Quad4 Git (Main)
>pip-rns
Install Python packages over Reticulum from remotes you choose, and share integrity-backed offline wheel bundles (T383838.opip) for sneakernet / air-gap paths.
You pick every source. There is no default vendor index. Indexes and aliases are opt-in. PyPI, HTTPS git, and system pip remain available as bridges when you need them, not as the center of the design.
rngit page (optional peer docs): T383838132f67e79d9b24aad014e93015fb858f:/page/index.mu
Tools
┌────────────────────┬────────────────────────────────────────────────────────────────────┐
│ Tool │ Purpose │
├────────────────────┼────────────────────────────────────────────────────────────────────┤
│ T383838pip-rns / T383838pipx-rns │ Install from Reticulum rngit remotes via pip, pipx, uv, or poetry │
│ T383838opip │ Build, verify, and install offline T383838.opip bundles for USB / air-gap │
└────────────────────┴────────────────────────────────────────────────────────────────────┘
Both ship in this package. T383838opip uses only the Python standard library (no extra dependencies).
Choose your sources
1. Sneakernet first-class: build or export a bundle, copy offline, verify, install.
2. Release wheel over RNS: prefer signed rngit releases (cheaper than a full source clone).
3. Source clone: expensive on RNS. Cached and updated when possible. Confirm before the first pull.
4. Indexes (optional): register peer package lists you trust. None are shipped pre-selected.
T282828
# Offline / USB
opip create -r requirements.txt -o ./pkg.opip
opip export ./pkg.opip -o /media/usb/pkg.opip
opip verify /media/usb/pkg.opip --require-signature
opip install /media/usb/pkg.opip
# Mirror a release for sneakernet
pip-rns export rns://identity/group/repo --ref v1.0.0 -o /media/usb/mirror
# Online: prefer release, pin or remember publisher
pip-rns trust add rns://identity/group/repo e46112d44649266d71fe2193e00a4710
pip-rns install --from-release rns://identity/group/repo --ref v1.0.0
pip-rns install --offline rns://identity/group/repo # cache hit only
# Hear announced rngit repository nodes (passive, needs RNS)
pip-rns discover --seconds 60 --save --scan
pip-rns discover packages
pip-rns install lxmfy
pip-rns
Features
• Multi-backend - install with pip, pipx, uv, or poetry
• Version pinning - T383838pipx-rns install repo@v1.0.0 or T383838--ref v1.0.0
• Releases - install pre-built T383838.whl files from rngit releases (T383838--from-release / T383838--require-release)
• Trust store - remember publisher identities (T383838pip-rns trust). T383838--verify for one-off pins
• Fail closed - signed releases must verify unless you pass T383838--insecure
• Offline - T383838--offline uses cache / local paths only (no RNS fetch)
• Export - T383838pip-rns export mirrors release artifacts for USB sharing
• Editable mode - T383838--editable for persistent checkouts
• pipx inject - install into existing pipx venvs
• Aliases - short names for long remote paths
• Indexes - opt-in sync of package listings from remotes you register
• Discover - listen for announced rngit nodes (T383838git.repositories) on the mesh
Requirements
• python 3.7 or higher
Install
Install from local wheel:
T282828
pip install pip_rns-*.whl
From Source (rngit)
T282828
git clone rns://06a54b505bb67b25ef3f8097e8001edc/public/pip-rns
cd pip-rns
make
make install
Bridge: PyPI (optional HTTPS path)
T282828
pip install pip-rns
# or
pipx install pip-rns
Bridge: git over HTTPS
T282828
pip install git+https://github.com/Quad4-Software/pip-rns
Verify Releases
T282828
rnid -i e46112d44649266d71fe2193e00a4710 -V pip_rns-*.rsg
Usage
T282828
pipx-rns install 06a54b505bb67b25ef3f8097e8001edc/public/LXMFy
# or
pipx-rns install 06a54b505bb67b25ef3f8097e8001edc/public/LXMFy@v1.6.3
# branch (clones source. no release probe)
pip-rns install rns://7649a50d84610232d1416b41d2896aff/reticulum/reticulum@master
Adding an index (opt-in peer list)
T282828
pip-rns index add rns://identity/group/index
pip-rns index list
You choose which indexes to trust. None are added automatically.
Commands
T383838pip-rns (generic)
T282828
pip-rns [install] <identity/group/repo> [--from-release|--from-source|-s] [--require-release]
[--offline] [--insecure] [--verify IDENTITY] [--yes|-y]
[--pipx] [--uv] [--poetry] [--ref TAG] [--editable] [--use-cache]
[--venv PATH] [--remember-venv] [-- <tool flags>]
pip-rns update <remote> [options]
pip-rns export <remote> -o DIR [--ref TAG] [--verify IDENTITY] [--all]
pip-rns list [--pipx] [--uv] [--poetry]
pip-rns uninstall <package> [--pipx] [--uv] [--poetry]
pip-rns alias add|set|rm|ls
pip-rns trust add|rm|ls|set-default|forget-default
pip-rns discover [listen|ls|clear|scan|packages] [--seconds N] [--save] [--scan]
pip-rns index add|rm|ls|sync|list|search
pip-rns release list|view
pip-rns venv list|set|forget
pip-rns bundle install|verify
pip-rns doctor [--online --remote RNS_URL]
pip-rns completion install [--shell bash|zsh|fish]
T383838pip-rns rns://id/group/repo is shorthand for install. With no T383838@ref / mode flags on a TTY, you get a menu (latest release preferred, source clone labeled expensive, pick a release). Install prefers a release T383838.whl when one exists (use T383838--from-source/T383838-s to force a clone, or T383838--from-release / T383838--require-release to require a wheel). Branch-like refs such as T383838@master or T383838@main clone from source automatically. RNS source installs reuse T383838~/.local/share/pip-rns/cache and fetch/update on repeat (set T383838PIP_RNS_NO_CACHE=1 to force a fresh temp clone). T383838--offline never contacts RNS. Indexes are opt-in: add only remotes you choose.
T383838pipx-rns (pipx-specific)
T282828
pipx-rns install <remote> [--ref TAG] [--editable] [--from-release|--from-source]
[--require-release] [--offline] [--insecure] [--verify IDENTITY] [--yes]
pipx-rns inject <venv> <remote>
pipx-rns update <remote>
pipx-rns list
pipx-rns uninstall <package>
pipx-rns doctor [--online]
pipx-rns completion install
Releases
Install pre-built T383838.whl from an rngit release (faster, no build step):
T282828
pip-rns install --from-release rns://06a54b505bb67b25ef3f8097e8001edc/public/rns-page-node --ref v1.6.0
Require a specific release signer when installing (or save it with T383838pip-rns trust):
T282828
pip-rns install --from-release rns://id/group/repo --ref v1.0.0 --verify e46112d44649266d71fe2193e00a4710
pip-rns trust add rns://id/group/repo e46112d44649266d71fe2193e00a4710
List, view, and export releases:
T282828
pip-rns release list rns://06a54b505bb67b25ef3f8097e8001edc/public/rns-page-node
pip-rns release view rns://06a54b505bb67b25ef3f8097e8001edc/public/rns-page-node v1.6.0
pip-rns export rns://06a54b505bb67b25ef3f8097e8001edc/public/rns-page-node --ref v1.6.0 -o ./mirror
Release artifacts are downloaded via T383838rngit release fetch on the rngit node hosting the repository. Signed releases fail closed if verification is not confirmed unless you pass T383838--insecure.
Aliases
Save long remote paths under a short name:
T282828
pip-rns alias add lxmfy 06a54b505bb67b25ef3f8097e8001edc/public/LXMFy
pip-rns alias ls
pip-rns install lxmfy
Aliases are stored in T383838~/.config/pip-rns/aliases (T383838%APPDATA%/pip-rns/aliases on Windows):
T282828
lxmfy=06a54b505bb67b25ef3f8097e8001edc/public/LXMFy
Custom config directory:
T282828
pip-rns --config /path/to/dir alias add lxmfy <remote>
PIP_RNS_CONFIG=/path/to/dir pip-rns install lxmfy
Trust
T282828
pip-rns trust add rns://id/group/repo e46112d44649266d71fe2193e00a4710
pip-rns trust set-default e46112d44649266d71fe2193e00a4710
pip-rns trust ls
Stored in T383838~/.config/pip-rns/trust.json. Used automatically when T383838--verify is omitted (unless T383838--insecure).
Discover
rngit nodes announce on the T383838git.repositories aspect. Listen on your local Reticulum stack (requires the T383838rns Python package):
T282828
pip-rns discover --seconds 60 --save
pip-rns discover ls
Heard destination hashes can be used as T383838rns://<destination_hash>/group/repo when the path is known. Discovery is passive. You only learn nodes that announce during the listen window.
Scan those nodes for Python packages (Nomad catalog when enabled, common T383838packages index repos, and release T383838.whl checks):
T282828
pip-rns discover --save --scan
# or later:
pip-rns discover scan
pip-rns discover packages
pip-rns install lxmfy
Short names from discovery resolve after aliases and registered indexes.
Indexes
Register an index (an rngit repo with a T383838packages file) and install by name:
T282828
pip-rns index add rns://identity/group/index
pip-rns index sync
pip-rns index list
pip-rns install lxmfy
Indexes chain with aliases: local aliases take priority, then synced indexes, then raw path.
Bundles (opip integration)
Install or verify offline T383838.opip bundles using pip-rns aliases and config:
T282828
pip-rns bundle install lxmfy-bundle@v1.0.0 --signer e46112d44649266d71fe2193e00a4710
pip-rns bundle verify ./my-bundle.opip --require-signature
Passthrough
Flags after T383838-- are forwarded to the underlying tool:
T282828
pip-rns install identity/group/repo -- --break-system-packages
pip-rns install --poetry identity/group/repo -- --dev
pipx-rns install identity/group/repo -- --force
pip-rns Environment
┌────────────────────────┬─────────┬───────────────────────────────────────────────┐
│ Variable │ Default │ Description │
├────────────────────────┼─────────┼───────────────────────────────────────────────┤
│ T383838PIP_RNS_PIP │ T383838pip │ pip command │
│ T383838PIP_RNS_PIPX │ T383838pipx │ pipx command │
│ T383838PIP_RNS_UV │ T383838uv │ uv command │
│ T383838PIP_RNS_POETRY │ T383838poetry │ poetry command │
│ T383838PIP_RNS_CONFIG │ - │ config directory for aliases │
│ T383838PIP_RNS_USE_CACHE │ - │ enable cache (T3838381) │
│ T383838PIP_RNS_COLOR │ T383838auto │ T383838auto, T383838always, T383838never (or T3838380/T3838381) │
│ T383838PIP_RNS_NO_INTERACTIVE │ - │ disable prompts when set │
│ T383838NO_COLOR │ - │ disable colors (standard) │
│ T383838FORCE_COLOR │ - │ force colors (standard) │
│ T383838CI │ - │ disables prompts and color unless T383838FORCE_COLOR │
└────────────────────────┴─────────┴───────────────────────────────────────────────┘
Color stays off on classic Windows T383838cmd.exe / PowerShell unless Windows Terminal (T383838WT_SESSION), ConEmu/ANSICON, or T383838FORCE_COLOR is set. Global flag: T383838--no-interactive. Long RNS waits show a TTY spinner (T383838Waiting on Reticulum…).
Remember a venv: T383838pip-rns install … --venv /path --remember-venv or T383838pip-rns venv set default /path.
opip (offline bundles)
Create and install integrity-backed offline Python wheel bundles (T383838.opip).
Features
• create: Fetch wheels from PyPI and pack them into an integrity-backed bundle
• auto-detect: Read T383838pyproject.toml, T383838setup.py, or T383838requirements.txt from a cloned project
• universal bundles: T383838--platform universal bundles wheels for Windows, Linux, and macOS in one file
• install: Install from a local bundle, HTTP/HTTPS/FTP/git, or Reticulum (T383838rns://) source
• export: Copy a verified bundle for sneakernet / USB sharing
• uninstall / update: Manage registered bundles
• verify: Check integrity, authenticity, and PyPI provenance
• Windows integration: File association and Explorer context menus (T383838register-windows)
Each bundle contains T383838manifest.json, T383838integrity.json, T383838lock.json, T383838sbom.json, optional T383838publisher.json, plus a T383838wheels/ directory and pinned T383838requirements.txt. Signed bundles also have a Reticulum T383838.rsg sidecar (and optionally an T383838.rsm release manifest when published via T383838rngit release).
Quick start
Bundle a cloned project on a connected machine:
T282828
git clone https://github.com/example/some-project.git
cd some-project
opip create
Copy the T383838.opip file to the air-gapped machine:
T282828
opip verify my-bundle.opip
opip install my-bundle.opip
Install from an rngit release over Reticulum:
T282828
opip install rns://identity/group/repo@v1.0.0
opip install rns://identity/group/repo@v1.0.0:my-bundle.opip
Manual requirements and platform targeting:
T282828
opip create -o my-bundle.opip -r requirements.txt
opip create -r requirements.txt --python 3.12 --platform win_amd64
opip create -r requirements.txt --python 3.12 --platform universal
Signed bundles (Reticulum RSG). A present T383838.rsg is verified automatically via the embedded pubkey. Pass T383838--signer to pin a required identity:
T282828
opip keygen -o publisher.rns
opip create -r requirements.txt --publisher "My Team" --identity publisher.rns --require-pypi-hash
opip verify shared-bundle.opip
opip verify shared-bundle.opip --signer e46112d44649266d71fe2193e00a4710 --require-signature
Publish a signed bundle as an rngit release (creates T383838.rsm manifest automatically):
T282828
rngit release -i publisher.rns rns://identity/group/repo create v1.0.0:./dist
opip Commands
┌───────────────────────────────────────────────────┬──────────────────────────────────────────────┐
│ Command │ Description │
├───────────────────────────────────────────────────┼──────────────────────────────────────────────┤
│ T383838create [-o FILE] [-C DIR] [-r REQ.txt] [packages… │ Build a bundle │
│ T383838install SOURCE [--target DIR] [--remember-target… │ Install a bundle │
│ T383838dest list|set|forget │ Remembered install destinations per bundle │
│ T383838uninstall BUNDLE [--user] │ Uninstall by registered bundle name │
│ T383838update BUNDLE [-o FILE] │ Rebuild a registered bundle │
│ T383838export SOURCE -o FILE │ Copy a verified bundle for sharing │
│ T383838verify BUNDLE [--signer IDENTITY] [--require-sig… │ Verify integrity and authenticity │
│ T383838keygen -o FILE │ Generate Reticulum identity for signing │
│ T383838info BUNDLE │ Show bundle metadata │
│ T383838list [bundles|installed] │ List registry │
│ T383838doctor │ Check environment health │
│ T383838completion install │ Install shell completions │
│ T383838help [COMMAND] [-i] │ Interactive or per-command help │
│ T383838register-windows │ Register T383838.opip association and context menus │
└───────────────────────────────────────────────────┴──────────────────────────────────────────────┘
Global flags: T383838--no-color, T383838--no-interactive / T383838-y, T383838--data-dir, T383838--version.
Remember a per-bundle install destination after T383838opip install --target DIR (prompted when interactive), or use T383838--remember-target / T383838opip dest set NAME PATH. Later installs reuse that path when T383838--target is omitted.
opip Environment
┌─────────────────────┬────────────────────────────────────────────────────────────────────┐
│ Variable │ Purpose │
├─────────────────────┼────────────────────────────────────────────────────────────────────┤
│ T383838OPIP_DATA_DIR │ State directory (same as T383838--data-dir) │
│ T383838OPIP_JOBS │ Default parallel downloads for T383838create │
│ T383838OPIP_PYTHON │ Default T383838--python for T383838create │
│ T383838OPIP_PLATFORM │ Default T383838--platform for T383838create │
│ T383838OPIP_PUBLISHER │ Default T383838--publisher for T383838create │
│ T383838OPIP_IDENTITY │ Default T383838--identity path for T383838create │
│ T383838OPIP_SIGNER │ Default T383838--signer for T383838verify and T383838install │
│ T383838OPIP_COLOR │ T383838auto, T383838always, or T383838never │
│ T383838OPIP_NO_COLOR │ Disable color when set │
│ T383838OPIP_FORCE_COLOR │ Force color when set │
│ T383838OPIP_NO_INTERACTIVE │ Disable prompts when set │
│ T383838NO_COLOR │ Standard. Disables colors when set │
│ T383838FORCE_COLOR │ Standard. Enables colors when set │
│ T383838CI │ disables prompts and color unless T383838FORCE_COLOR │
│ T383838PIP_RNS_CONFIG │ pip-rns config directory. aliases are resolved for T383838rns:// installs │
└─────────────────────┴────────────────────────────────────────────────────────────────────┘
Shell Completions
T282828
pip-rns completion install
opip completion install
# or pick a shell explicitly:
pip-rns completion install --shell zsh
Manual copy (same destinations):
T282828
# Bash
cp completions/pip-rns.bash ~/.local/share/bash-completion/completions/
cp completions/opip.bash ~/.local/share/bash-completion/completions/
# ZSH
cp completions/_pip-rns ~/.local/share/zsh/site-functions/
cp completions/_opip ~/.local/share/zsh/site-functions/
# Fish
cp completions/pip-rns.fish ~/.local/share/fish/vendor_completions.d/
cp completions/opip.fish ~/.local/share/fish/vendor_completions.d/
Man Pages
T282828
cp man/man1/pip-rns.1 ~/.local/share/man/man1/
cp man/man1/pipx-rns.1 ~/.local/share/man/man1/
cp man/man1/opip.1 ~/.local/share/man/man1/
Tests
T282828
python -m tests.test_runner
python -m tests.test_runner -v
python -m tests.test_runner -f opip
# Optional live tests (requires RNS, 60+ seconds):
PIP_RNS_TEST_LIVE=1 python -m tests.test_runner -f live
The test runner adds T383838src/ to T383838PYTHONPATH automatically. Optional live tests are skipped unless T383838PIP_RNS_TEST_LIVE=1 is set.
License
Served by rngit 1.4.1 - Generated in 0.04s