│  ├─ Eagle/lib/Eagle1.0/   # Eagle library packaged for Tcl
│  └─ Harpy/Tools/sign.eagle# Harpy code-sign tooling
├─ tools/
│  ├─ deploy.bat
│  ├─ pkgr_an_d_get.sh
│  └─ pkgr_an_d_install.sh  # helper scripts to fetch/install the client
└─ doc/
   ├─ redirector_v1.html    # URN/URL redirector server documentation (reference)
   ├─ repository_v1.html    # package metadata server documentation (reference)
   └─ toolset_v1.html       # package client toolset documentation (reference)
```

> File names and layout above come from the initial import(s). See the commit tree for the authoritative list. The current version is **1.0.11**.

---

## Security model at a glance

* **Metadata path**: The client asks a repository service for a package that satisfies a **TIP #268** version requirement. The server returns a small **signed script** that knows what to fetch.
* **File path**: The client downloads one or more **OpenPGP‑signed** files and verifies them **before** the package is made available to the interpreter.

* **Run once**: `pkgr_setup.eagle` to register:

  * One or more **repository endpoints** (metadata server URLs).
  * **File server** base URLs.
  * API keys (**read** and **full**) for private/personal repositories.

* **Persisted settings**: setup writes settings that subsequent runs of the client will use automatically (both for on‑demand resolution and pre‑installation). See `doc/toolset_v1.html` for parameter names and advanced options.

---

## FAQ

**Q. Does this replace `pkgIndex.tcl`?**
A. No. pkgt **uses** normal package metadata; it just enables secure **remote** resolution and delivery when a required package is not available locally.

-----BEGIN PGP SIGNATURE-----
Comment: Eagle Package Repository

iQIzBAABCAAdFiEEw8dROIPu3TrtH+QlUCyWr0ldwtkFAmjXRFQACgkQUCyWr0ld
wtlhlRAAqOXgNYQuSDGwkFX+be03zXRQzohsdSxW+3/mulfUZwFzkxjvZNaRMdOw
WpkAWDh4rynmdcPkSkbgi5OoDsSTB1LLq6Ov0rXGhQq0ePz/Pel5kqMdTGTLSzcb
mzkYjhd4/xs4Af+eogvdxCUOR/UknWUC82O2pgAz+m3xIso5/Iq+9GmLQJXHUtC2
2YOkddRHnwcTIEmyKnMN4DYQsEOYckXk+2fivrtPpbvn+Vhsu8otDxIvUggiwj8P
oPEI95crEBWiAM07LIPEhlLhfSVhJNzaedvYunJ/QulU3rHVVAnnd/ujpBAC8DxZ
Qxwt/ytCtyt8HmGeOygHQHP3jwReQ+z1cfLPisg99HT9FIERjsBbr75elsrVbsUp
B+IG29y+mpltitP6V1qeOaf7OIxcVRVBz0XQe7buhWBhiGh/+Ls+Gl9pIL23fs5U
hkEMn34/4TIYySNJSeQgiOB7P4LNlVCud8rF24GEJHpHnCr7Dlm+S4zWf4nnnD6Y
PQws4WMGmWnBk0Bp8kVQp/Fm/PhxtlVNk1FgXNg5+0BE7MtZZmmXQyP2u7Ihx7+n
9EsQk5dJzhfc4Qmc3wyhq1WCbjMe9MdLFZzOmEwv2EmtPDdEsbzzFjBCUxZxTHLE
w2cI9FNwn75+1rHuHDeuUdcHbW4Q/HRYfmj5uZo9ACyIrG3mxLc=
=EhAi
-----END PGP SIGNATURE-----