[ProGet] Alpine Feed Connector - Package Caching Broken

[chowarth_6088]

Hello, apologies if this isn't the correct place to post / ask this question.

I've setup a new Alpine package feed which is working great. However, there is an issue where, if the cache is enabled, apk add will fail once some packages are cached. The workaround for now is disabling the cache, though it would be ideal to take advantage of the cache :). See screenshot:

Happy to report this elsewhere if needed.

Thank you.

[atripp]

Hi @chowarth_6088 ,

Can you give some more details about the errors that you're receiving, and how to reproduce this?

Thanks,
Alana

[artur.wisniowski_4029]

I have exact same issue, I can replicate it every single time. I'm running Version 2024.3 (Build 4)

Scenario:

1. I've created two separate feeds, one for community and one for main packages:
   

2. Each of the feeds has one assigned connector, to corresponding repository. No issues there:
   
   

3. When i use feed for the first time (cache is empty), everything is working smoothly. But the second time, the cache is filled I'm starting getting error after using apk add on every package, that is already in the cache (was downloaded before). When I try do add new package which is not present in the cache, it will also work for the first time and only.

4. As the original author mentioned, when i manually clear the cache, I can again download packages but only once. After the cache contains the package, it will no longer work.

5. The apk update works every time without any error, no matter what.

6. Those are the error messages that I'm getting when trying to download package cached already by ProGet. I'm using ProGet while building docker images:
   

[artur.wisniowski_4029]

I think I've found something. I've looked into APKINDEX before the package is cached and after. ProGet is definetelly doing something to it.

I thing, that after caching package ProGet wrongly calculate C filed inside APKINDEX file (which is file checksum according to https://wiki.alpinelinux.org/wiki/Apk_spec).

Here is an example:

C:Q1UIflJfipsQ/A/h2DPh9PCYwROC8=
P:musl-dev
V:1.2.3-r5
A:x86_64
S:3225228
I:10346496
T:the musl c library (libc) implementation (development files)
U:https://musl.libc.org/
L:MIT
o:musl
m:Timo Teräs <timo.teras@iki.fi>
t:1684510151
c:b12380f8608f8cdd44347db413e8937ac4a5565b
D:musl=1.2.3-r5

• Before package was cached (no single download from feed):
  C: Q1UIflJfipsQ/A/h2DPh9PCYwROC8=

• Original value from official Alpine repo (which matches C returned by ProGet):
  C: Q1UIflJfipsQ/A/h2DPh9PCYwROC8=

• After package was cached (downloaded from feed):
  C:y3bwudQn8ZsMwZJVfU44wZ5WQFw=

As you can see, the checksum is being changed even the package itself is still exact the same file. This is definitely a bug.

[stevedennis]

@artur-wisniowski_4029 thanks for the troubleshooting! We'll investigate/fix this via PG-2671; we're going to target this Friday's maintenance release

[gdivis]

Hi @artur-wisniowski_4029,

We'll get this fixed, but it's unlikely to be in this week's release. ProGet hashs the complete package file for every package uploaded to it, while the APK spec says to hash only over a certain tar segment of the package. We've been returning ProGet's hash of the package file as the checksum and this is incorrect as you've noted.

We'll post here again when we have a fix date, but I'd expect it will be either next week or the week after.

Thanks!