bump Gitea to 28.2.0

Reviewed-on: #21

.gitea/workflows/build.yml

@@ -62,6 +62,18 @@ jobs:
         id: package-selection
         run: scripts/apk/ci-package-cache.sh prepare
 
+      - name: Validate selected package matrix
+        run: |
+          for package in ${ALPINE_PACKAGES}; do
+            case "${package}" in
+              seaweedfs|greptimedb|lavinmq|gitea|nifi|rclone-openrc) ;;
+              *)
+                printf 'selected package is missing from the CI build matrix: %s\n' "${package}" >&2
+                exit 1
+                ;;
+            esac
+          done
+
   build:
     needs: preflight
     if: needs.preflight.outputs.packages_selected == 'true'
@@ -70,7 +82,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        package: [seaweedfs, greptimedb, lavinmq, gitea, nifi]
+        package: [seaweedfs, greptimedb, lavinmq, gitea, nifi, rclone-openrc]
     container:
       image: "alpine:3.24"
     env:
@@ -136,40 +148,10 @@ jobs:
           scripts/apk/ci-package-cache.sh prepare
           printf 'ALPINE_PACKAGES=%s\n' "$selected_packages" >> "$GITHUB_ENV"
 
-      - name: Download SeaweedFS artifacts
+      - name: Download package artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'seaweedfs')
         uses: actions/download-artifact@v3
         with:
-          name: alpine-package-seaweedfs-${{ github.sha }}
+          path: packages/worker-artifacts
-          path: packages/worker-artifacts/seaweedfs
-
-      - name: Download GreptimeDB artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'greptimedb')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-greptimedb-${{ github.sha }}
-          path: packages/worker-artifacts/greptimedb
-
-      - name: Download LavinMQ artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'lavinmq')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-lavinmq-${{ github.sha }}
-          path: packages/worker-artifacts/lavinmq
-
-      - name: Download Gitea artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'gitea')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-gitea-${{ github.sha }}
-          path: packages/worker-artifacts/gitea
-
-      - name: Download NiFi artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'nifi')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-nifi-${{ github.sha }}
-          path: packages/worker-artifacts/nifi
 
       - name: Merge package artifacts
         run: scripts/apk/merge-ci-artifacts.sh

.gitignore

@@ -7,3 +7,5 @@ packaging/alpine/*/*/tmp/
 packaging/alpine/*/*/*.apk
 packaging/alpine/*/*/*.tar.*
 !packaging/alpine/*/*/*-vendor.tar.gz
+!packaging/alpine/local/lavinmq/lavinmq-*-shards.tar.gz
+!packaging/alpine/local/lavinmq/lavinmq-*-assets.tar.gz

README.md

@@ -22,8 +22,9 @@ https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
 | [SeaweedFS](packaging/alpine/local/seaweedfs/README.md)   | `seaweedfs`  | `4.48`          | Binary repackaging of official upstream release tarballs | Ships current SeaweedFS features with Alpine OpenRC role splits.                                                |
 | [GreptimeDB](packaging/alpine/local/greptimedb/README.md) | `greptimedb` | `1.2.1`         | Source build from upstream release                       | Provides a current GreptimeDB build and component OpenRC packages before it is available from Alpine community. |
 | [LavinMQ](packaging/alpine/local/lavinmq/README.md)       | `lavinmq`    | `2.10.1`        | Source build from upstream release                       | Provides a current LavinMQ build on Alpine 3.24 with matching Crystal support.                                  |
-| [Gitea](packaging/alpine/local/gitea/README.md)           | `gitea`      | `28.0.0`        | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service.                        |
+| [Gitea](packaging/alpine/local/gitea/README.md)           | `gitea`      | `28.2.0`        | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service.                        |
 | [Apache NiFi](packaging/alpine/local/nifi/README.md)      | `nifi`       | `2.12.0`        | Binary repackaging of the official Standard distribution | Provides Apache NiFi 2 with a secure default configuration and OpenRC service.                                  |
+| [rclone OpenRC](packaging/alpine/local/rclone-openrc/README.md) | `rclone-openrc` | `0.1.0` | OpenRC integration for Alpine's rclone package | Provides reusable, instance-capable OpenRC supervision for rclone commands. |
 
 ## Use In Production
 
@@ -168,6 +169,9 @@ weed version
 
 apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
 greptime --version
+
+apk add rclone-openrc
+rclone version
 ```
 
 Run package-local runtime tests:

mise.lock

@@ -43,32 +43,10 @@ url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Windows_x86_6
 url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891261"
 
 [[tools.docker-cli]]
-version = "29.8.2"
+version = "29.9.1"
 backend = "aqua:docker/cli"
 specifiers = ["latest"]
 
-[tools.docker-cli."platforms.linux-arm64"]
-url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-arm64-musl"]
-url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-x64"]
-checksum = "blake3:3a70b254f51e6a0fb384e1d93bc859c19b975ae979abbec968e378f79335da5d"
-url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-x64-musl"]
-url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.macos-arm64"]
-url = "https://download.docker.com/mac/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.macos-x64"]
-url = "https://download.docker.com/mac/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.windows-x64"]
-url = "https://download.docker.com/win/static/stable/x86_64/docker-29.8.2.zip"
-
 [[tools.jq]]
 version = "1.8.2"
 backend = "aqua:jqlang/jq"
@@ -157,48 +135,6 @@ url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellche
 url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
 
 [[tools.trivy]]
-version = "0.75.0"
+version = "0.76.0"
 backend = "aqua:aquasecurity/trivy"
 specifiers = ["latest"]
-
-[tools.trivy."platforms.linux-arm64"]
-checksum = "sha256:a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335583"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-arm64-musl"]
-checksum = "sha256:a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335583"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-x64"]
-checksum = "sha256:c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335432"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-x64-musl"]
-checksum = "sha256:c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335432"
-provenance = "cosign"
-
-[tools.trivy."platforms.macos-arm64"]
-checksum = "sha256:4a77108cccf8e55c8d6823e1e759939a622277e66cd0daa3c1fc621ed69e4568"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_macOS-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335435"
-provenance = "cosign"
-
-[tools.trivy."platforms.macos-x64"]
-checksum = "sha256:291edaa9778acbe4693d067b5ad60ee11570e5ac68296e85595417528ca641e4"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_macOS-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335728"
-provenance = "cosign"
-
-[tools.trivy."platforms.windows-x64"]
-checksum = "sha256:4e43bd71a30f51aee39525f60f2b47043af77eb8df8fe082aae4372b69c6660f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_windows-64bit.zip"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335433"
-provenance = "cosign"

packaging/alpine/local/gitea/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=gitea
-pkgver=28.0.0
+pkgver=28.2.0
-pkgrel=1
+pkgrel=0
 pkgdesc="Self-hosted Git service written in Go"
 url="https://about.gitea.com/"
 arch="x86_64 aarch64"
@@ -79,9 +79,9 @@ _logrotate() {
 }
 
 sha512sums="
-434eedf3cf9348b708d15170f3f47486e20253ef607ef5e4c8494e5a833342c1580179d6de6b8b29278fc2d570d24380ace142530102d0e14644891ff0e7bd4d  gitea-28.0.0-linux-amd64.xz
+a6ebe8f400d7ccbc4b98f314a2f21695e012d3ddd78f9b94583fe912f93ed078da5ef34c25ff2f5a0fd2d8ae6b531b25c6c1627fde09f17e9624bb9a9d5113fb  gitea-28.2.0-linux-amd64.xz
-a11dc1fff26d6e43541cbfa827be5cb95cec5b0336c944a1bbd294fdc212ca5eac983892879f453f3ab7eb0ddb7ea812a37c7e5aab2b8e1f886a3c790741e802  gitea-28.0.0-linux-arm64.xz
+e95cac30cad61cad06dee885fdb88676198663b25c70816860152ae85497332e03aa87bff2c1f58f84fcd0b46bb9b3f978617f972dd94dc506b1493f36da7f47  gitea-28.2.0-linux-arm64.xz
-bd5b600754388c6fe15ee91929231e804c74f4e694f892904e363ac9b923e9957c1f4f3a2489e216b7b05763022d6b8fdb9e01a49271c6f64313277a9a304797  gitea-src-28.0.0.tar.gz
+7bf890a3572f2992f2056f9e846732a267e2eb4a178212927fda98ed47b4ca09e9ecb748c2b424c4a90911689fe451c51f0bf987b02a49d751fc472a1d84d3fd  gitea-src-28.2.0.tar.gz
 4e20b24c34af01a27589a13d9140d559909cc44507febe5de692d7bc154d65f4b01b79d2f1dcce9fed77b60ac3b1a52cc0ec72161e5a2484a4c718d26d3c630d  gitea.ini
 9474d707df8b049c93ec4642f71195adff699e1e812f315cac4295b3ab29eeb9ba8b83bf3307c50b04e072a4a9dc4c4f84ac490ee22291bd50015009795c1598  gitea.initd
 456a565123b46c0c3a36adbde4c881ee04557a2f1ba492a76205c28f72598bf3b7b96192ddeae4f9ab197fdc75bb5e10a3421574e1bf831192220b4540bb39fc  gitea.logrotate

packaging/alpine/local/greptimedb/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=greptimedb
 pkgver=1.2.1
-pkgrel=4
+pkgrel=5
 pkgdesc="Cloud-native observability database for metrics, logs, and traces"
 url="https://github.com/GreptimeTeam/greptimedb"
 arch="x86_64"

packaging/alpine/local/lavinmq/APKBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=lavinmq
-pkgver=2.10.1
+pkgver=2.10.2
 pkgrel=1
 pkgdesc="High-performance AMQP and MQTT message queue server"
 url="https://github.com/cloudamqp/lavinmq"
@@ -82,9 +82,9 @@ _logrotate() {
 }
 
 sha512sums="
-1c2c932a0698227abfe8353988ea75b48f9048f183d85410797af5bc14495e2cb4497e72acc8fc9ff9ef8f78e8ebb648a1b40b5cf7f1b86e18597d10297417ff  lavinmq-2.10.1.tar.gz
+35757407adb6fdd6378c65cde229471bd362b6a7fdc13279658312ef8a7304c0557619a1394a0b4cf33ef25ffb6c039f65c217f2af37bf12fc01b73d84e55e69  lavinmq-2.10.2.tar.gz
-d0dfdd5c0e474024f57deb9e31c76e3f176e798c8d21dea53d3aea1b05436bd03fa34e69ccddf322bc89adedce5f379df5a316cddbbdfe12520e5bf672ad8228  lavinmq-2.10.1-shards.tar.gz
+d0dfdd5c0e474024f57deb9e31c76e3f176e798c8d21dea53d3aea1b05436bd03fa34e69ccddf322bc89adedce5f379df5a316cddbbdfe12520e5bf672ad8228  lavinmq-2.10.2-shards.tar.gz
-ae3cea2534b211abbcbd1e4fcb6da73dfaf383a19aef1c45f367cba77492cc20a7ce8283fc42f26c0a023149114c369bed307fb8cde0b8f27fba61165092e986  lavinmq-2.10.1-assets.tar.gz
+ae3cea2534b211abbcbd1e4fcb6da73dfaf383a19aef1c45f367cba77492cc20a7ce8283fc42f26c0a023149114c369bed307fb8cde0b8f27fba61165092e986  lavinmq-2.10.2-assets.tar.gz
 62a609d50f28db960098c4c84ce4f1dad78413366a9a9aca18fe321114d687be3bf7b71924d4ace69bd74383c5ac40d2ee09ae0eef9c1bfe653b97448e42e110  lavinmq.confd
 1853196e70297b5c4a2207fde50df735620cf6d99c4994644fd676bffaf863d67300ad7ae771c4bbb86fce1a0485c2a7968cf912c5f5bb878e08b15e5a28ba1b  lavinmq.initd
 9999dd6a96bd29a3d0bda1b2110af940b15acf1250a0f3ba6c93d16bd62063ab1c1dfa4c237da99bbb401150517abde59e2c7275f4b72c3eb7c90e1ce61d43b9  lavinmq.logrotate

packaging/alpine/local/lavinmq/README.md

@@ -55,23 +55,14 @@ Wrapper settings in `/etc/conf.d/lavinmq`:
 
 1. In `APKBUILD`, set `pkgver` to the new upstream version and reset `pkgrel`
    to `0`.
-2. Add versioned vendored archives for the locked Shards dependencies and
+2. Generate the versioned, locked Shards and frontend-asset archives:
-   frontend assets. If the new upstream `shard.lock` and the asset rules in its
-   `Makefile` are unchanged, the existing archives can be reused under the new
-   names:
 
    ```sh
-   cd packaging/alpine/local/lavinmq
+   ALPINE_PACKAGE=lavinmq mise run apk:update-generated
-   cp lavinmq-2.10.1-shards.tar.gz lavinmq-<version>-shards.tar.gz
-   cp lavinmq-2.10.1-assets.tar.gz lavinmq-<version>-assets.tar.gz
-   git add -f lavinmq-<version>-shards.tar.gz lavinmq-<version>-assets.tar.gz
    ```
 
-   When `shard.lock` changes, extract the upstream source, run
+   The hook uses the upstream `shard.lock` and `Makefile`, so it also refreshes
-   `shards install --production` in it, and create the shards archive with
+   the bundled inputs when either dependency list changes.
-   `tar -czf lavinmq-<version>-shards.tar.gz lib`. If the asset rules change,
-   download the files specified by the new `Makefile` to a staging directory
-   and create `lavinmq-<version>-assets.tar.gz` from that directory's contents.
 3. From the repository root, refresh checksums and build the package:
 
    ```sh

packaging/alpine/local/lavinmq/scripts/update-generated-sources.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+package_dir="${PACKAGE_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+repo_root="${REPO_ROOT:-$(cd "${package_dir}/../../../.." && pwd)}"
+pkgver="$(awk -F= '$1 == "pkgver" { print $2; exit }' "${package_dir}/APKBUILD")"
+distfiles_dir="${repo_root}/.cache/apk-distfiles"
+shards_cache_dir="${repo_root}/.cache/shards"
+source_archive="${distfiles_dir}/lavinmq-${pkgver}.tar.gz"
+shards_archive="${package_dir}/lavinmq-${pkgver}-shards.tar.gz"
+assets_archive="${package_dir}/lavinmq-${pkgver}-assets.tar.gz"
+tmpdir="$(mktemp -d)"
+assets_dir="${tmpdir}/assets"
+
+cleanup() {
+  rm -rf "${tmpdir}"
+}
+trap cleanup EXIT
+
+mkdir -p "${distfiles_dir}" "${shards_cache_dir}"
+if [[ ! -f "${source_archive}" ]]; then
+  curl --fail --location --retry 3 --silent --show-error \
+    --output "${source_archive}" \
+    "https://github.com/cloudamqp/lavinmq/archive/refs/tags/v${pkgver}.tar.gz"
+fi
+
+tar -xzf "${source_archive}" -C "${tmpdir}"
+source_dir="${tmpdir}/lavinmq-${pkgver}"
+if [[ ! -d "${source_dir}" ]]; then
+  printf 'unexpected LavinMQ source archive layout: %s\n' "${source_archive}" >&2
+  exit 1
+fi
+
+# shard.lock pins the Crystal dependencies.  `make js` fetches exactly the
+# frontend assets declared by this upstream version's Makefile.
+(
+  cd "${source_dir}"
+  SHARDS_CACHE_PATH="${shards_cache_dir}" shards install --production
+  make js
+)
+
+tar --create --gzip --file "${shards_archive}" \
+  --directory "${source_dir}" \
+  --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+  lib
+mkdir -p "${assets_dir}"
+# The offline Makefile patch intentionally reads every asset from the root of
+# .alpine-assets, including helpers.segment.js which upstream stores in chunks/.
+find "${source_dir}/static/js/lib" -type f -exec cp -p {} "${assets_dir}/" \;
+tar --create --gzip --file "${assets_archive}" \
+  --directory "${assets_dir}" \
+  --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+  .
+
+printf 'Updated %s and %s\n' "${shards_archive##*/}" "${assets_archive##*/}"

packaging/alpine/local/nifi/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=nifi
 pkgver=2.12.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Reliable system for processing and distributing data"
 url="https://nifi.apache.org/"
 arch="x86_64 aarch64"

packaging/alpine/local/rclone-openrc/APKBUILD

@@ -0,0 +1,29 @@
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
+pkgname=rclone-openrc
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Generic, instance-capable OpenRC service for rclone"
+url="https://rclone.org/"
+arch="noarch"
+license="MIT"
+depends="openrc rclone"
+install="$pkgname.pre-install"
+pkgusers="rclone"
+pkggroups="rclone"
+options="!check"
+source="
+	rclone.confd
+	rclone.initd
+	"
+
+package() {
+	install -d -m 0750 -o root -g rclone "$pkgdir"/etc/rclone
+	install -d -m 0750 -o rclone -g rclone "$pkgdir"/var/lib/rclone/cache
+	install -Dm644 "$srcdir"/rclone.confd "$pkgdir"/etc/conf.d/rclone
+	install -Dm755 "$srcdir"/rclone.initd "$pkgdir"/etc/init.d/rclone
+}
+
+sha512sums="
+91a05da2c5740a810faf0226ab5fcb3d92a9db56b42c10decaed91481d3129cfc37f5f726a6dc1b5b1246ad4d1386cbe918e109f152969912ea670dbff35fe70  rclone.confd
+e92ce86aa21ce1a94beb8304c806b4c0045d412477d7a232e37b0f28354af3060de054c5ae3d1ea353b92d19137a0cfa00b0891b0e179aa32bc6b2c7ecdfc7ea  rclone.initd
+"

packaging/alpine/local/rclone-openrc/README.md

@@ -0,0 +1,59 @@
+# rclone OpenRC Alpine Package
+
+Provides a generic, instance-capable OpenRC service for Alpine's `rclone`
+package. It does not repackage the rclone binary.
+
+## Install
+
+```sh
+apk add rclone-openrc
+```
+
+The package creates the unprivileged `rclone` account, `/etc/rclone` for
+configuration and credentials, and `/var/lib/rclone/cache` for rclone state.
+It deliberately does not create remotes, credentials, authorized-key files, or
+SSH host keys; provision those as machine-specific secrets.
+
+## Create an Instance
+
+Copy the template and symlink the generic service under an instance name:
+
+```sh
+cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+ln -s rclone /etc/init.d/rclone.sftp
+```
+
+For an SFTP server, configure `/etc/conf.d/rclone.sftp`:
+
+```sh
+RCLONE_COMMAND="serve sftp"
+RCLONE_REMOTE="/srv/storage"
+RCLONE_ARGS="
+  --addr :2022
+  --authorized-keys /etc/rclone/authorized_keys
+  --key /etc/rclone/ssh_host_ed25519_key
+  --log-level INFO
+"
+```
+
+Then enable and start it:
+
+```sh
+rc-update add rclone.sftp default
+rc-service rclone.sftp start
+```
+
+Other instances, such as `rclone.webdav` or `rclone.rcd`, use their own
+`/etc/conf.d/rclone.<name>` file with the same generic init script. The service
+runs rclone in the foreground under `supervise-daemon`, which restarts it after
+an unexpected exit. Set `RCLONE_RESPAWN_MAX` to a positive value to limit
+restart attempts.
+
+## Package Commands
+
+```sh
+ALPINE_PACKAGE=rclone-openrc mise run apk:checksum
+ALPINE_PACKAGE=rclone-openrc mise run apk:build
+ALPINE_PACKAGE=rclone-openrc SKIP_BUILD=1 mise run apk:test-install
+ALPINE_PACKAGE=rclone-openrc mise run apk:runtime-test
+```

packaging/alpine/local/rclone-openrc/rclone-openrc.pre-install

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+addgroup -S rclone 2>/dev/null
+adduser -S -D -H -h /var/lib/rclone -s /sbin/nologin \
+	-G rclone -g rclone rclone 2>/dev/null
+
+exit 0

packaging/alpine/local/rclone-openrc/rclone.confd

@@ -0,0 +1,23 @@
+# Defaults for rclone OpenRC instances.
+#
+# To create an instance, copy this file to /etc/conf.d/rclone.<name> and create
+# /etc/init.d/rclone.<name> as a symlink to /etc/init.d/rclone. For example:
+#
+#   cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+#   ln -s rclone /etc/init.d/rclone.sftp
+#
+# Each instance must set RCLONE_COMMAND. RCLONE_REMOTE is optional because
+# commands such as "rcd" do not use a remote.
+RCLONE_COMMAND=""
+RCLONE_REMOTE=""
+RCLONE_ARGS=""
+
+RCLONE_CONFIG="/etc/rclone/rclone.conf"
+RCLONE_CACHE_DIR="/var/lib/rclone/cache"
+RCLONE_USER="rclone"
+RCLONE_GROUP="rclone"
+
+# Restart a long-running rclone command after an unexpected exit. Set
+# RCLONE_RESPAWN_MAX to a positive number to limit restart attempts.
+RCLONE_RESPAWN_DELAY="5"
+RCLONE_RESPAWN_MAX="0"

packaging/alpine/local/rclone-openrc/rclone.initd

@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+
+instance_name="${RC_SVCNAME#rclone.}"
+description="rclone ${instance_name} service"
+
+supervisor="supervise-daemon"
+command="/usr/bin/rclone"
+command_user="${RCLONE_USER:-rclone}:${RCLONE_GROUP:-rclone}"
+pidfile="/run/rclone/${RC_SVCNAME}.pid"
+respawn_delay="${RCLONE_RESPAWN_DELAY:-5}"
+respawn_max="${RCLONE_RESPAWN_MAX:-0}"
+supervise_daemon_args="--chdir /var/lib/rclone --pidfile ${pidfile}"
+command_args="${RCLONE_COMMAND:-} ${RCLONE_REMOTE:-} --config ${RCLONE_CONFIG:-/etc/rclone/rclone.conf} --cache-dir ${RCLONE_CACHE_DIR:-/var/lib/rclone/cache} ${RCLONE_ARGS:-}"
+
+depend() {
+	need net
+	use dns logger
+}
+
+start_pre() {
+	local service_owner="${RCLONE_USER:-rclone}:${RCLONE_GROUP:-rclone}"
+
+	if [ -z "${RCLONE_COMMAND:-}" ]; then
+		eerror "RCLONE_COMMAND is required; configure /etc/conf.d/${RC_SVCNAME}"
+		return 1
+	fi
+
+	checkpath -d -m 0750 -o "$service_owner" \
+		/run/rclone \
+		"${RCLONE_CACHE_DIR:-/var/lib/rclone/cache}"
+}

packaging/alpine/local/rclone-openrc/scripts/runtime-test.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add rclone-openrc
+
+test -x /usr/bin/rclone
+test -f /etc/conf.d/rclone
+test -f /etc/init.d/rclone
+test "$(stat -c '%U:%G %a' /etc/rclone)" = "root:rclone 750"
+test "$(stat -c '%U:%G %a' /var/lib/rclone/cache)" = "rclone:rclone 750"
+
+cp /etc/conf.d/rclone /etc/conf.d/rclone.rcd
+ln -s rclone /etc/init.d/rclone.rcd
+sed -i 's|^RCLONE_COMMAND=""|RCLONE_COMMAND="rcd"|' /etc/conf.d/rclone.rcd
+sed -i 's|^RCLONE_ARGS=""|RCLONE_ARGS="--rc-addr 127.0.0.1:5572 --rc-no-auth"|' /etc/conf.d/rclone.rcd
+
+rc-update add rclone.rcd default || true
+rc-service rclone.rcd start
+rc-service rclone.rcd status
+rc-service rclone.rcd stop

packaging/alpine/local/rclone-openrc/scripts/test-install.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
+# shellcheck source=scripts/apk/test-install-lib.sh
+. "${repo_root}/scripts/apk/test-install-lib.sh"
+
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-rclone-openrc}" "${PACKAGE_VERSION:-}" <<'SCRIPT'
+    set -e
+
+    if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
+      if [ -n "${ALPINE_REPOSITORY_KEY_URL}" ]; then
+        apk add --no-cache curl >/dev/null
+        cd /etc/apk/keys
+        curl -fsSLOJ "${ALPINE_REPOSITORY_KEY_URL}"
+      fi
+      printf "%s\n" "${ALPINE_REPOSITORY_URL}" >> /etc/apk/repositories
+    else
+      cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
+      printf "%s\n" /repo >> /etc/apk/repositories
+    fi
+    apk update
+    apk add "${PACKAGE_NAME}"
+
+    test -x /usr/bin/rclone
+    test -f /etc/conf.d/rclone
+    test -f /etc/init.d/rclone
+    test -d /etc/rclone
+    test "$(stat -c '%U:%G %a' /etc/rclone)" = "root:rclone 750"
+    test "$(stat -c '%U:%G %a' /var/lib/rclone/cache)" = "rclone:rclone 750"
+
+    cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+    ln -s rclone /etc/init.d/rclone.sftp
+    rc-update add rclone.sftp default
+    test -L /etc/runlevels/default/rclone.sftp
+SCRIPT

packaging/alpine/local/seaweedfs/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=seaweedfs
 pkgver=4.48
-pkgrel=3
+pkgrel=4
 pkgdesc="Distributed storage system for object storage, file systems, and Iceberg tables"
 url="https://github.com/seaweedfs/seaweedfs"
 arch="x86_64 aarch64"

scripts/apk/ci-package-cache.sh

@@ -30,16 +30,30 @@ registry_key_url() {
 }
 
 download_registry_metadata() {
-  local arch url key_dir
+  local arch url key_dir http_status
 
   require_registry_config INSTANCE_URL "${instance_url}"
   require_registry_config PACKAGE_OWNER "${owner}"
+  declare -gA registry_index_available=()
   mkdir -p "${registry_cache}"
   url="$(registry_url)"
   for arch in ${arches}; do
-    curl --fail --silent --show-error --location \
+    if http_status="$(curl --fail --silent --location \
       --output "${registry_cache}/${arch}.APKINDEX.tar.gz" \
-      "${url}/${arch}/APKINDEX.tar.gz"
+      --write-out '%{http_code}' \
+      "${url}/${arch}/APKINDEX.tar.gz")"; then
+      registry_index_available["${arch}"]=1
+      continue
+    fi
+    if [[ "${http_status}" == 404 ]]; then
+      registry_index_available["${arch}"]=0
+      printf 'Registry index is absent: %s/%s/APKINDEX.tar.gz; treating it as empty\n' \
+        "${url}" "${arch}" >&2
+      continue
+    fi
+    printf 'failed to download registry index (%s): %s/%s/APKINDEX.tar.gz\n' \
+      "${http_status:-curl error}" "${url}" "${arch}" >&2
+    return 1
   done
   key_dir="${registry_cache}/keys"
   mkdir -p "${key_dir}"
@@ -59,6 +73,7 @@ load_registry_index() {
   declare -gA registry_latest_versions=()
 
   for arch in ${arches}; do
+    [[ "${registry_index_available[${arch}]:-0}" == 1 ]] || continue
     while IFS=$'\t' read -r package_name package_version; do
       [[ -n "${package_name}" && -n "${package_version}" ]] || continue
       registry_key="${arch}|${package_name}"

scripts/apk/ci-smoke.sh

@@ -6,12 +6,13 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 . "${repo_root}/scripts/apk/package-lib.sh"
 repo_name="${ALPINE_REPO_NAME:-local}"
 arch="${ALPINE_ARCH:-$(apk --print-arch)}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc rclone-openrc}"
 repo_dir="${repo_root}/packages/${repo_name}/${arch}"
 registry_url="${ALPINE_REGISTRY_URL:-}"
 registry_key="${ALPINE_REGISTRY_KEY:-}"
 read -r -a package_list <<< "${packages}"
 declare -A source_packages=()
+local_repo_complete=0
 
 while IFS= read -r package_dir; do
   while IFS= read -r spec; do
@@ -26,18 +27,30 @@ for package in "${package_list[@]}"; do
   fi
 done
 
+if [[ -d "${repo_dir}" ]]; then
+  local_repo_complete=1
+  for package in "${package_list[@]}"; do
+    if ! compgen -G "${repo_dir}/${package}-*.apk" >/dev/null; then
+      local_repo_complete=0
+      break
+    fi
+  done
+fi
+
 if [[ -d "${repo_dir}" ]]; then
   cp "${repo_dir}"/*.rsa.pub /etc/apk/keys/
   echo "${repo_root}/packages/${repo_name}" >> /etc/apk/repositories
 fi
 
-if [[ -n "${registry_url}" ]]; then
+if [[ -n "${registry_url}" && "${local_repo_complete}" == 0 ]]; then
   if [[ ! -f "${registry_key}" ]]; then
     printf 'missing Alpine registry signing key: %s\n' "${registry_key:-<unset>}" >&2
     exit 1
   fi
   cp "${registry_key}" /etc/apk/keys/
   echo "${registry_url}" >> /etc/apk/repositories
+elif [[ -n "${registry_url}" ]]; then
+  printf 'Using the complete local Alpine repository; registry fallback is not needed\n'
 fi
 
 if [[ ! -d "${repo_dir}" && -z "${registry_url}" ]]; then
@@ -64,6 +77,11 @@ if command -v gitea >/dev/null 2>&1; then
   test -f /etc/gitea/app.ini
   test -d /var/lib/gitea
 fi
+if command -v rclone >/dev/null 2>&1; then
+  rclone version
+  test -f /etc/conf.d/rclone
+  test -f /etc/init.d/rclone
+fi
 if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
   find /etc/init.d -maxdepth 1 -name 'seaweedfs.*' -print | sort
 fi

scripts/apk/smoke.sh

@@ -5,7 +5,7 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 alpine_version="${ALPINE_VERSION:-3.24}"
 platform="${ALPINE_BUILD_PLATFORM:-linux/amd64}"
 arch="${ALPINE_ARCH:-x86_64}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc rclone-openrc}"
 
 if [[ ! -d "${repo_root}/packages/local/${arch}" ]]; then
   printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
@@ -39,6 +39,11 @@ docker run --rm --platform "${platform}" \
       test -f /etc/gitea/app.ini
       test -d /var/lib/gitea
     fi
+    if command -v rclone >/dev/null 2>&1; then
+      rclone version
+      test -f /etc/conf.d/rclone
+      test -f /etc/init.d/rclone
+    fi
     if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
       ls -1 /etc/init.d/seaweedfs.* | sort
     fi

scripts/apk/test-shell.sh

@@ -76,6 +76,7 @@ Examples:
   apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
   apk add lavinmq lavinmq-openrc
   apk add gitea gitea-openrc
+  apk add rclone-openrc
 
 Entering ${TEST_SHELL}.