Support for Alpine Packages

[shfunke_1795]

UPDATE: Starting in ProGet 2023.22, you can create Alpine (APK) feeds with connectors

Hey,

for building Docker images we'd like to use internal mirrors
for Debian and Alpine packages, right now Alpine is not supported.

The support of Alpine packages would be a benefit not only
for internal builds on machines without internet access but
also in regards of security as then these packages would be
included in the security scans for projects under Reporting & SCA.

[jrottmann_6111]

That would be really beneficial for me too.

+1

[apxltd]

Hi @shfunke_1795 , @jrottmann_6111

Thanks, I just added this to our documentation page!

I didn't look too deeply, but I found some initial documentation:
https://wiki.alpinelinux.org/wiki/Package_management

It seems this is "like Yum/RPM but for Alpine Linux"? None of us here use Alpine Linux, so there's a pretty big learning curve to get started. Any help here would be appreciated, and definitely move this along :)

Is this related to "APK" that Android uses?

Is the "API" mostly like basic file downloads, based on an index file? Are you able to "hack" or do a PoC using ProGet Asset Directories?

[sdohle_3924]

@apxltd
Hi,

this is the link to the package format description:
https://wiki.alpinelinux.org/wiki/Apk_spec#:~:text=The APK v2 package format,it were a single stream.

[bahues_9728]

That would be very usefull for me as well.

+1

[shfunke_1795]

Hey,

The Alpine repository is basically a file repository containing all the packages
along side with an index.

APKINDEX.tar.gz
nodejs-16.16.0-r0.apk

For example files that are stored within the repository. The index
file contains the meta information of all packages and the APK
files are tar.gz archives of the actual package. 2

.
| -- APKINDEX
| -- DESCRIPTION

Structure of the APKINDEX archive.

v3.16.2-12-g0a9ad186b5

Contents of the DESCRIPTION file for the index.

C:Q1q+b+YJqvl8+pTo4w26MOThV13Ew=
P:nodejs
V:16.16.0-r0
A:x86_64
S:12195388
I:33898496
T:JavaScript runtime built on V8 engine - LTS version
U:https://nodejs.org/
L:MIT
o:nodejs
m:Jakub Jirutka <jakub@jirutka.cz>
t:1658183261
c:60ef72f6571ba1057c3c15f2ce3fe532551f4bd3
k:100
D:ca-certificates nghttp2-libs>=1.41 /bin/sh so:libbrotlidec.so.1 so:libbrotlienc.so.1 so:libc.musl-x86_64.so.1 so:libcares.so.2 so:libcrypto.so.1.1 so:libgcc_s.so.1 so:libicui18n.so.71 so:libicuuc.so.71 so:libnghttp2.so.14 so:libssl.so.1.1 so:libstdc++.so.6 so:libz.so.1
p:nodejs-lts=16.16.0 cmd:node=16.16.0-r0

...

Contents of the APKINDEX file for the index 3.

For setting up the repository the APK tool can be used, for e.g. generating
the index. 1

.
| -- usr
     | -- bin
     |    | -- node
     | -- share
          | -- systemtap
               | -- tapset
                   | -- node.stp

Example structure of a APK package.

[apxltd]

Thanks for the updates/info!

Hopefully some other folks will find this and express some interest -- I'll update if I hear anything from other users, or there's any marketing interest.

By the way, this is different than Android Package Manager APKs. Someone asked about that once because they were curious if ProGet could be like a private app store for mobile apps.

[appplat_4310]

@shfunke_1795 said in Support for Alpine Packages:

Hey,
for building Docker images we'd like to use internal mirrors
for Debian and Alpine packages, right now Alpine is not supported.
The support of Alpine packages would be a benefit not only
for internal builds on machines without internet access but
also in regards of security as then these packages would be
included in the security scans for projects under Reporting & SCA.

we are in the same scenario and it would be great to be able to rely on proget for this work.
we are long-time customers of proget and it would make our lives a lot easier.
Best regards.

[apxltd]

@shfunke_1795 @jrottmann_6111 @sdohle_3924 @bahues_9728 @appplat_4310

Thanks for insight into this! I'm happy to report that starting in ProGet 2023.22, you can create Alpine (APK) feeds with connectors :)