upgrade seaweedfs to 4.41 and patch gitea's new checksum

---------

Co-authored-by: Joachim Schlöffel <me@joachim-schloeffel.com>
Reviewed-on: #4

.dockerignore

@@ -0,0 +1,5 @@
+.git
+.cache
+packages
+packaging/**/pkg
+packaging/**/src

.gitea/workflows/build.yml

@@ -1,6 +1,8 @@
 name: Build Alpine Packages
 
 on:
+  schedule:
+    - cron: "17 5 * * 1"
   push:
     branches:
       - master
@@ -29,29 +31,52 @@ jobs:
       PACKAGE_OWNER: "${{ vars.PACKAGE_OWNER }}"
       PACKAGE_USER: "${{ secrets.PACKAGE_USER }}"
       PACKAGE_TOKEN: "${{ secrets.PACKAGE_TOKEN }}"
-      PACKAGER: "Joachim Schlöffel <me@joachim-schloeffel.com>"
+      PACKAGER: "${{ gitea.repository_owner }}"
+      ALPINE_APK_REPO_CACHE: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/apk-repo"
       CARGO_HOME: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/cargo"
       RUSTUP_HOME: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/rustup"
       CARGO_TARGET_DIR: "/cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb/target"
     steps:
       - name: Prepare Environment
         run: |
-          apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git nodejs sudo tar
+          apk add --no-cache --update abuild-rootbld alpine-sdk atools-apkbuild-lint bash ca-certificates curl doas git nodejs rsync shellcheck sudo tar
-          mkdir -p "$CARGO_HOME" "$RUSTUP_HOME" "$CARGO_TARGET_DIR"
+          mkdir -p "$ALPINE_APK_REPO_CACHE" "$CARGO_HOME" "$RUSTUP_HOME" "$CARGO_TARGET_DIR"
-          chown 1000:1000 /cache /cache/public-alpine-packages /cache/public-alpine-packages/${{ matrix.alpine_registry_branch }} /cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}/greptimedb "$CARGO_HOME" "$RUSTUP_HOME" "$CARGO_TARGET_DIR"
+          chown -R 1000:1000 /cache/public-alpine-packages/${{ matrix.alpine_registry_branch }}
 
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Build packages
+      - name: Select packages
         run: |
           scripts/apk/clean.sh
           find packaging/alpine/local -mindepth 2 -maxdepth 2 -name APKBUILD -exec apkbuild-lint {} +
+          scripts/apk/lint-shell.sh
+          scripts/apk/outdated.sh | tee update-check.txt
+          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+            {
+              echo "## Upstream update check"
+              echo
+              echo '```text'
+              cat update-check.txt
+              echo '```'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - name: Prepare package cache
+        if: github.event_name != 'schedule'
+        run: |
+          scripts/apk/ci-package-cache.sh prepare
+
+      - name: Build packages
+        if: github.event_name != 'schedule'
+        run: |
           scripts/apk/ci-build.sh
+          scripts/apk/ci-package-cache.sh sync
           scripts/apk/export-ci-assets.sh
           scripts/apk/list-packages.sh
 
       - name: Check artifact upload support
+        if: github.event_name != 'schedule'
         id: artifact-upload
         run: |
           if [ -n "${ACTIONS_RUNTIME_TOKEN:-}" ]; then
@@ -61,18 +86,20 @@ jobs:
           fi
 
       - name: Upload generated CI assets
-        if: steps.artifact-upload.outputs.available == 'true'
+        if: github.event_name != 'schedule' && steps.artifact-upload.outputs.available == 'true'
         uses: actions/upload-artifact@v3
         with:
           name: greptimedb-musl-binaries-${{ matrix.alpine_registry_branch }}
           path: packages/ci-assets/
 
       - name: Smoke test
+        if: github.event_name != 'schedule'
         run: scripts/apk/ci-smoke.sh
 
       - name: Runtime test
+        if: github.event_name != 'schedule'
         run: scripts/apk/runtime-test.sh
 
       - name: Publish Alpine packages
-        if: github.event_name != 'pull_request'
+        if: github.event_name != 'pull_request' && github.event_name != 'schedule'
         run: scripts/apk/publish-gitea.sh

README.md

@@ -1,6 +1,15 @@
 # Alpine Packages
 
-Alpine stable packaging for internal packages.
+Alpine stable packaging for internal packages. This repository carries selected
+upstream releases ahead of Alpine community packages when we need newer
+features, packaging fixes, or service layouts on the current Alpine branch.
+
+Packages are either source builds or binary repackages:
+
+- Source builds compile upstream source releases inside the Alpine build
+  environment and link against Alpine libraries.
+- Binary repackages wrap official upstream Linux release artifacts in Alpine
+  package metadata, OpenRC services, config defaults, and role subpackages.
 
 ```text
 https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
@@ -8,9 +17,12 @@ https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
 
 ## Available Packages
 
-- [SeaweedFS](packaging/alpine/local/seaweedfs/README.md): `seaweedfs`
+| Package                                                   | APK Name     | Package Version | Package Type                                             | Purpose                                                                                                         |
-- [GreptimeDB](packaging/alpine/local/greptimedb/README.md): `greptimedb`
+|-----------------------------------------------------------|--------------|-----------------|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
-- [LavinMQ](packaging/alpine/local/lavinmq/README.md): `lavinmq`
+| [SeaweedFS](packaging/alpine/local/seaweedfs/README.md)   | `seaweedfs`  | `4.40`          | Binary repackaging of official upstream release tarballs | Ships current SeaweedFS features with Alpine OpenRC role splits.                                                |
+| [GreptimeDB](packaging/alpine/local/greptimedb/README.md) | `greptimedb` | `1.1.4`         | Source build from upstream release                       | Provides a current GreptimeDB build and component OpenRC packages before it is available from Alpine community. |
+| [LavinMQ](packaging/alpine/local/lavinmq/README.md)       | `lavinmq`    | `2.9.1`         | Source build from upstream release                       | Provides a current LavinMQ build on Alpine 3.24 with matching Crystal support.                                  |
+| [Gitea](packaging/alpine/local/gitea/README.md)           | `gitea`      | `1.27.0`        | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service.                        |
 
 ## Use In Production
 
@@ -49,14 +61,6 @@ Package sources live under:
 packaging/alpine/local/<pkgname>/
 ```
 
-Currently packaged:
-
-```text
-seaweedfs    SeaweedFS 4.31 release binary and OpenRC role splits
-greptimedb   GreptimeDB 1.1.2 built from source for x86_64
-lavinmq      LavinMQ 2.9.1 built from source for x86_64
-```
-
 Local build output is written under:
 
 ```text
@@ -84,13 +88,15 @@ apk:ci-build          Build all configured Alpine packages directly in the curre
 apk:ci-smoke          Install-test built packages directly in the current Alpine environment
 apk:clean             Remove generated Alpine package build outputs
 apk:lint              Run Alpine APKBUILD lint in Docker
+apk:lint-shell        Run ShellCheck for packaging automation
 apk:packages          List built Alpine packages and dependencies
 apk:publish-check     Run lint, multi-arch build, package listing, and smoke test
 apk:publish-gitea     Publish built packages to the Gitea Alpine package registry
+apk:outdated          Check packaged upstream versions against latest GitHub releases
 apk:shell             Open an Alpine package build shell in Docker
 apk:smoke             Install-test built packages from the local repository in Docker
 apk:test-install      Test README installation instructions in a fresh Alpine container
-apk:test-shell        Open an Alpine shell with the current local package build installed
+apk:test-shell        Open an Alpine shell with the local APK repository configured
 apk:update-generated  Refresh packaged upstream examples and shell completions
 apk:runtime-test      Run package-local Docker runtime tests against the local...
 gitea-workflow-build  Run the Gitea build workflow locally through act as a pull_request event
@@ -114,6 +120,8 @@ ALPINE_PACKAGE=greptimedb mise run apk:build
 ALPINE_PACKAGE=greptimedb SKIP_BUILD=1 mise run apk:test-install
 ALPINE_PACKAGE=lavinmq mise run apk:build
 ALPINE_PACKAGE=lavinmq SKIP_BUILD=1 mise run apk:test-install
+ALPINE_PACKAGE=gitea mise run apk:build
+ALPINE_PACKAGE=gitea SKIP_BUILD=1 mise run apk:test-install
 ```
 
 Override Docker cache scope:
@@ -123,11 +131,17 @@ ALPINE_APK_CACHE_SCOPE=public-alpine-packages ALPINE_PACKAGE=greptimedb mise run
 ALPINE_APK_CACHE_PREFIX=alpine-apk-ci ALPINE_PACKAGE=greptimedb mise run apk:build
 ```
 
-Open an Alpine test shell:
+Local packages use `local` as the default package metadata identity. Override it
+when needed:
+
+```sh
+PACKAGER="Example Builder <builder@example.com>" ALPINE_PACKAGE=seaweedfs mise run apk:build
+```
+
+Open an Alpine package build shell:
 
 ```sh
 ALPINE_PACKAGE=seaweedfs mise run apk:shell
-mise run apk:test-shell
 ```
 
 Run the install test:
@@ -143,6 +157,17 @@ SKIP_BUILD=1 mise run apk:test-install
 SKIP_BUILD=1 mise run apk:test-shell
 ```
 
+`apk:test-shell` opens an Alpine shell with the local APK repository configured.
+Install whichever built packages you want inside the container:
+
+```sh
+apk add seaweedfs seaweedfs-master-openrc
+weed version
+
+apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
+greptime --version
+```
+
 Run package-local runtime tests:
 
 ```sh
@@ -190,6 +215,22 @@ ALPINE_PACKAGE=seaweedfs mise run apk:update-generated
 mise run apk:checksum
 ```
 
+### Upstream Update Visibility
+
+Check whether packaged upstream versions are current:
+
+```sh
+mise run apk:outdated
+ALPINE_PACKAGE=seaweedfs mise run apk:outdated
+```
+
+By default this is a warning-only signal. To make outdated or unknown package
+versions fail the command:
+
+```sh
+APK_UPDATE_CHECK_MODE=fail mise run apk:outdated
+```
+
 ### Gitea Workflow
 
 `.gitea/workflows/build.yml` builds and publishes `v3.24`. Pull requests
@@ -242,6 +283,7 @@ Then test at least one installed role in the package shell:
 
 ```sh
 mise run apk:test-shell
+apk add seaweedfs seaweedfs-master-openrc
 rc-service seaweedfs.master start
 weed version
 ```

bin/greptimedb

@@ -1,13 +0,0 @@
-#!/usr/bin/env -S mise tool-stub
-# GrepTimeDB 1.0.2 release binary.
-
-version = "1.0.2"
-bin = "greptime"
-
-[platforms.linux-x64]
-url = "https://github.com/GreptimeTeam/greptimedb/releases/download/v1.0.2/greptime-linux-amd64-v1.0.2.tar.gz"
-checksum = "sha256:1ad1f9312ce18a49494434cf52cf9fa00093c4712728508bff4578d060fb2d89"
-
-[platforms.linux-arm64]
-url = "https://github.com/GreptimeTeam/greptimedb/releases/download/v1.0.2/greptime-linux-arm64-v1.0.2.tar.gz"
-checksum = "sha256:e6567f5d97fd34b876b5653c22877c238a1633ecbe26b3b7c22b95892656c39c"

bin/weed

@@ -1,15 +0,0 @@
-#!/usr/bin/env -S mise tool-stub
-# SeaweedFS 4.31 release binary.
-
-version = "4.31"
-bin = "weed"
-
-[platforms.linux-x64]
-url = "https://github.com/seaweedfs/seaweedfs/releases/download/4.31/linux_amd64.tar.gz"
-checksum = "sha256:81103c53453fddfa75d9d611cd3e61aa57e7a3099dc7a1de5977ab4b19211958"
-size = 43223476
-
-[platforms.linux-arm64]
-url = "https://github.com/seaweedfs/seaweedfs/releases/download/4.31/linux_arm64.tar.gz"
-checksum = "sha256:76ac1ffce87a2a710a3913282a19de6d9a3785f4a3586556858ec7b81a87d958"
-size = 38036794

mise.toml

@@ -1,6 +1,5 @@
 [tools]
 act = "latest"
-codex = "latest"
 docker-cli = "latest"
 shellcheck = "latest"
 
@@ -36,6 +35,10 @@ run = "scripts/apk/update-generated-sources.sh"
 description = "Run Alpine APKBUILD lint in Docker"
 run = "scripts/apk/build.sh lint"
 
+[tasks."apk:lint-shell"]
+description = "Run ShellCheck for packaging automation"
+run = "scripts/apk/lint-shell.sh"
+
 [tasks."apk:smoke"]
 description = "Install-test built packages from the local repository in Docker"
 run = "scripts/apk/smoke.sh"
@@ -45,7 +48,7 @@ description = "Install-test built packages directly in the current Alpine enviro
 run = "scripts/apk/ci-smoke.sh"
 
 [tasks."apk:test-shell"]
-description = "Open an Alpine shell with the current local package build installed"
+description = "Open an Alpine shell with the local APK repository configured"
 run = "scripts/apk/test-shell.sh"
 
 [tasks."apk:test-install"]
@@ -61,6 +64,10 @@ env = { ALPINE_ARCH = "x86_64", ALPINE_REPO_NAME = "local", ALPINE_VERSION = "3.
 description = "List built Alpine packages and dependencies"
 run = "scripts/apk/list-packages.sh"
 
+[tasks."apk:outdated"]
+description = "Check packaged upstream versions against latest GitHub releases"
+run = "scripts/apk/outdated.sh"
+
 [tasks."apk:publish-check"]
 description = "Run lint, multi-arch build, package listing, and smoke test"
 run = "scripts/apk/publish-check.sh"

packaging/alpine/local/gitea/APKBUILD

@@ -0,0 +1,77 @@
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
+pkgname=gitea
+pkgver=1.27.1
+pkgrel=2
+pkgdesc="Self-hosted Git service written in Go"
+url="https://about.gitea.com/"
+arch="x86_64 aarch64"
+license="MIT"
+depends="git git-lfs gnupg"
+makedepends="tar xz"
+provides="cmd:gitea=$pkgver-r$pkgrel"
+install="$pkgname.pre-install"
+pkgusers="gitea"
+pkggroups="www-data"
+subpackages="
+	$pkgname-doc
+	$pkgname-openrc:_openrc:noarch
+	"
+options="!check !strip !tracedeps"
+
+case "$CARCH" in
+	x86_64)
+		_archive="$pkgname-$pkgver-linux-amd64.xz"
+		;;
+	aarch64)
+		_archive="$pkgname-$pkgver-linux-arm64.xz"
+		;;
+esac
+
+source="
+	$pkgname-$pkgver-linux-amd64.xz::https://github.com/go-gitea/gitea/releases/download/v$pkgver/gitea-$pkgver-linux-amd64.xz
+	$pkgname-$pkgver-linux-arm64.xz::https://github.com/go-gitea/gitea/releases/download/v$pkgver/gitea-$pkgver-linux-arm64.xz
+	$pkgname-src-$pkgver.tar.gz::https://github.com/go-gitea/gitea/releases/download/v$pkgver/gitea-src-$pkgver.tar.gz
+	gitea.ini
+	gitea.initd
+	"
+builddir="$srcdir/gitea-src-$pkgver"
+
+prepare() {
+	default_prepare
+	xz -dc "$srcdir/$_archive" > "$srcdir"/gitea
+	chmod 0755 "$srcdir"/gitea
+}
+
+package() {
+	local _dir
+	for _dir in gitea gitea/git gitea/data gitea/db gitea/custom; do
+		install -d -m 0750 -o gitea -g www-data \
+			"$pkgdir"/var/lib/$_dir
+	done
+
+	install -d -m 0755 -o gitea -g www-data "$pkgdir"/var/log/gitea
+	install -Dm755 "$srcdir"/gitea "$pkgdir"/usr/bin/gitea
+	install -Dm644 -o gitea -g www-data "$srcdir"/gitea.ini \
+		"$pkgdir"/etc/gitea/app.ini
+	chown gitea:www-data "$pkgdir"/etc/gitea
+
+	install -d -m 0755 "$pkgdir"/usr/share/webapps/gitea
+	cp -r "$builddir"/options "$builddir"/public "$builddir"/templates \
+		"$pkgdir"/usr/share/webapps/gitea/
+	install -Dm644 "$builddir"/LICENSE -t "$pkgdir"/usr/share/licenses/gitea/
+}
+
+_openrc() {
+	pkgdesc="$pkgdesc (OpenRC service)"
+	depends="$pkgname=$pkgver-r$pkgrel openrc"
+
+	install -Dm755 "$srcdir"/gitea.initd "$subpkgdir"/etc/init.d/gitea
+}
+
+sha512sums="
+103a3af76a84d9a093aaed09f03519ae1f698609f3374d64bc0c3aaed00296e5bea8382e8b5a0115c56875d64b8dd8e69dea43093ecebcd87fd5298e533b6fa2  gitea-1.27.1-linux-amd64.xz
+ffb9d13be03ada20a8b8d59c6e7885b4ba57a27f3f487920a61b2491e56c06eb8d4f21ff6fb32ea598535b3af66bb15347ed3e07df4eaf532ed4c63909e4caee  gitea-1.27.1-linux-arm64.xz
+19e9893a2e15de188ad4fb17f52c49c87884ff5c14d2fadf59213887f262f7200ae0a86af4d3c9488d1cded54864e08423b5058e60c694fbb235e8693736436d  gitea-src-1.27.1.tar.gz
+431184faffa8996873d92d7b0d16bc4b1a0178d264cd2928d1f49b13ad3e6470d9ede7a18c12112deeeb38f0647ccc0b012e98bcbd96e7b8496a3dc18f5b1fb7  gitea.ini
+9474d707df8b049c93ec4642f71195adff699e1e812f315cac4295b3ab29eeb9ba8b83bf3307c50b04e072a4a9dc4c4f84ac490ee22291bd50015009795c1598  gitea.initd
+"

packaging/alpine/local/gitea/README.md

@@ -0,0 +1,38 @@
+# Gitea Alpine Package
+
+Repackages upstream Gitea 1.27.0 Linux release binaries for `x86_64` and
+`aarch64`.
+
+The package follows Alpine's Gitea runtime layout:
+
+- `/usr/bin/gitea`
+- `/etc/gitea/app.ini`
+- `/var/lib/gitea`
+- `/var/log/gitea`
+- `/usr/share/webapps/gitea`
+
+Install the OpenRC service with:
+
+```sh
+apk add gitea gitea-openrc
+rc-update add gitea default
+rc-service gitea start
+```
+
+Refresh checksums:
+
+```sh
+ALPINE_PACKAGE=gitea mise run apk:checksum
+```
+
+Build:
+
+```sh
+ALPINE_PACKAGE=gitea mise run apk:build
+```
+
+Install-test local build:
+
+```sh
+ALPINE_PACKAGE=gitea SKIP_BUILD=1 mise run apk:test-install
+```

packaging/alpine/local/gitea/gitea.ini

@@ -0,0 +1,26 @@
+# Configuration cheat sheet: https://docs.gitea.io/en-us/config-cheat-sheet/
+
+RUN_USER = gitea
+RUN_MODE = prod
+
+[repository]
+ROOT = /var/lib/gitea/git
+SCRIPT_TYPE = sh
+
+[server]
+STATIC_ROOT_PATH = /usr/share/webapps/gitea
+APP_DATA_PATH    = /var/lib/gitea/data
+LFS_START_SERVER = true
+
+[database]
+DB_TYPE = sqlite3
+PATH = /var/lib/gitea/db/gitea.db
+SSL_MODE = disable
+
+[session]
+PROVIDER = file
+
+[log]
+ROOT_PATH = /var/log/gitea
+MODE = file
+LEVEL = Info

packaging/alpine/local/gitea/gitea.initd

@@ -0,0 +1,30 @@
+#!/sbin/openrc-run
+
+supervisor=supervise-daemon
+name=gitea
+command="/usr/bin/gitea"
+command_user="${GITEA_USER:-gitea}"
+command_args="web --config '${GITEA_CONF:-/etc/gitea/app.ini}'"
+supervise_daemon_args="--env GITEA_WORK_DIR='${GITEA_WORK_DIR:-/var/lib/gitea}' --chdir '${GITEA_WORK_DIR:-/var/lib/gitea}' --stdout '${GITEA_LOG_FILE:-/var/log/gitea/http.log}' --stderr '${GITEA_LOG_FILE:-/var/log/gitea/http.log}'"
+pidfile="/run/gitea.pid"
+extra_started_commands="reopen_log"
+capabilities="^cap_net_bind_service"
+
+depend() {
+	use logger dns
+	need net
+	after firewall mysql postgresql
+}
+
+# https://github.com/go-gitea/gitea/issues/17976
+# reload() {
+#	ebegin "Reloading ${RC_SVCNAME}"
+#	${supervisor} ${RC_SVCNAME} --signal HUP --pidfile "${pidfile}"
+#	eend $?
+# }
+
+reopen_log() {
+	ebegin "Reopening logfile for ${RC_SVCNAME}"
+	${supervisor} ${RC_SVCNAME} --signal USR1 --pidfile "${pidfile}"
+	eend $?
+}

packaging/alpine/local/gitea/gitea.pre-install

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+addgroup -S www-data 2>/dev/null
+adduser -S -D -H -h /var/lib/gitea -s /sbin/nologin \
+	-G www-data -g gitea gitea 2>/dev/null
+
+exit 0

packaging/alpine/local/gitea/scripts/runtime-test.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add gitea gitea-doc gitea-openrc
+
+test -x /usr/bin/gitea
+test -f /etc/gitea/app.ini
+test -d /var/lib/gitea
+test -d /var/lib/gitea/git
+test -d /var/lib/gitea/data
+test -d /var/lib/gitea/db
+test -d /var/log/gitea
+test -d /usr/share/webapps/gitea/options
+test -d /usr/share/webapps/gitea/public
+test -d /usr/share/webapps/gitea/templates
+test -f /etc/init.d/gitea
+
+gitea --version
+
+rc-update add gitea default || true
+test -L /etc/runlevels/default/gitea

packaging/alpine/local/gitea/scripts/test-install.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
+# shellcheck source=scripts/apk/test-install-lib.sh
+. "${repo_root}/scripts/apk/test-install-lib.sh"
+
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-gitea}" "${PACKAGE_VERSION:-1.27.0-r1}" <<'SCRIPT'
+    set -e
+
+    if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
+      if [ -n "${ALPINE_REPOSITORY_KEY_URL}" ]; then
+        apk add --no-cache curl >/dev/null
+        cd /etc/apk/keys
+        curl -fsSLOJ "${ALPINE_REPOSITORY_KEY_URL}"
+      fi
+      printf "%s\n" "${ALPINE_REPOSITORY_URL}" >> /etc/apk/repositories
+    else
+      apk update
+      apk add "${PACKAGE_NAME}"
+      installed_before="$(apk list -I "${PACKAGE_NAME}" | awk "{print \$1}")"
+      printf "Installed repository package before local upgrade: %s\n" "${installed_before}"
+      if [ "${installed_before}" = "${PACKAGE_NAME}-${PACKAGE_VERSION}" ]; then
+        printf "default repository already has %s; upgrade path was not exercised\n" "${PACKAGE_VERSION}" >&2
+        exit 1
+      fi
+
+      cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
+      printf "%s\n" /repo >> /etc/apk/repositories
+    fi
+    apk update
+    apk add --upgrade "${PACKAGE_NAME}" "${PACKAGE_NAME}-doc" "${PACKAGE_NAME}-openrc"
+    installed_after="$(apk list -I "${PACKAGE_NAME}" | awk "{print \$1}")"
+    printf "Installed package after local upgrade: %s\n" "${installed_after}"
+    test "${installed_after}" = "${PACKAGE_NAME}-${PACKAGE_VERSION}"
+
+    test -x /usr/bin/gitea
+    test -f /etc/gitea/app.ini
+    test -d /var/lib/gitea
+    test -d /var/lib/gitea/git
+    test -d /var/lib/gitea/data
+    test -d /var/lib/gitea/db
+    test -d /var/log/gitea
+    test -d /usr/share/webapps/gitea/options
+    test -d /usr/share/webapps/gitea/public
+    test -d /usr/share/webapps/gitea/templates
+    test -f /etc/init.d/gitea
+
+    gitea --version
+
+    rc-update add gitea default
+    test -L /etc/runlevels/default/gitea
+SCRIPT

packaging/alpine/local/gitea/update-check.conf

@@ -0,0 +1,3 @@
+provider=github
+repo=go-gitea/gitea
+version_prefix=v

packaging/alpine/local/greptimedb/APKBUILD

@@ -1,6 +1,6 @@
-# Maintainer: Joachim Schlöffel <me@joachim-schloeffel.com>
+# Maintainer: Joachim Schlöffel <mjoachim.schloeffel@financial-service-plus.de>
 pkgname=greptimedb
-pkgver=1.1.2
+pkgver=1.1.4
 pkgrel=0
 pkgdesc="Cloud-native observability database for metrics, logs, and traces"
 url="https://github.com/GreptimeTeam/greptimedb"
@@ -127,7 +127,7 @@ _docs() {
 }
 
 sha512sums="
-bc449d2f2a2513e6ba326cac951ddfc87461e8fa7bbdd3d9935990d7718b24a298547154786c2129379d79f5e3cbf0515e5b82a2e79d28ea8d00fcc7384da447  greptimedb-1.1.2.tar.gz
+d60080a82a1dba52ab28d33ba1d9109bd047a6e598dbad17a3d92c82c6aad20b7fffd35cc20571829d8869360040af61195eeb97a14e08d8289e70663ee08664  greptimedb-1.1.4.tar.gz
 4260acae5bed00a693dceffe9f53d0f8b25fd677b15638e951cf973dc29681f4bacde352c661a12bd78af7be9181a3740812f814fc3c4c8c87ea4eee6ee07e2d  dashboard-v0.12.0.tar.gz
 29cc3376753487b216748e3f85e12639830e1ac4a763e94f330f87c3651a8ef9de35732958311c0049e1b7cbb4e90a9e602b3aff43297fe088c5ce795a110a79  datanode.toml
 52790808cb4f5cf0220ac2ab169b623fe76b6318d27d7f003e1197e850373cb915bfd40556098bcb7650f293d751039cb3bccbf9107bb160b8284887794ba975  flownode.toml

packaging/alpine/local/greptimedb/scripts/test-install.sh

@@ -2,43 +2,10 @@
 set -euo pipefail
 
 repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
-package_name="${PACKAGE_NAME:-greptimedb}"
+# shellcheck source=scripts/apk/test-install-lib.sh
-alpine_version="${ALPINE_VERSION:-3.24}"
+. "${repo_root}/scripts/apk/test-install-lib.sh"
-arch="${ALPINE_ARCH:-x86_64}"
-repository_url="${ALPINE_REPOSITORY_URL:-}"
-repository_key_url="${ALPINE_REPOSITORY_KEY_URL:-}"
 
-case "${arch}" in
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-greptimedb}" "${PACKAGE_VERSION:-}" <<'SCRIPT'
-  x86_64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/amd64}"
-    ;;
-  aarch64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/arm64}"
-    ;;
-  *)
-    printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2
-    exit 2
-    ;;
-esac
-
-if [[ -z "${repository_url}" && "${SKIP_BUILD:-0}" != "1" ]]; then
-  ALPINE_PACKAGE="${package_name}" "${repo_root}/scripts/apk/build.sh" build "${arch}"
-fi
-
-if [[ -z "${repository_url}" && ! -d "${repo_root}/packages/local/${arch}" ]]; then
-  printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
-  printf 'run: ALPINE_PACKAGE=%s mise run apk:build\n' "${package_name}" >&2
-  exit 1
-fi
-
-docker run --rm --platform "${platform}" \
-  -e "ALPINE_ARCH=${arch}" \
-  -e "PACKAGE_NAME=${package_name}" \
-  -e "ALPINE_REPOSITORY_URL=${repository_url}" \
-  -e "ALPINE_REPOSITORY_KEY_URL=${repository_key_url}" \
-  -v "${repo_root}/packages/local:/repo:ro" \
-  "alpine:${alpine_version}" \
-  sh -lc '
     set -e
 
     if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
@@ -68,4 +35,4 @@ docker run --rm --platform "${platform}" \
     test -f "/usr/share/doc/${PACKAGE_NAME}/config/config.md"
     test -f "/usr/share/doc/${PACKAGE_NAME}/config/standalone.example.toml"
     find /etc/init.d -maxdepth 1 -name "greptimedb.*" -print | sort
-  '
+SCRIPT

packaging/alpine/local/greptimedb/update-check.conf

@@ -0,0 +1,3 @@
+provider=github
+repo=GreptimeTeam/greptimedb
+version_prefix=v

packaging/alpine/local/lavinmq/APKBUILD

@@ -1,7 +1,7 @@
-# Maintainer: Joachim Schlöffel <me@joachim-schloeffel.com>
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=lavinmq
 pkgver=2.9.1
-pkgrel=0
+pkgrel=2
 pkgdesc="High-performance AMQP and MQTT message queue server"
 url="https://github.com/cloudamqp/lavinmq"
 arch="x86_64"
@@ -23,6 +23,8 @@ makedepends="
 	yaml-dev
 	"
 install="$pkgname.pre-install"
+pkgusers="lavinmq"
+pkggroups="lavinmq"
 subpackages="
 	$pkgname-doc
 	$pkgname-openrc:_openrc:noarch
@@ -52,6 +54,7 @@ package() {
 	make DESTDIR="$pkgdir" install
 	rm -r "$pkgdir"/lib/systemd "$pkgdir"/usr/lib/sysusers.d
 	rmdir "$pkgdir"/lib "$pkgdir"/usr/lib
+	install -d -m 0750 -o lavinmq -g lavinmq "$pkgdir"/var/lib/lavinmq
 }
 
 _openrc() {
@@ -67,5 +70,5 @@ _openrc() {
 sha512sums="
 5f88de7a1e093b1f6e2ead5c340140bd489a99ca8adfa9f40052148490d0bdf8ff1e2dad67727e9799ad1f942755df01525e63d24b0901684a743f43c42110b9  lavinmq-2.9.1.tar.gz
 62a609d50f28db960098c4c84ce4f1dad78413366a9a9aca18fe321114d687be3bf7b71924d4ace69bd74383c5ac40d2ee09ae0eef9c1bfe653b97448e42e110  lavinmq.confd
-76fbfa1b14c58631e92f817e689584239eb644e68460c091decdcabe7661aeb210f9128545262add2fb07eeee155c8734f1e612fc59ebb897d3c67e95a56350f  lavinmq.initd
+1853196e70297b5c4a2207fde50df735620cf6d99c4994644fd676bffaf863d67300ad7ae771c4bbb86fce1a0485c2a7968cf912c5f5bb878e08b15e5a28ba1b  lavinmq.initd
 "

packaging/alpine/local/lavinmq/lavinmq.initd

@@ -18,9 +18,11 @@ depend() {
 }
 
 start_pre() {
-	checkpath -d -m 0755 -o "${LAVINMQ_USER:-lavinmq}:${LAVINMQ_GROUP:-lavinmq}" \
+	local service_owner="${LAVINMQ_USER:-lavinmq}:${LAVINMQ_GROUP:-lavinmq}"
+
+	checkpath -d -m 0755 -o "$service_owner" \
 		/run/lavinmq \
 		/var/log/lavinmq
-	checkpath -d -m 0750 -o "${LAVINMQ_USER:-lavinmq}:${LAVINMQ_GROUP:-lavinmq}" \
+	checkpath -d -m 0750 -o "$service_owner" "$data_dir"
-		"$data_dir"
+	checkpath -f -m 0640 -o "$service_owner" "$data_dir"/.lock
 }

packaging/alpine/local/lavinmq/scripts/runtime-test.sh

@@ -8,6 +8,7 @@ test -x /usr/bin/lavinmqctl
 test -x /usr/bin/lavinmqperf
 test -f /etc/lavinmq/lavinmq.ini
 test -d /var/lib/lavinmq
+test "$(stat -c '%U:%G %a' /var/lib/lavinmq)" = "lavinmq:lavinmq 750"
 test -f /etc/conf.d/lavinmq
 test -f /etc/init.d/lavinmq
 test -f /usr/share/doc/lavinmq/README.md

packaging/alpine/local/lavinmq/scripts/test-install.sh

@@ -2,43 +2,10 @@
 set -euo pipefail
 
 repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
-package_name="${PACKAGE_NAME:-lavinmq}"
+# shellcheck source=scripts/apk/test-install-lib.sh
-alpine_version="${ALPINE_VERSION:-3.24}"
+. "${repo_root}/scripts/apk/test-install-lib.sh"
-arch="${ALPINE_ARCH:-x86_64}"
-repository_url="${ALPINE_REPOSITORY_URL:-}"
-repository_key_url="${ALPINE_REPOSITORY_KEY_URL:-}"
 
-case "${arch}" in
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-lavinmq}" "${PACKAGE_VERSION:-}" <<'SCRIPT'
-  x86_64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/amd64}"
-    ;;
-  aarch64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/arm64}"
-    ;;
-  *)
-    printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2
-    exit 2
-    ;;
-esac
-
-if [[ -z "${repository_url}" && "${SKIP_BUILD:-0}" != "1" ]]; then
-  ALPINE_PACKAGE="${package_name}" "${repo_root}/scripts/apk/build.sh" build "${arch}"
-fi
-
-if [[ -z "${repository_url}" && ! -d "${repo_root}/packages/local/${arch}" ]]; then
-  printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
-  printf 'run: ALPINE_PACKAGE=%s mise run apk:build\n' "${package_name}" >&2
-  exit 1
-fi
-
-docker run --rm --platform "${platform}" \
-  -e "ALPINE_ARCH=${arch}" \
-  -e "PACKAGE_NAME=${package_name}" \
-  -e "ALPINE_REPOSITORY_URL=${repository_url}" \
-  -e "ALPINE_REPOSITORY_KEY_URL=${repository_key_url}" \
-  -v "${repo_root}/packages/local:/repo:ro" \
-  "alpine:${alpine_version}" \
-  sh -lc '
     set -e
 
     if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
@@ -60,6 +27,7 @@ docker run --rm --platform "${platform}" \
     test -x /usr/bin/lavinmqperf
     test -f /etc/lavinmq/lavinmq.ini
     test -d /var/lib/lavinmq
+    test "$(stat -c "%U:%G %a" /var/lib/lavinmq)" = "lavinmq:lavinmq 750"
     test -f /etc/conf.d/lavinmq
     test -f /etc/init.d/lavinmq
     test -f /usr/share/doc/lavinmq/README.md
@@ -71,4 +39,4 @@ docker run --rm --platform "${platform}" \
 
     rc-update add lavinmq default
     test -L /etc/runlevels/default/lavinmq
-  '
+SCRIPT

packaging/alpine/local/lavinmq/update-check.conf

@@ -0,0 +1,3 @@
+provider=github
+repo=cloudamqp/lavinmq
+version_prefix=v

packaging/alpine/local/seaweedfs/APKBUILD

@@ -1,7 +1,7 @@
-# Maintainer: Joachim Schlöffel <me@joachim-schloeffel.com>
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=seaweedfs
-pkgver=4.31
+pkgver=4.41
-pkgrel=3
+pkgrel=0
 pkgdesc="Distributed storage system for object storage, file systems, and Iceberg tables"
 url="https://github.com/seaweedfs/seaweedfs"
 arch="x86_64 aarch64"
@@ -109,15 +109,15 @@ _bashcomp() {
 }
 
 sha512sums="
-60c758d6d565d0cbc533e4e5677186a4700d48be12ebbd2bd1c6b4bcf38f687d0ab1f66e0953c8a27c663549cdbae73e5fd7eda74bb422c20e10e0d0850b5ead  seaweedfs-4.31-linux-amd64.tar.gz
+51810779863e7b5578ef1a236af137f2ef79e44b7d8f10b5b36f6d45fa002ae8c6ad92f18e7fefdff8f7a4ec5c29acea13d757faf74e26f0a2e3914680a03092  seaweedfs-4.41-linux-amd64.tar.gz
-93c7539fe15a0aa6192d26ac2360003961f0643e302d910179d02341b10a7243df776294fb1b0134ec2a2a9596b1abc3ce9ab701f9bc3d78f2b965ea464a4b18  seaweedfs-4.31-linux-arm64.tar.gz
+20b7504c2efcfaab86e92ad336715f80e3653dc833e20c56f7cde545b57488374648d5155e47b4faaa95df92311a0675d368baa01e75a717c788a304655b29c7  seaweedfs-4.41-linux-arm64.tar.gz
 b6ce09d6d83dd70e2797a185171eea3587436fb024a99b4998f714b713244d6f768ef59f67c9b7251650d4f19d414eea231eab92099763d85cd92e41cb2bdc3f  credential.toml
 7105de7053654b8c0502521ce58585915fc831c3152801e1db02b1c5214dc3c3ed31f4fc18000665d8338c7a10ffbf0d248368bef2ef3a6d37d46cd856398366  example-credential.toml
-6213e9cff227d66a7a04237d15e2f77904f1bcdf5709fd985c1e12fe4aca0d0327db6997d567303eff47dabec3650db2a6d874b03adda41b239e04ee0c3557ee  example-filer.toml
+9e6401387698832cb4aae0876ef3e237c9b70af17db7563ed641ba40c81af99f1d6c22281bafa64fff7ee8d2c89f16ccac1322ea31c9a02b545faa4e09f08549  example-filer.toml
 e5753bd0bcc60dc84428c40ba556c08acae61dec083a5b76640125f637532e7c5759a72cdfd95114222a7a0901a916ec3c4d12f306853cfca0fe9a0b1857893e  example-master.toml
 2c200c28172a5d0b1c80ab28e849287e7af8d103355638fd3183b8614d3e2b1b3482132522663f7c6d844e10e13b8c6e23fb5fba0dec2cc83de45c2f17b33477  example-notification.toml
 4b507540d57799e42ec0ee84073c6fa32c577a2f4a98bf66ee7302355080c63c65d70709115185debdee3c957e9294e79a8e461347d7148af7fdd368dc548af6  example-replication.toml
-a0f307bc73b1aa03653c42c22a1fc704640cbd86957a417f947fe33356e03734c33782777cb1d6cb17360fc6b3930ffbe1386f89123e9dc3c21468210418aae2  example-security.toml
+6951e1110d458238b0ef1905c4c6bb874d06f1c18b83dd8e1742534806b8db68b4410a664bf53085781e5d4d35e87941279d9c7398529ee707bb99def5055591  example-security.toml
 70069f97edf261a2cd0669dd60adad80533609a25d7429254e0c3322d7e80337f5ff69a5581bc39e6a15442098d14d610ce5f0cb14f02c461c8d3dd440b22c56  example-shell.toml
 be5771a5e1bf626c53f9dffbfa2a400d9b8f9626d55a7b61dcd853753561989427ba872a2638a5e6343f44dea6790678483bd29101d6495dbbfcd3029947b9a7  filer.toml
 2cd6c73a5e23e0395b6f099dcc3acf9280cbb3e13f54408571e91741c4e6b0dad85f6d4e5a92f23ad541bad57ce295c28bb8450fe11da35acbd4da25848f61e5  master.toml

packaging/alpine/local/seaweedfs/README.md

@@ -1,6 +1,6 @@
 # SeaweedFS Alpine Package
 
-Repackages official SeaweedFS 4.31 Linux release tarballs for `x86_64` and
+Repackages official SeaweedFS 4.39 Linux release tarballs for `x86_64` and
 `aarch64`.
 
 ## Package Commands
@@ -127,5 +127,5 @@ rc-service seaweedfs.master restart
 Pin:
 
 ```sh
-apk add seaweedfs=4.31-r3
+apk add seaweedfs=4.39-r0
 ```

packaging/alpine/local/seaweedfs/example-filer.toml

@@ -366,6 +366,21 @@ healthcheck_enabled = false
 # increase the value is recommend, be sure the value in Elastic is greater or equal here
 index.max_result_window = 10000
 
+# for Elasticsearch 8.x clusters
+[elastic8]
+enabled = false
+servers = [
+    "http://localhost1:9200",
+    "http://localhost2:9200",
+    "http://localhost3:9200",
+]
+username = ""
+password = ""
+sniff_enabled = false
+healthcheck_enabled = false
+# increase the value is recommend, be sure the value in Elastic is greater or equal here
+index.max_result_window = 10000
+
 
 [arangodb] # in development dont use it
 enabled = false

packaging/alpine/local/seaweedfs/example-security.toml

@@ -4,6 +4,15 @@
 #    /etc/seaweedfs/security.toml
 # this file is read by master, volume server, filer, and worker
 
+# Any value below can also be supplied as an environment variable instead of
+# living in this file: prefix the key with WEED_, upper-case it, and replace
+# "." with "_". This is the recommended way to inject the secrets in here from
+# a Kubernetes Secret (env valueFrom.secretKeyRef) rather than a ConfigMap.
+# The JWT signing keys map to:
+#   WEED_JWT_SIGNING_KEY, WEED_JWT_SIGNING_READ_KEY              (master <-> volume)
+#   WEED_JWT_FILER_SIGNING_KEY, WEED_JWT_FILER_SIGNING_READ_KEY  (s3/clients <-> filer)
+# A set env var wins over the file, so the file can stay empty (or absent).
+
 # comma separated origins allowed to make requests to the filer and s3 gateway.
 # enter in this format: https://domain.com, or http://localhost:port
 [cors.allowed_origins]

packaging/alpine/local/seaweedfs/scripts/test-install.sh

@@ -2,38 +2,10 @@
 set -euo pipefail
 
 repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
-package_name="${PACKAGE_NAME:-seaweedfs}"
+# shellcheck source=scripts/apk/test-install-lib.sh
-alpine_version="${ALPINE_VERSION:-3.24}"
+. "${repo_root}/scripts/apk/test-install-lib.sh"
-arch="${ALPINE_ARCH:-x86_64}"
 
-case "${arch}" in
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-seaweedfs}" "${PACKAGE_VERSION:-}" <<'SCRIPT'
-  x86_64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/amd64}"
-    ;;
-  aarch64)
-    platform="${ALPINE_TEST_PLATFORM:-linux/arm64}"
-    ;;
-  *)
-    printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2
-    exit 2
-    ;;
-esac
-
-if [[ "${SKIP_BUILD:-0}" != "1" ]]; then
-  ALPINE_PACKAGE="${package_name}" "${repo_root}/scripts/apk/build.sh" build "${arch}"
-fi
-
-if [[ ! -d "${repo_root}/packages/local/${arch}" ]]; then
-  printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
-  printf 'run: ALPINE_PACKAGE=%s mise run apk:build\n' "${package_name}" >&2
-  exit 1
-fi
-
-docker run --rm --platform "${platform}" \
-  -e "ALPINE_ARCH=${arch}" \
-  -v "${repo_root}/packages/local:/repo:ro" \
-  "alpine:${alpine_version}" \
-  sh -lc '
     set -e
 
     cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
@@ -70,4 +42,4 @@ docker run --rm --platform "${platform}" \
     test -d /usr/share/doc/seaweedfs/examples
     test -f /usr/share/doc/seaweedfs/examples/master.toml
     test -f /usr/share/bash-completion/completions/weed
-  '
+SCRIPT

packaging/alpine/local/seaweedfs/scripts/update-generated-sources.sh

@@ -1,15 +1,41 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
 package_dir="${PACKAGE_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
 configs=(credential filer master notification replication security shell)
+pkgver="$(
+  awk -F= '$1 == "pkgver" { print $2; exit }' "${package_dir}/APKBUILD"
+)"
+tmpdir="$(mktemp -d)"
+
+cleanup() {
+  rm -rf "${tmpdir}"
+}
+trap cleanup EXIT
+
+case "$(uname -m)" in
+  x86_64)
+    archive="linux_amd64.tar.gz"
+    ;;
+  aarch64|arm64)
+    archive="linux_arm64.tar.gz"
+    ;;
+  *)
+    printf 'unsupported host architecture for SeaweedFS generated sources: %s\n' "$(uname -m)" >&2
+    exit 2
+    ;;
+esac
+
+curl -fsSL \
+  -o "${tmpdir}/${archive}" \
+  "https://github.com/seaweedfs/seaweedfs/releases/download/${pkgver}/${archive}"
+tar -xzf "${tmpdir}/${archive}" -C "${tmpdir}" weed
 
 for config in "${configs[@]}"; do
-  "${repo_root}/bin/weed" scaffold -config "${config}" 2>/dev/null \
+  "${tmpdir}/weed" scaffold -config "${config}" 2>/dev/null \
     > "${package_dir}/example-${config}.toml"
 done
 
-"${repo_root}/bin/weed" autocomplete bash 2>/dev/null \
+"${tmpdir}/weed" autocomplete bash 2>/dev/null \
   | sed -E 's#complete -C "?[^"]*/weed"? weed#complete -C /usr/bin/weed weed#' \
     > "${package_dir}/weed.bash-completion"

packaging/alpine/local/seaweedfs/update-check.conf

@@ -0,0 +1,3 @@
+provider=github
+repo=seaweedfs/seaweedfs
+version_prefix=none

scripts/apk/build.sh

@@ -19,6 +19,8 @@ if [[ "${builder_gid}" == "0" ]]; then
   builder_gid=1000
 fi
 
+image_name="${ALPINE_APK_BUILDER_IMAGE:-alpine-apk-builder:${alpine_version}-${builder_uid}-${builder_gid}}"
+
 cache_scope_from_remote() {
   local remote
   local path
@@ -63,7 +65,6 @@ run_for_arch() {
   local arch="$1"
   local subcommand="$2"
   local package_dir="$3"
-  local image_name
   local container_package_dir
   local package_name
   local cache_scope
@@ -73,19 +74,9 @@ run_for_arch() {
   apk_validate_package_dir "${package_dir}"
   package_name="$(apk_package_name "${package_dir}")"
   container_package_dir="$(apk_container_package_dir "${repo_root}" "${package_dir}")"
-  image_name="${ALPINE_APK_BUILDER_IMAGE:-alpine-apk-builder:${arch}}"
   cache_scope="${ALPINE_APK_CACHE_SCOPE:-$(cache_scope_from_remote)}"
   cache_prefix="${ALPINE_APK_CACHE_PREFIX:-alpine-apk}-${cache_scope}-${package_name}-${arch}"
 
-  docker build \
-    --platform "${build_platform}" \
-    --build-arg "ALPINE_VERSION=${alpine_version}" \
-    --build-arg "BUILDER_UID=${builder_uid}" \
-    --build-arg "BUILDER_GID=${builder_gid}" \
-    -f "${repo_root}/scripts/apk/Dockerfile" \
-    -t "${image_name}" \
-    "${repo_root}"
-
   docker_args=(--rm --platform "${build_platform}")
   if [[ -t 0 && -t 1 ]]; then
     docker_args+=(-it)
@@ -98,7 +89,7 @@ run_for_arch() {
     -e "APKBUILD_DIR=${container_package_dir}" \
     -e "CARGO_HOME=/home/builder/.cache/cargo" \
     -e "CARGO_TARGET_DIR=/home/builder/.cache/cargo-target" \
-    -e "PACKAGER=${PACKAGER:-Joachim Schlöffel <me@joachim-schloeffel.com>}" \
+    -e "PACKAGER=${PACKAGER:-local}" \
     -e "RUSTUP_HOME=/home/builder/.cache/rustup" \
     -v "${cache_prefix}-cargo:/home/builder/.cache/cargo" \
     -v "${cache_prefix}-cargo-target:/home/builder/.cache/cargo-target" \
@@ -111,11 +102,33 @@ run_for_arch() {
     "${subcommand}"
 }
 
+build_builder_image() {
+  docker build \
+    --platform "${build_platform}" \
+    --build-arg "ALPINE_VERSION=${alpine_version}" \
+    --build-arg "BUILDER_UID=${builder_uid}" \
+    --build-arg "BUILDER_GID=${builder_gid}" \
+    -f "${repo_root}/scripts/apk/Dockerfile" \
+    -t "${image_name}" \
+    "${repo_root}"
+}
+
 mkdir -p \
   "${repo_root}/.cache/abuild" \
   "${repo_root}/.cache/apk-distfiles" \
   "${repo_root}/packages"
 
+case "${command_name}" in
+  build-all|build|checksum|lint|shell) ;;
+  *)
+    printf 'unknown command: %s\n' "${command_name}" >&2
+    printf 'usage: %s [build|build-all|checksum|lint|shell] [x86_64|aarch64]\n' "$0" >&2
+    exit 2
+    ;;
+esac
+
+build_builder_image
+
 case "${command_name}" in
   build-all)
     while IFS= read -r package_dir; do

scripts/apk/ci-build.sh

@@ -2,12 +2,19 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/apk/package-lib.sh
 . "${repo_root}/scripts/apk/package-lib.sh"
 
 repo_name="${ALPINE_REPO_NAME:-local}"
 arches="${ALPINE_ARCHES:-x86_64 aarch64}"
-packager="${PACKAGER:-Joachim Schlöffel <me@joachim-schloeffel.com>}"
+packager="${PACKAGER:-local}"
 selected_packages="${ALPINE_PACKAGE:-${ALPINE_PACKAGES:-}}"
+skip_build="${ALPINE_SKIP_BUILD:-0}"
+
+if [[ "${skip_build}" == "1" ]]; then
+  printf 'Skipping package build: restored package cache is complete\n'
+  exit 0
+fi
 
 if [[ "${1:-}" != "--as-builder" && "$(id -u)" == "0" ]]; then
   addgroup -g 1000 builder 2>/dev/null || addgroup builder
@@ -24,6 +31,15 @@ export PACKAGER="${packager}"
 export REPODEST="${repo_root}/packages"
 export SRCDEST="${repo_root}/.cache/apk-distfiles"
 
+install_repo_keys() {
+  local key
+  shopt -s nullglob
+  for key in "${REPODEST}/${repo_name}"/*/*.rsa.pub; do
+    doas cp "${key}" /etc/apk/keys/
+  done
+  shopt -u nullglob
+}
+
 git config --global --add safe.directory "${repo_root}"
 mkdir -p "${repo_root}/.cache/abuild" "${SRCDEST}" "${REPODEST}" "${HOME}/.abuild"
 
@@ -37,6 +53,7 @@ if ! compgen -G "${HOME}/.abuild/*.rsa" > /dev/null; then
 fi
 
 doas cp "${HOME}"/.abuild/*.rsa.pub /etc/apk/keys/
+install_repo_keys
 doas apk update
 
 while IFS= read -r package_dir; do
@@ -55,10 +72,8 @@ while IFS= read -r package_dir; do
 
     printf 'Building %s for %s\n' "$(basename "${package_dir}")" "${arch}"
     (
-      export ALPINE_ARCH="${arch}"
-      export CARCH="${arch}"
       cd "${package_dir}"
-      abuild -r
+      ALPINE_ARCH="${arch}" CARCH="${arch}" abuild -r
     )
 
     mkdir -p "${REPODEST}/${repo_name}/${arch}"

scripts/apk/ci-package-cache.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/apk/package-lib.sh
+. "${repo_root}/scripts/apk/package-lib.sh"
+
+repo_name="${ALPINE_REPO_NAME:-local}"
+arches="${ALPINE_ARCHES:-x86_64 aarch64}"
+cache_root="${ALPINE_APK_REPO_CACHE:-/cache/public-alpine-packages/${ALPINE_REGISTRY_BRANCH:-local}/apk-repo}"
+repo_dest="${repo_root}/packages/${repo_name}"
+command_name="${1:-prepare}"
+
+all_packages() {
+  while IFS= read -r package_dir; do
+    apk_package_name "${package_dir}"
+  done < <(apk_all_package_dirs "${repo_root}")
+}
+
+mark_all_packages() {
+  local reason="$1"
+
+  printf 'Rebuilding all packages: %s\n' "${reason}" >&2
+  all_packages
+}
+
+diff_base() {
+  local before="${GITHUB_EVENT_BEFORE:-${CI_COMMIT_BEFORE_SHA:-}}"
+  local base_ref="${GITHUB_BASE_REF:-}"
+
+  if [[ -n "${base_ref}" ]] && git rev-parse --verify "origin/${base_ref}" >/dev/null 2>&1; then
+    printf '%s...HEAD\n' "origin/${base_ref}"
+    return
+  fi
+
+  if [[ -n "${before}" && ! "${before}" =~ ^0+$ ]] && git rev-parse --verify "${before}^{commit}" >/dev/null 2>&1; then
+    printf '%s..HEAD\n' "${before}"
+    return
+  fi
+
+  if git rev-parse --verify "HEAD^" >/dev/null 2>&1; then
+    printf 'HEAD^..HEAD\n'
+    return
+  fi
+
+  return 1
+}
+
+changed_packages() {
+  local base
+  local changed_paths
+  local changed_path
+  local package
+  declare -A selected=()
+
+  if ! base="$(diff_base)"; then
+    mark_all_packages "no usable git diff base"
+    return
+  fi
+
+  if ! changed_paths="$(git diff --name-only "${base}")"; then
+    mark_all_packages "git diff failed for ${base}"
+    return
+  fi
+
+  while IFS= read -r changed_path; do
+    [[ -n "${changed_path}" ]] || continue
+    case "${changed_path}" in
+      scripts/apk/*|.gitea/workflows/build.yml|mise.toml)
+        mark_all_packages "shared build logic changed"
+        return
+        ;;
+      packaging/alpine/local/*)
+        package="${changed_path#packaging/alpine/local/}"
+        package="${package%%/*}"
+        selected["${package}"]=1
+        ;;
+    esac
+  done <<< "${changed_paths}"
+
+  for package in "${!selected[@]}"; do
+    printf '%s\n' "${package}"
+  done | sort
+}
+
+restore_cache() {
+  if [[ -d "${cache_root}" ]]; then
+    mkdir -p "${repo_dest}"
+    cp -a "${cache_root}/." "${repo_dest}/"
+    printf 'Restored Alpine package repository cache from %s\n' "${cache_root}"
+  else
+    printf 'No Alpine package repository cache found at %s\n' "${cache_root}"
+  fi
+}
+
+package_apk_names() {
+  local package_dir="$1"
+  local arch="$2"
+
+  apk_package_apk_names "${package_dir}" "${arch}"
+}
+
+package_cache_complete() {
+  local package_dir="$1"
+  local package_name
+  local arch
+  local apk_name
+
+  package_name="$(apk_package_name "${package_dir}")"
+
+  for arch in ${arches}; do
+    case "${arch}" in
+      x86_64|aarch64) ;;
+      *) printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2; exit 2 ;;
+    esac
+
+    if ! apk_package_supports_arch "${package_dir}" "${arch}"; then
+      continue
+    fi
+
+    while IFS= read -r apk_name; do
+      if [[ ! -f "${repo_dest}/${arch}/${apk_name}" ]]; then
+        printf 'Cache miss for %s: missing %s/%s\n' "${package_name}" "${arch}" "${apk_name}" >&2
+        return 1
+      fi
+    done < <(package_apk_names "${package_dir}" "${arch}")
+  done
+
+  return 0
+}
+
+select_missing_packages() {
+  local package_dir
+  local package_name
+
+  while IFS= read -r package_dir; do
+    apk_validate_package_dir "${package_dir}"
+    package_name="$(apk_package_name "${package_dir}")"
+    if ! package_cache_complete "${package_dir}"; then
+      printf '%s\n' "${package_name}"
+    fi
+  done < <(apk_all_package_dirs "${repo_root}")
+}
+
+prune_stale_apks() {
+  local package_dir
+  local arch
+  local apk_name
+  local current_apk
+  declare -A expected_apks=()
+
+  if [[ ! -d "${repo_dest}" ]]; then
+    return
+  fi
+
+  while IFS= read -r package_dir; do
+    apk_validate_package_dir "${package_dir}"
+    for arch in ${arches}; do
+      case "${arch}" in
+        x86_64|aarch64) ;;
+        *) printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2; exit 2 ;;
+      esac
+
+      if ! apk_package_supports_arch "${package_dir}" "${arch}"; then
+        continue
+      fi
+
+      while IFS= read -r apk_name; do
+        expected_apks["${repo_dest}/${arch}/${apk_name}"]=1
+      done < <(package_apk_names "${package_dir}" "${arch}")
+    done
+  done < <(apk_all_package_dirs "${repo_root}")
+
+  shopt -s nullglob
+  for current_apk in "${repo_dest}"/*/*.apk; do
+    if [[ -z "${expected_apks[${current_apk}]:-}" ]]; then
+      rm -f "${current_apk}"
+      printf 'Pruned stale cached APK: %s\n' "${current_apk#"${repo_root}/"}"
+    fi
+  done
+  shopt -u nullglob
+}
+
+prepare() {
+  local selected_packages
+  local selected
+  declare -A selected_map=()
+
+  restore_cache
+  prune_stale_apks
+
+  while IFS= read -r selected; do
+    [[ -n "${selected}" ]] || continue
+    selected_map["${selected}"]=1
+  done < <(changed_packages)
+
+  while IFS= read -r selected; do
+    [[ -n "${selected}" ]] || continue
+    selected_map["${selected}"]=1
+  done < <(select_missing_packages)
+
+  selected_packages="$(
+    for selected in "${!selected_map[@]}"; do
+      printf '%s\n' "${selected}"
+    done | sort | xargs
+  )"
+
+  if [[ -n "${selected_packages}" ]]; then
+    printf 'Selected packages for rebuild: %s\n' "${selected_packages}"
+    export ALPINE_PACKAGES="${selected_packages}"
+    export ALPINE_SKIP_BUILD=0
+  else
+    printf 'No packages selected for rebuild\n'
+    export ALPINE_PACKAGES=""
+    export ALPINE_SKIP_BUILD=1
+  fi
+
+  if [[ -n "${GITHUB_ENV:-}" ]]; then
+    {
+      printf 'ALPINE_PACKAGES=%s\n' "${ALPINE_PACKAGES}"
+      printf 'ALPINE_SKIP_BUILD=%s\n' "${ALPINE_SKIP_BUILD}"
+    } >> "${GITHUB_ENV}"
+  fi
+}
+
+sync_cache() {
+  if [[ ! -d "${repo_dest}" ]]; then
+    printf 'missing package repository: %s\n' "${repo_dest}" >&2
+    exit 1
+  fi
+
+  prune_stale_apks
+  mkdir -p "${cache_root}"
+  rsync -a --delete "${repo_dest}/" "${cache_root}/"
+  printf 'Updated Alpine package repository cache at %s\n' "${cache_root}"
+}
+
+case "${command_name}" in
+  prepare)
+    prepare
+    ;;
+  sync)
+    sync_cache
+    ;;
+  *)
+    printf 'usage: %s [prepare|sync]\n' "$0" >&2
+    exit 2
+    ;;
+esac

scripts/apk/ci-smoke.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 repo_name="${ALPINE_REPO_NAME:-local}"
 arch="${ALPINE_ARCH:-$(apk --print-arch)}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
 repo_dir="${repo_root}/packages/${repo_name}/${arch}"
 read -r -a package_list <<< "${packages}"
 
@@ -29,9 +29,17 @@ if command -v lavinmq >/dev/null 2>&1; then
   lavinmqctl --version
   lavinmqperf --version
 fi
+if command -v gitea >/dev/null 2>&1; then
+  gitea --version
+  test -f /etc/gitea/app.ini
+  test -d /var/lib/gitea
+fi
 if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
   find /etc/init.d -maxdepth 1 -name 'seaweedfs.*' -print | sort
 fi
 if [[ -f /etc/init.d/lavinmq ]]; then
   printf '%s\n' /etc/init.d/lavinmq
 fi
+if [[ -f /etc/init.d/gitea ]]; then
+  printf '%s\n' /etc/init.d/gitea
+fi

scripts/apk/container-entrypoint.sh

@@ -7,7 +7,7 @@ repo_name="${ALPINE_REPO_NAME:-local}"
 arch="${ALPINE_ARCH:-x86_64}"
 
 export CARCH="${CARCH:-$arch}"
-export PACKAGER="${PACKAGER:-Joachim Schlöffel <me@joachim-schloeffel.com>}"
+export PACKAGER="${PACKAGER:-local}"
 if [[ -n "${PACKAGER_PRIVKEY:-}" ]]; then
   export PACKAGER_PRIVKEY
 fi
@@ -15,6 +15,15 @@ fi
 git config --global --add safe.directory /work
 mkdir -p /home/builder/.abuild /home/builder/packages "${package_dir}"
 
+install_repo_keys() {
+  local key
+  shopt -s nullglob
+  for key in "/home/builder/packages/${repo_name}"/*/*.rsa.pub; do
+    doas cp "${key}" /etc/apk/keys/
+  done
+  shopt -u nullglob
+}
+
 if [[ -n "${PACKAGER_PRIVKEY:-}" && ! -f "${PACKAGER_PRIVKEY}" ]]; then
   abuild-keygen -a -n
 elif ! compgen -G "/home/builder/.abuild/*.rsa" > /dev/null; then
@@ -34,6 +43,7 @@ if [[ -n "${PACKAGER_PRIVKEY:-}" && -f "${PACKAGER_PRIVKEY}.pub" ]]; then
 elif compgen -G "/home/builder/.abuild/*.rsa.pub" > /dev/null; then
   doas cp /home/builder/.abuild/*.rsa.pub /etc/apk/keys/
 fi
+install_repo_keys
 
 case "${command_name}" in
   build)

scripts/apk/lint-shell.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+shellcheck \
+  "${repo_root}"/scripts/apk/*.sh \
+  "${repo_root}"/packaging/alpine/local/*/scripts/*.sh

scripts/apk/list-packages.sh

@@ -2,7 +2,25 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/apk/package-lib.sh
+. "${repo_root}/scripts/apk/package-lib.sh"
+
 repo_dir="${repo_root}/packages/local"
+arches="${ALPINE_ARCHES:-x86_64 aarch64}"
+declare -A expected_apks=()
+
+while IFS= read -r package_source_dir; do
+  apk_validate_package_dir "${package_source_dir}"
+  for arch in ${arches}; do
+    if ! apk_package_supports_arch "${package_source_dir}" "${arch}"; then
+      continue
+    fi
+
+    while IFS= read -r apk_name; do
+      expected_apks["${repo_dir}/${arch}/${apk_name}"]=1
+    done < <(apk_package_apk_names "${package_source_dir}" "${arch}")
+  done
+done < <(apk_all_package_dirs "${repo_root}")
 
 if [[ -n "${ALPINE_ARCH:-}" ]]; then
   package_dirs=("${repo_dir}/${ALPINE_ARCH}")
@@ -29,6 +47,10 @@ for package_dir in "${package_dirs[@]}"; do
 
   printf '## %s\n' "$(basename "${package_dir}")"
   for apk in "${apks[@]}"; do
+    if [[ -z "${expected_apks[${apk}]:-}" ]]; then
+      printf 'Skipping stale local APK: %s\n' "${apk#"${repo_root}/"}"
+      continue
+    fi
     printf '### %s\n' "$(basename "${apk}")"
     tar -xOf "${apk}" .PKGINFO 2>/dev/null \
       | sed -n '/^pkgname =/p;/^pkgver =/p;/^arch =/p;/^depend =/p;/^provides =/p;/^install_if =/p'

scripts/apk/outdated.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/apk/package-lib.sh
+source "${repo_root}/scripts/apk/package-lib.sh"
+
+mode="${APK_UPDATE_CHECK_MODE:-warn}"
+if [[ "${mode}" != "warn" && "${mode}" != "fail" ]]; then
+  printf 'APK_UPDATE_CHECK_MODE must be warn or fail\n' >&2
+  exit 2
+fi
+
+github_latest_release() {
+  local repo="$1"
+  local api_url="https://api.github.com/repos/${repo}/releases/latest"
+  local response
+
+  response="$(curl -fsSL \
+    -H 'Accept: application/vnd.github+json' \
+    -H 'X-GitHub-Api-Version: 2022-11-28' \
+    "${api_url}" 2>/dev/null)" || return 1
+
+  printf '%s\n' "${response}" \
+    | sed -n 's/^[[:space:]]*"tag_name":[[:space:]]*"\([^"]*\)".*/\1/p' \
+    | head -n 1
+}
+
+apkbuild_value() {
+  local package_dir="$1"
+  local key="$2"
+
+  awk -F= -v key="${key}" '
+    $1 == key {
+      value = $2
+      gsub(/["'\'']/, "", value)
+      gsub(/^[ \t]+|[ \t]+$/, "", value)
+      print value
+      exit
+    }
+  ' "${package_dir}/APKBUILD"
+}
+
+load_update_metadata() {
+  local package_dir="$1"
+  local metadata="${package_dir}/update-check.conf"
+
+  provider=""
+  repo=""
+  version_prefix="v"
+
+  if [[ ! -f "${metadata}" ]]; then
+    return 1
+  fi
+
+  # shellcheck source=/dev/null
+  source "${metadata}"
+
+  if [[ "${provider}" != "github" || -z "${repo}" ]]; then
+    return 1
+  fi
+}
+
+normalize_version() {
+  local version="$1"
+  local prefix="$2"
+
+  case "${prefix}" in
+    none|"")
+      printf '%s\n' "${version}"
+      ;;
+    *)
+      printf '%s\n' "${version#"${prefix}"}"
+      ;;
+  esac
+}
+
+version_is_newer() {
+  local latest="$1"
+  local current="$2"
+  local apk_result
+  local sorted
+
+  if [[ "${latest}" == "${current}" ]]; then
+    return 1
+  fi
+
+  if command -v apk >/dev/null 2>&1; then
+    apk_result="$(apk version -t "${latest}-r0" "${current}-r0" 2>/dev/null || true)"
+    [[ "${apk_result}" == ">" ]]
+    return
+  fi
+
+  if sort -V </dev/null >/dev/null 2>&1; then
+    sorted="$(printf '%s\n%s\n' "${current}" "${latest}" | sort -V | tail -n 1)"
+    [[ "${sorted}" == "${latest}" && "${latest}" != "${current}" ]]
+    return
+  fi
+
+  return 0
+}
+
+printf '%-14s %-14s %-14s %-18s %s\n' "PACKAGE" "CURRENT" "LATEST" "STATUS" "UPSTREAM"
+
+has_update=0
+has_unknown=0
+
+while IFS= read -r package_dir; do
+  apk_validate_package_dir "${package_dir}"
+
+  package_name="$(apk_package_name "${package_dir}")"
+  current_version="$(apkbuild_value "${package_dir}" "pkgver")"
+  status="unknown"
+  latest_version="-"
+  upstream_url="-"
+
+  if load_update_metadata "${package_dir}"; then
+    upstream_url="https://github.com/${repo}/releases"
+    if latest_tag="$(github_latest_release "${repo}")" && [[ -n "${latest_tag}" ]]; then
+      latest_version="$(normalize_version "${latest_tag}" "${version_prefix}")"
+      if version_is_newer "${latest_version}" "${current_version}"; then
+        status="update-available"
+        has_update=1
+      else
+        status="current"
+      fi
+    else
+      has_unknown=1
+    fi
+  else
+    has_unknown=1
+  fi
+
+  printf '%-14s %-14s %-14s %-18s %s\n' \
+    "${package_name}" \
+    "${current_version:-"-"}" \
+    "${latest_version}" \
+    "${status}" \
+    "${upstream_url}"
+done < <(apk_package_dirs "${repo_root}")
+
+if [[ "${mode}" == "fail" && ( "${has_update}" -ne 0 || "${has_unknown}" -ne 0 ) ]]; then
+  exit 1
+fi

scripts/apk/package-lib.sh

@@ -37,6 +37,14 @@ apk_package_dirs() {
     return
   fi
 
+  apk_all_package_dirs "${repo_root}"
+}
+
+apk_all_package_dirs() {
+  local repo_root="$1"
+  local package_root
+
+  package_root="$(apk_package_root "${repo_root}")"
   find "${package_root}" -mindepth 2 -maxdepth 2 -name APKBUILD -print \
     | sed 's#/APKBUILD$##' \
     | sort
@@ -87,6 +95,30 @@ apk_package_supports_arch() {
   return 1
 }
 
+apk_package_apk_names() {
+  local package_dir="$1"
+  local arch="$2"
+
+  (
+    set +u
+    local pkgname
+    local pkgver
+    local pkgrel
+    local subpackage
+    local subpackages
+    export CARCH="${arch}"
+    cd "${package_dir}" || exit 1
+    # shellcheck source=/dev/null
+    . ./APKBUILD
+
+    printf '%s-%s-r%s.apk\n' "${pkgname}" "${pkgver}" "${pkgrel}"
+    for subpackage in ${subpackages:-}; do
+      subpackage="${subpackage%%:*}"
+      printf '%s-%s-r%s.apk\n' "${subpackage}" "${pkgver}" "${pkgrel}"
+    done
+  )
+}
+
 apk_container_package_dir() {
   local repo_root="$1"
   local package_dir="$2"

scripts/apk/publish-check.sh

@@ -4,7 +4,9 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 
 cd "${repo_root}"
+mise run apk:outdated
 mise run apk:lint
+mise run apk:lint-shell
 mise run apk:build-all
 mise run apk:packages
 mise run apk:smoke

scripts/apk/publish-gitea.sh

@@ -2,8 +2,12 @@
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=scripts/apk/package-lib.sh
+. "${repo_root}/scripts/apk/package-lib.sh"
+
 repo_name="${ALPINE_REPO_NAME:-local}"
 alpine_version="${ALPINE_VERSION:-3.24}"
+arches="${ALPINE_ARCHES:-x86_64 aarch64}"
 branch="${ALPINE_REGISTRY_BRANCH:-v${alpine_version}}"
 repository="${ALPINE_REGISTRY_REPOSITORY:-${PACKAGE_NAME:-main}}"
 instance_url="${INSTANCE_URL:-}"
@@ -46,23 +50,42 @@ if [[ "${#apks[@]}" -eq 0 ]]; then
   exit 1
 fi
 
-declare -A published_filenames=()
+declare -A expected_apks=()
-unique_apks=()
+while IFS= read -r package_dir; do
-for apk in "${apks[@]}"; do
+  apk_validate_package_dir "${package_dir}"
-  filename="$(basename "${apk}")"
+  for arch in ${arches}; do
-  if [[ -n "${published_filenames[${filename}]:-}" ]]; then
+    if ! apk_package_supports_arch "${package_dir}" "${arch}"; then
       continue
     fi
-  published_filenames["${filename}"]=1
+
-  unique_apks+=("${apk}")
+    while IFS= read -r apk_name; do
+      expected_apks["${package_root}/${arch}/${apk_name}"]=1
+    done < <(apk_package_apk_names "${package_dir}" "${arch}")
+  done
+done < <(apk_all_package_dirs "${repo_root}")
+
+current_apks=()
+stale_count=0
+for apk in "${apks[@]}"; do
+  if [[ -z "${expected_apks[${apk}]:-}" ]]; then
+    printf 'Skipping stale local APK: %s\n' "${apk#"${repo_root}/"}"
+    stale_count=$((stale_count + 1))
+    continue
+  fi
+  current_apks+=("${apk}")
 done
 
-printf 'Publishing %d APK files to %s\n' "${#unique_apks[@]}" "${upload_url}"
+if [[ "${#current_apks[@]}" -eq 0 ]]; then
-if [[ "${#unique_apks[@]}" -ne "${#apks[@]}" ]]; then
+  printf 'no current APK files found under %s\n' "${package_root}" >&2
-  printf 'Skipping %d duplicate local APK filename(s)\n' "$((${#apks[@]} - ${#unique_apks[@]}))"
+  exit 1
 fi
 
-for apk in "${unique_apks[@]}"; do
+printf 'Publishing %d APK files to %s\n' "${#current_apks[@]}" "${upload_url}"
+if [[ "${stale_count}" -ne 0 ]]; then
+  printf 'Skipping %d stale local APK file(s)\n' "${stale_count}"
+fi
+
+for apk in "${current_apks[@]}"; do
   filename="$(basename "${apk}")"
   status="$(
     curl --silent --show-error --location \

scripts/apk/runtime-test.Dockerfile

@@ -0,0 +1,4 @@
+ARG ALPINE_VERSION=3.24
+FROM alpine:${ALPINE_VERSION}
+
+RUN apk add --no-cache bash openrc

scripts/apk/runtime-test.sh

@@ -10,6 +10,7 @@ arch="${ALPINE_ARCH:-x86_64}"
 platform="${ALPINE_TEST_PLATFORM:-linux/amd64}"
 repo_dir="${repo_root}/packages/${repo_name}/${arch}"
 runtime_mode="${ALPINE_RUNTIME_TEST_MODE:-auto}"
+runtime_image="${ALPINE_RUNTIME_TEST_IMAGE:-alpine-apk-runtime-test:${alpine_version}}"
 
 validate_repo() {
   if [[ ! -d "${repo_dir}" ]]; then
@@ -66,10 +67,9 @@ run_hook_docker() {
     -e "PACKAGE_NAME=${package_name}" \
     -v "${repo_root}:/work:ro" \
     -v "${repo_root}/packages/${repo_name}:/repo:ro" \
-    "alpine:${alpine_version}" \
+    "${runtime_image}" \
     sh -lc '
       set -e
-      apk add --no-cache bash openrc >/dev/null
       cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
       printf "%s\n" /repo >> /etc/apk/repositories
       apk update
@@ -79,6 +79,15 @@ run_hook_docker() {
     '
 }
 
+build_runtime_image() {
+  docker build \
+    --platform "${platform}" \
+    --build-arg "ALPINE_VERSION=${alpine_version}" \
+    -f "${repo_root}/scripts/apk/runtime-test.Dockerfile" \
+    -t "${runtime_image}" \
+    "${repo_root}"
+}
+
 validate_repo
 
 case "${runtime_mode}" in
@@ -99,6 +108,8 @@ esac
 
 if [[ "${runtime_mode}" == "direct" ]]; then
   prepare_direct_runtime
+else
+  build_runtime_image
 fi
 
 while IFS= read -r package_dir; do

scripts/apk/smoke.sh

@@ -5,7 +5,7 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 alpine_version="${ALPINE_VERSION:-3.24}"
 platform="${ALPINE_BUILD_PLATFORM:-linux/amd64}"
 arch="${ALPINE_ARCH:-x86_64}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
 
 if [[ ! -d "${repo_root}/packages/local/${arch}" ]]; then
   printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
@@ -34,10 +34,18 @@ docker run --rm --platform "${platform}" \
       lavinmqctl --version
       lavinmqperf --version
     fi
+    if command -v gitea >/dev/null 2>&1; then
+      gitea --version
+      test -f /etc/gitea/app.ini
+      test -d /var/lib/gitea
+    fi
     if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
       ls -1 /etc/init.d/seaweedfs.* | sort
     fi
     if [ -f /etc/init.d/lavinmq ]; then
       ls -1 /etc/init.d/lavinmq
     fi
+    if [ -f /etc/init.d/gitea ]; then
+      ls -1 /etc/init.d/gitea
+    fi
   "

scripts/apk/test-install-lib.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+apk_test_install_run() {
+  local repo_root="$1"
+  local package_name="$2"
+  local package_version="$3"
+  local alpine_version="${ALPINE_VERSION:-3.24}"
+  local arch="${ALPINE_ARCH:-x86_64}"
+  local repository_url="${ALPINE_REPOSITORY_URL:-}"
+  local repository_key_url="${ALPINE_REPOSITORY_KEY_URL:-}"
+  local platform
+  local test_command
+
+  case "${arch}" in
+    x86_64) platform="${ALPINE_TEST_PLATFORM:-linux/amd64}" ;;
+    aarch64) platform="${ALPINE_TEST_PLATFORM:-linux/arm64}" ;;
+    *)
+      printf 'unsupported Alpine architecture: %s\n' "${arch}" >&2
+      return 2
+      ;;
+  esac
+
+  if [[ -z "${repository_url}" && "${SKIP_BUILD:-0}" != "1" ]]; then
+    ALPINE_PACKAGE="${package_name}" "${repo_root}/scripts/apk/build.sh" build "${arch}"
+  fi
+
+  if [[ -z "${repository_url}" && ! -d "${repo_root}/packages/local/${arch}" ]]; then
+    printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
+    printf 'run: ALPINE_PACKAGE=%s mise run apk:build\n' "${package_name}" >&2
+    return 1
+  fi
+
+  test_command="$(cat)"
+  docker run --rm --platform "${platform}" \
+    -e "ALPINE_ARCH=${arch}" \
+    -e "PACKAGE_NAME=${package_name}" \
+    -e "PACKAGE_VERSION=${package_version}" \
+    -e "ALPINE_REPOSITORY_URL=${repository_url}" \
+    -e "ALPINE_REPOSITORY_KEY_URL=${repository_key_url}" \
+    -v "${repo_root}/packages/local:/repo:ro" \
+    "alpine:${alpine_version}" \
+    sh -lc "${test_command}"
+}

scripts/apk/test-shell.sh

@@ -5,8 +5,8 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 alpine_version="${ALPINE_VERSION:-3.24}"
 platform="${ALPINE_BUILD_PLATFORM:-linux/amd64}"
 arch="${ALPINE_ARCH:-x86_64}"
-packages="${TEST_SHELL_PACKAGES:-seaweedfs seaweedfs-doc bash-completion seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-doc lavinmq-openrc}"
+packages="${TEST_SHELL_PACKAGES:-}"
-shell="${TEST_SHELL:-/bin/bash}"
+shell="${TEST_SHELL:-/bin/sh}"
 timeout_seconds="${TEST_SHELL_TIMEOUT:-120}"
 
 case "${arch}" in
@@ -24,9 +24,23 @@ if [[ ! -d "${repo_root}/packages/local/${arch}" ]]; then
   exit 1
 fi
 
-docker_args=(--rm --platform "${platform}")
+shopt -s nullglob
+repo_keys=("${repo_root}/packages/local/${arch}"/*.rsa.pub)
+repo_indexes=("${repo_root}/packages/local/${arch}"/APKINDEX.tar.gz)
+shopt -u nullglob
+
+if [[ "${#repo_keys[@]}" -eq 0 ]]; then
+  printf 'missing repository key: packages/local/%s/*.rsa.pub\n' "${arch}" >&2
+  exit 1
+fi
+if [[ "${#repo_indexes[@]}" -eq 0 ]]; then
+  printf 'missing repository index: packages/local/%s/APKINDEX.tar.gz\n' "${arch}" >&2
+  exit 1
+fi
+
+docker_args=(--rm -i --platform "${platform}")
 if [[ -t 0 && -t 1 ]]; then
-  docker_args+=(-it)
+  docker_args+=(-t)
 fi
 
 docker run "${docker_args[@]}" \
@@ -46,26 +60,25 @@ docker run "${docker_args[@]}" \
     printf "Refreshing apk indexes...\n"
     timeout "${TEST_SHELL_TIMEOUT}" apk update
 
-    printf "Installing test packages: %s\n" "${PACKAGE_LIST}"
+    if [ -n "${PACKAGE_LIST}" ]; then
+      printf "Installing requested test packages: %s\n" "${PACKAGE_LIST}"
       timeout "${TEST_SHELL_TIMEOUT}" apk add ${PACKAGE_LIST}
+    fi
 
-    printf "\nInstalled default test packages:\n"
+    cat <<EOF
-    apk info -e seaweedfs seaweedfs-doc seaweedfs-bash-completion \
+
-      seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc \
+Local APK repository is ready.
-      greptimedb lavinmq lavinmq-doc lavinmq-openrc \
+Repository: /repo
-      | sort
+Workspace:  /work
-    if command -v weed >/dev/null 2>&1; then
+
-      printf "\nSeaweedFS version:\n"
+Examples:
-      weed version
+  apk add seaweedfs seaweedfs-master-openrc
-    fi
+  apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
-    if command -v greptime >/dev/null 2>&1; then
+  apk add lavinmq lavinmq-openrc
-      printf "\nGreptimeDB version:\n"
+  apk add gitea gitea-openrc
-      greptime --version
+
-    fi
+Entering ${TEST_SHELL}.
-    if command -v lavinmq >/dev/null 2>&1; then
+
-      printf "\nLavinMQ version:\n"
+EOF
-      lavinmq -v
-    fi
-    printf "\nEntering %s. Repository mounted read-only at /work.\n\n" "${TEST_SHELL}"
     exec "${TEST_SHELL}"
   '