APK v3

rhessinger

Thank you for sending all this over! We are going to dig into this a bit further and will let you know what we find.

Thanks,
Rich

rhessinger

Can you provide where you are getting your test packages from? I have a feeling it has to do with them more than the index. I setup the environment you specified with alpine packages I pulled from Zend PHP and had no issues. I was able to update the index and install multiple packages.

Thanks,
Rich

henderkes

Hi, you can get the packages from the codesmith repo I set up. They're still available there.

I've also tried with two test packages containing just hello.txt and world.txt and got the same results.

Running inedo with Docker, if it matters!

rhessinger

Hi @henderkes,

I did try to download that script to extract the repo you were referring to, but Alpine does not have bash installed, only ash, so I get an error when attempting to run it. Could you please provide me a direct link? To be honest, this all screams a configuration error on Alpine or an issue with the APK directly.

In my test, I created a feed in ProGet with a connector created pointing to "https://repos.zend.com/zendphp/apk_alpine320/x86_64/". I then added my feed to alpine, apk update, and then apk add php85zend. Everything worked as expected.

Thanks,
Rich

henderkes

@rhessinger You can install bash on alpine too. You can get a direct download to the packages here: https://pkg.henderkes.com/85/php-zts/packages?q=&type=alpine

For testing it should be enough to download php-zts-cli and php-zts-zstd.

If connected feeds are working for you, the issue may be specific to local feeds.

rhessinger

Hi @henderkes,

Thanks for sending those packages over. I was able to recreate some issues with those packages and we are currently still looking for the cause. I'll send over an update once I have a bit more information.

Thanks,
Rich

rhessinger

Hi @henderkes,

Sorry for the delay on this. Right now, there looks to be a couple issues I'm working through with this. I should have an update for you on Friday. I believe I have identified the issues, but I'm trying to confirm some things based on your APK packages. Just to confirm, the packages you shared are APK Tools V2 packages correct?

Thanks,
Rich

rhessinger

Hi @henderkes,

So we have identified the issue. When it comes to your packages, there where two issues that were preventing them from being updated and installed.

The packages you provided to me are unsigned. According to the APK documentation, that is not supported. In reality, that is a case that they support and have supported for some time. So we have a ticket, PG-3192, to correct the checksum generation for unsigned packages.
When a checksum is not generated, ProGet was inserting the hash of the package instead, which would cause the index to fail.
- In older versions of APK tools V2, this would fail the install of that package, but show you the all packages in the index.
- In newer versions of APK Tools V2, it will stop processing once a package with a bad checksum is shown. Which is why it looked like only one package existed in the feed. Installing these packages will most likely fail with a checksum error.
- In APK Tools v3, it errors on apk update and these packages cannot be installed at all.

We are going to be adding the checksum verification to the Feed integrity checks and a way to regenerate the checksums in ticket PG-3193. That should resolve all these issues for you. That also explains why my test cases worked fine, because most public index packages are signed packages.

Thanks,
Rich

henderkes

@rhessinger Oh, that explains it. I deliberately left all packages unsigned as I expected ProGet to sign them for me instead. Thank you for figuring this out!

rhessinger

Hi @henderkes,

No problem! Both these issues are expected to be fixed in this Friday's release of ProGet 2025.18.

Thanks,
Rich