
The system addresses the complexity of NIX by decoupling build systems from package systems, and modernizes package management beyond 1970s-era designs. It provides Install, Update, Remove, Freeze, Thaw, and Extract operations, along with cache management, PKI management for trust verification, and repository management capabilities.
Blog pricing
Pricing model: Freemium
Orbital Package System is completely free and open-source under the Apache 2.0 license. There are no paid tiers or subscriptions. The tool can be used freely for both personal and commercial purposes. Repository hosting requires your own S3 storage (which incurs AWS costs separately), but the Orbital software itself has no licensing fees.
Blog pros
- Cryptographically signed archives for security
- Signed metadata ensures integrity verification
- Public key fetching from DNS simplifies trust management
- Embeddable design works in Go apps without Pkl dependency
- Fast random accesssigned archive format (Opkg)
- Zstd compression for smaller package sizes
- Build system-friendly DSL (Opkgfile) is variable and flexible
- Version time component avoids semver increment for CI builds
- Publish directly to S3 repositories
- Fetch packages from HTTPS or S3 sources
- Open-source under Apache 2.0 license
- Simpler than NIX with decoupled build systems
- Modern design unlike 1970s-era package systems
- Supports Freeze and Thaw for package state management
- Built-in cache management with Clean and Clear operations
Blog cons
- Relatively new project with smaller community
- Documentation may be limited compared to established package managers
- Primarily focused on Go ecosystem integration
- Requires understanding of cryptographic concepts for full utilization
- S3 repository hosting incurs AWS costs
- DNS-based public key fetching requires DNS infrastructure setup
- May lack some features of mature package managers like apt or yum
- Limited pre-built package ecosystem compared to established systems
Frequently asked questions about Blog
What is Orbital Package System (OPS)?
Orbital Package System is an open-source package manager designed to ship filesystems wrapped in cryptographically verifiable archives. It is a reboot of ZPS and is built on the philosophy that existing package systems are too complex and painful to use. It backs plugin and update delivery for formae via the public hub at https://hub.platform.engineering.
What license is Orbital under?
Orbital Package System is licensed under Apache 2.0, which is a permissive open-source license that allows free use, modification, distribution, and commercial use without requiring derivative works to be open-source.
How does Orbital handle security?
Orbital provides cryptographic security through signed archives, signed metadata, and public key fetching from DNS. This ensures that packages cannot be tampered with and that users can verify the authenticity of packages they download.
Can I embed Orbital in my Go application?
Yes, Orbital is embeddable and can be used with no Pkl dependency to create a software updater for your Go app. The Embeddable feature is specifically designed for this use case.
Where can I publish Orbital packages?
You can publish Orbital packages to S3 repositories. The system supports publishing to S3 and fetching packages from both HTTPS and S3 sources, giving you flexibility in where you host your package repositories.
What compression does Orbital use?
Orbital uses Zstd compression in its Opkg format. This provides fast random access to signed archive contents while maintaining good compression ratios for smaller package sizes.
How does Orbital handle versions?
Orbital uses a version time component instead of requiring semver increments for CI builds. This means versions can include timestamps (like 0.84.0_20260416T142110Z) which is more practical for continuous integration scenarios.
What is Opkgfile?
Opkgfile is Orbital's build system-friendly DSL (Domain Specific Language) for defining package manifests. It is variable and designed to work well with various build systems, making it easy to create Orbital packages.
Is Orbital related to NIX?
OrbitalPosition is inspired by the need to address NIX's complexity. The project explicitly states that NIX is too complex and that build systems should not be tightly coupled to package systems, which is a design principle Orbital follows.
How do I get started with Orbital?
Orbital is available on GitHub at github.com/platform-engineering-labs/orbital. It can be imported as a Go package (github.com/platform-engineering-labs/orbital) and used either dynamically with a config file or embedded directly in your application. The Apache 2.0 license means you can use it freely without licensing concerns.