bump Gitea to 28.2.0

Reviewed-on: #21

.gitea/workflows/build.yml

@@ -62,6 +62,18 @@ jobs:
         id: package-selection
         run: scripts/apk/ci-package-cache.sh prepare
 
+      - name: Validate selected package matrix
+        run: |
+          for package in ${ALPINE_PACKAGES}; do
+            case "${package}" in
+              seaweedfs|greptimedb|lavinmq|gitea|nifi|rclone-openrc) ;;
+              *)
+                printf 'selected package is missing from the CI build matrix: %s\n' "${package}" >&2
+                exit 1
+                ;;
+            esac
+          done
+
   build:
     needs: preflight
     if: needs.preflight.outputs.packages_selected == 'true'
@@ -70,7 +82,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        package: [seaweedfs, greptimedb, lavinmq, gitea]
+        package: [seaweedfs, greptimedb, lavinmq, gitea, nifi, rclone-openrc]
     container:
       image: "alpine:3.24"
     env:
@@ -136,33 +148,10 @@ jobs:
           scripts/apk/ci-package-cache.sh prepare
           printf 'ALPINE_PACKAGES=%s\n' "$selected_packages" >> "$GITHUB_ENV"
 
-      - name: Download SeaweedFS artifacts
+      - name: Download package artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'seaweedfs')
         uses: actions/download-artifact@v3
         with:
-          name: alpine-package-seaweedfs-${{ github.sha }}
+          path: packages/worker-artifacts
-          path: packages/worker-artifacts/seaweedfs
-
-      - name: Download GreptimeDB artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'greptimedb')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-greptimedb-${{ github.sha }}
-          path: packages/worker-artifacts/greptimedb
-
-      - name: Download LavinMQ artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'lavinmq')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-lavinmq-${{ github.sha }}
-          path: packages/worker-artifacts/lavinmq
-
-      - name: Download Gitea artifacts
-        if: contains(needs.preflight.outputs.selected_packages, 'gitea')
-        uses: actions/download-artifact@v3
-        with:
-          name: alpine-package-gitea-${{ github.sha }}
-          path: packages/worker-artifacts/gitea
 
       - name: Merge package artifacts
         run: scripts/apk/merge-ci-artifacts.sh

.gitea/workflows/package-status.yml

@@ -1,30 +0,0 @@
-name: Package Update Status
-
-on:
-  schedule:
-    - cron: "17 5 * * 1"
-  workflow_dispatch:
-
-jobs:
-  package-status:
-    runs-on: ubuntu-latest
-    container:
-      image: alpine:3.24
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Check packaged upstream versions
-        run: |
-          apk add --no-cache --update abuild-rootbld alpine-sdk bash ca-certificates doas git nodejs sudo curl git jq docker
-          APK_UPDATE_CHECK_MODE=warn scripts/apk/outdated.sh > update-check.txt
-          cat update-check.txt
-          if [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
-            {
-              echo "## Upstream package update check"
-              echo
-              echo '```text'
-              cat update-check.txt
-              echo '```'
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi

.gitignore

@@ -3,6 +3,9 @@
 packages/
 packaging/alpine/*/*/pkg/
 packaging/alpine/*/*/src/
+packaging/alpine/*/*/tmp/
 packaging/alpine/*/*/*.apk
 packaging/alpine/*/*/*.tar.*
 !packaging/alpine/*/*/*-vendor.tar.gz
+!packaging/alpine/local/lavinmq/lavinmq-*-shards.tar.gz
+!packaging/alpine/local/lavinmq/lavinmq-*-assets.tar.gz

README.md

@@ -1,7 +1,5 @@
 # Alpine Packages
 
-[![Package update check](https://code.factoring.digital/public/alpine-packages/actions/workflows/package-status.yml/badge.svg?branch=main&event=schedule)](https://code.factoring.digital/public/alpine-packages/actions?workflow=package-status.yml)
-
 Alpine stable packaging for internal packages. This repository carries selected
 upstream releases ahead of Alpine community packages when we need newer
 features, packaging fixes, or service layouts on the current Alpine branch.
@@ -23,8 +21,10 @@ https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
 |-----------------------------------------------------------|--------------|-----------------|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
 | [SeaweedFS](packaging/alpine/local/seaweedfs/README.md)   | `seaweedfs`  | `4.48`          | Binary repackaging of official upstream release tarballs | Ships current SeaweedFS features with Alpine OpenRC role splits.                                                |
 | [GreptimeDB](packaging/alpine/local/greptimedb/README.md) | `greptimedb` | `1.2.1`         | Source build from upstream release                       | Provides a current GreptimeDB build and component OpenRC packages before it is available from Alpine community. |
-| [LavinMQ](packaging/alpine/local/lavinmq/README.md)       | `lavinmq`    | `2.10.0`        | Source build from upstream release                       | Provides a current LavinMQ build on Alpine 3.24 with matching Crystal support.                                  |
+| [LavinMQ](packaging/alpine/local/lavinmq/README.md)       | `lavinmq`    | `2.10.1`        | Source build from upstream release                       | Provides a current LavinMQ build on Alpine 3.24 with matching Crystal support.                                  |
-| [Gitea](packaging/alpine/local/gitea/README.md)           | `gitea`      | `1.27.3`        | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service.                        |
+| [Gitea](packaging/alpine/local/gitea/README.md)           | `gitea`      | `28.2.0`        | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service.                        |
+| [Apache NiFi](packaging/alpine/local/nifi/README.md)      | `nifi`       | `2.12.0`        | Binary repackaging of the official Standard distribution | Provides Apache NiFi 2 with a secure default configuration and OpenRC service.                                  |
+| [rclone OpenRC](packaging/alpine/local/rclone-openrc/README.md) | `rclone-openrc` | `0.1.0` | OpenRC integration for Alpine's rclone package | Provides reusable, instance-capable OpenRC supervision for rclone commands. |
 
 ## Use In Production
 
@@ -169,6 +169,9 @@ weed version
 
 apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
 greptime --version
+
+apk add rclone-openrc
+rclone version
 ```
 
 Run package-local runtime tests:

mise.lock

@@ -43,32 +43,10 @@ url = "https://github.com/nektos/act/releases/download/v0.2.89/act_Windows_x86_6
 url_api = "https://api.github.com/repos/nektos/act/releases/assets/434891261"
 
 [[tools.docker-cli]]
-version = "29.8.2"
+version = "29.9.1"
 backend = "aqua:docker/cli"
 specifiers = ["latest"]
 
-[tools.docker-cli."platforms.linux-arm64"]
-url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-arm64-musl"]
-url = "https://download.docker.com/linux/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-x64"]
-checksum = "blake3:3a70b254f51e6a0fb384e1d93bc859c19b975ae979abbec968e378f79335da5d"
-url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.linux-x64-musl"]
-url = "https://download.docker.com/linux/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.macos-arm64"]
-url = "https://download.docker.com/mac/static/stable/aarch64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.macos-x64"]
-url = "https://download.docker.com/mac/static/stable/x86_64/docker-29.8.2.tgz"
-
-[tools.docker-cli."platforms.windows-x64"]
-url = "https://download.docker.com/win/static/stable/x86_64/docker-29.8.2.zip"
-
 [[tools.jq]]
 version = "1.8.2"
 backend = "aqua:jqlang/jq"
@@ -157,48 +135,6 @@ url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellche
 url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
 
 [[tools.trivy]]
-version = "0.75.0"
+version = "0.76.0"
 backend = "aqua:aquasecurity/trivy"
 specifiers = ["latest"]
-
-[tools.trivy."platforms.linux-arm64"]
-checksum = "sha256:a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335583"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-arm64-musl"]
-checksum = "sha256:a1ee9f6ffb7d112b64ff726a2a0717c21175c1114361391f4a132956751a13b3"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335583"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-x64"]
-checksum = "sha256:c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335432"
-provenance = "cosign"
-
-[tools.trivy."platforms.linux-x64-musl"]
-checksum = "sha256:c6e65abddb348e25f10549df887045629cf28cc72453cd1c63acb717316b3f3f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_Linux-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335432"
-provenance = "cosign"
-
-[tools.trivy."platforms.macos-arm64"]
-checksum = "sha256:4a77108cccf8e55c8d6823e1e759939a622277e66cd0daa3c1fc621ed69e4568"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_macOS-ARM64.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335435"
-provenance = "cosign"
-
-[tools.trivy."platforms.macos-x64"]
-checksum = "sha256:291edaa9778acbe4693d067b5ad60ee11570e5ac68296e85595417528ca641e4"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_macOS-64bit.tar.gz"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335728"
-provenance = "cosign"
-
-[tools.trivy."platforms.windows-x64"]
-checksum = "sha256:4e43bd71a30f51aee39525f60f2b47043af77eb8df8fe082aae4372b69c6660f"
-url = "https://github.com/aquasecurity/trivy/releases/download/v0.75.0/trivy_0.75.0_windows-64bit.zip"
-url_api = "https://api.github.com/repos/aquasecurity/trivy/releases/assets/603335433"
-provenance = "cosign"

packaging/alpine/local/gitea/APKBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=gitea
-pkgver=28.0.0
+pkgver=28.2.0
 pkgrel=0
 pkgdesc="Self-hosted Git service written in Go"
 url="https://about.gitea.com/"
@@ -14,6 +14,7 @@ pkgusers="gitea"
 pkggroups="www-data"
 subpackages="
 	$pkgname-doc
+	$pkgname-logrotate:_logrotate:noarch
 	$pkgname-openrc:_openrc:noarch
 	"
 options="!check !strip !tracedeps"
@@ -33,6 +34,7 @@ source="
 	$pkgname-src-$pkgver.tar.gz::https://github.com/go-gitea/gitea/releases/download/v$pkgver/gitea-src-$pkgver.tar.gz
 	gitea.ini
 	gitea.initd
+	gitea.logrotate
 	"
 builddir="$srcdir/gitea-src-$pkgver"
 
@@ -68,10 +70,19 @@ _openrc() {
 	install -Dm755 "$srcdir"/gitea.initd "$subpkgdir"/etc/init.d/gitea
 }
 
+_logrotate() {
+	pkgdesc="Log rotation configuration for $pkgname"
+	depends="$pkgname=$pkgver-r$pkgrel logrotate"
+
+	install -Dm644 "$srcdir"/gitea.logrotate \
+		"$subpkgdir"/etc/logrotate.d/$pkgname
+}
+
 sha512sums="
-434eedf3cf9348b708d15170f3f47486e20253ef607ef5e4c8494e5a833342c1580179d6de6b8b29278fc2d570d24380ace142530102d0e14644891ff0e7bd4d  gitea-28.0.0-linux-amd64.xz
+a6ebe8f400d7ccbc4b98f314a2f21695e012d3ddd78f9b94583fe912f93ed078da5ef34c25ff2f5a0fd2d8ae6b531b25c6c1627fde09f17e9624bb9a9d5113fb  gitea-28.2.0-linux-amd64.xz
-a11dc1fff26d6e43541cbfa827be5cb95cec5b0336c944a1bbd294fdc212ca5eac983892879f453f3ab7eb0ddb7ea812a37c7e5aab2b8e1f886a3c790741e802  gitea-28.0.0-linux-arm64.xz
+e95cac30cad61cad06dee885fdb88676198663b25c70816860152ae85497332e03aa87bff2c1f58f84fcd0b46bb9b3f978617f972dd94dc506b1493f36da7f47  gitea-28.2.0-linux-arm64.xz
-bd5b600754388c6fe15ee91929231e804c74f4e694f892904e363ac9b923e9957c1f4f3a2489e216b7b05763022d6b8fdb9e01a49271c6f64313277a9a304797  gitea-src-28.0.0.tar.gz
+7bf890a3572f2992f2056f9e846732a267e2eb4a178212927fda98ed47b4ca09e9ecb748c2b424c4a90911689fe451c51f0bf987b02a49d751fc472a1d84d3fd  gitea-src-28.2.0.tar.gz
 4e20b24c34af01a27589a13d9140d559909cc44507febe5de692d7bc154d65f4b01b79d2f1dcce9fed77b60ac3b1a52cc0ec72161e5a2484a4c718d26d3c630d  gitea.ini
 9474d707df8b049c93ec4642f71195adff699e1e812f315cac4295b3ab29eeb9ba8b83bf3307c50b04e072a4a9dc4c4f84ac490ee22291bd50015009795c1598  gitea.initd
+456a565123b46c0c3a36adbde4c881ee04557a2f1ba492a76205c28f72598bf3b7b96192ddeae4f9ab197fdc75bb5e10a3421574e1bf831192220b4540bb39fc  gitea.logrotate
 "

packaging/alpine/local/gitea/README.md

@@ -19,6 +19,13 @@ rc-update add gitea default
 rc-service gitea start
 ```
 
+Install daily rotation for the OpenRC service log, retaining 14 compressed
+archives:
+
+```sh
+apk add gitea-logrotate
+```
+
 Refresh checksums:
 
 ```sh

packaging/alpine/local/gitea/gitea.logrotate

@@ -0,0 +1,10 @@
+/var/log/gitea/http.log {
+	daily
+	rotate 14
+	missingok
+	notifempty
+	compress
+	delaycompress
+	copytruncate
+	su gitea www-data
+}

packaging/alpine/local/gitea/scripts/test-install.sh

@@ -5,7 +5,7 @@ repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." &&
 # shellcheck source=scripts/apk/test-install-lib.sh
 . "${repo_root}/scripts/apk/test-install-lib.sh"
 
-apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-gitea}" "${PACKAGE_VERSION:-1.27.0-r1}" <<'SCRIPT'
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-gitea}" "${PACKAGE_VERSION:-28.0.0-r1}" <<'SCRIPT'
     set -e
 
     if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
@@ -29,7 +29,7 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-gitea}" "${PACKAGE_VERSION:
       printf "%s\n" /repo >> /etc/apk/repositories
     fi
     apk update
-    apk add --upgrade "${PACKAGE_NAME}" "${PACKAGE_NAME}-doc" "${PACKAGE_NAME}-openrc"
+    apk add --upgrade "${PACKAGE_NAME}" "${PACKAGE_NAME}-doc" "${PACKAGE_NAME}-logrotate" "${PACKAGE_NAME}-openrc"
     installed_after="$(apk list -I "${PACKAGE_NAME}" | awk "{print \$1}")"
     printf "Installed package after local upgrade: %s\n" "${installed_after}"
     test "${installed_after}" = "${PACKAGE_NAME}-${PACKAGE_VERSION}"
@@ -45,6 +45,9 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-gitea}" "${PACKAGE_VERSION:
     test -d /usr/share/webapps/gitea/public
     test -d /usr/share/webapps/gitea/templates
     test -f /etc/init.d/gitea
+    test -f /etc/logrotate.d/gitea
+    apk info -e logrotate
+    logrotate -d /etc/logrotate.conf
 
     gitea --version
 

packaging/alpine/local/greptimedb/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=greptimedb
 pkgver=1.2.1
-pkgrel=3
+pkgrel=5
 pkgdesc="Cloud-native observability database for metrics, logs, and traces"
 url="https://github.com/GreptimeTeam/greptimedb"
 arch="x86_64"
@@ -38,6 +38,7 @@ subpackages="
 	$pkgname-docs:_docs:noarch
 	$pkgname-flownode-openrc:_openrc_flownode:noarch
 	$pkgname-frontend-openrc:_openrc_frontend:noarch
+	$pkgname-logrotate:_logrotate:noarch
 	$pkgname-metasrv-openrc:_openrc_metasrv:noarch
 	$pkgname-standalone-openrc:_openrc_standalone:noarch
 	"
@@ -53,6 +54,7 @@ source="
 	greptimedb.flownode.confd
 	greptimedb.frontend.confd
 	greptimedb.initd
+	greptimedb.logrotate
 	greptimedb.metasrv.confd
 	greptimedb.standalone.confd
 	metasrv.toml
@@ -136,6 +138,14 @@ _openrc_frontend() { _openrc_service frontend; }
 _openrc_metasrv() { _openrc_service metasrv; }
 _openrc_standalone() { _openrc_service standalone; }
 
+_logrotate() {
+	pkgdesc="Log rotation configuration for $pkgname"
+	depends="$pkgname=$pkgver-r$pkgrel logrotate"
+
+	install -Dm644 "$srcdir"/greptimedb.logrotate \
+		"$subpkgdir"/etc/logrotate.d/$pkgname
+}
+
 _docs() {
 	pkgdesc="$pkgdesc (configuration examples and reference)"
 	depends=""
@@ -154,6 +164,7 @@ e3e19ab3c7a345ecf8cf0a507f7fc95dd3b036a4a797385cf77fcf1999f2e4f053042c7bbda8de73
 daf8efacc8bf2b74abd9f4900f889585295b57333a8a562a722de0596d35f25d5f9149e0879f4140bfdf727caa59c3f55b1380212722df92c588d912275530b8  greptimedb.flownode.confd
 e3e61b1df00f8172a3b1d4a0d37ed2574a8c5cd27676b4e2ce14d15ad8933d233baabe8da374f715d00cfaee26f665244c1ba00f70197fcc713c4e9af9c3229e  greptimedb.frontend.confd
 f72f52aa8277fc56eb071b5118990b8f4e09d143634c2f7fc54ed1f5ff065631c8630c45fe90d3db1f3ea0540c1ab3154a383d2000b4c5978e889ca02a1b6564  greptimedb.initd
+775b4db7e7bc6127376b22fed8330b952c5027e3bfbfa29bb6ae034e6c75e7fed8ddfc0ad9761f369acd37398dfbd145cfea210828f2fc0bec9be92b051e6a75  greptimedb.logrotate
 df495367d85844dcba99e5aa01e5a23fd14799b7521a72d9ea00d29fc0e5fbc5c5d06ee88e88d9637e260f8337249a39d2b0115de58da4899824d20bd844254a  greptimedb.metasrv.confd
 882a79e969cac42adfada22060e6507fb687755a6d266d6728154b3e4da5777d2eaf5ad9bc331ed050448249ca609e6a61977b624d9faf25d83ed975345452cf  greptimedb.standalone.confd
 8120ec338ebe1330d43b20d9b34a8f5f778ea13cb056febd3c8e9dc189d0de2380b90e5474a0990294d7004827c6133d44d2dd3e32d463b9259c47c82592d257  metasrv.toml

packaging/alpine/local/greptimedb/README.md

@@ -28,6 +28,8 @@ Installs `/usr/bin/greptime` and component OpenRC packages:
 - `greptimedb-datanode-openrc`: `greptime datanode start`
 - `greptimedb-flownode-openrc`: `greptime flownode start`
 - `greptimedb-frontend-openrc`: `greptime frontend start`
+- `greptimedb-logrotate`: daily rotation for the OpenRC service logs, retaining
+  14 compressed archives
 
 Default TOML files are installed in `/etc/greptimedb`. Standalone ports:
 

packaging/alpine/local/greptimedb/greptimedb.logrotate

@@ -0,0 +1,10 @@
+/var/log/greptimedb/greptimedb.*.log {
+	daily
+	rotate 14
+	missingok
+	notifempty
+	compress
+	delaycompress
+	copytruncate
+	su greptimedb greptimedb
+}

packaging/alpine/local/greptimedb/scripts/test-install.sh

@@ -26,6 +26,7 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-greptimedb}" "${PACKAGE_VER
       "${PACKAGE_NAME}-docs" \
       "${PACKAGE_NAME}-flownode-openrc" \
       "${PACKAGE_NAME}-frontend-openrc" \
+      "${PACKAGE_NAME}-logrotate" \
       "${PACKAGE_NAME}-metasrv-openrc" \
       "${PACKAGE_NAME}-standalone-openrc"
 
@@ -34,5 +35,8 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-greptimedb}" "${PACKAGE_VER
     ls -1 /etc/greptimedb
     test -f "/usr/share/doc/${PACKAGE_NAME}/config/config.md"
     test -f "/usr/share/doc/${PACKAGE_NAME}/config/standalone.example.toml"
+    test -f /etc/logrotate.d/greptimedb
+    apk info -e logrotate
+    logrotate -d /etc/logrotate.conf
     find /etc/init.d -maxdepth 1 -name "greptimedb.*" -print | sort
 SCRIPT

packaging/alpine/local/lavinmq/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=lavinmq
-pkgver=2.10.1
+pkgver=2.10.2
-pkgrel=0
+pkgrel=1
 pkgdesc="High-performance AMQP and MQTT message queue server"
 url="https://github.com/cloudamqp/lavinmq"
 arch="x86_64"
@@ -26,6 +26,7 @@ pkgusers="lavinmq"
 pkggroups="lavinmq"
 subpackages="
 	$pkgname-doc
+	$pkgname-logrotate:_logrotate:noarch
 	$pkgname-openrc:_openrc:noarch
 	"
 source="
@@ -34,6 +35,7 @@ source="
 	$pkgname-$pkgver-assets.tar.gz
 	lavinmq.confd
 	lavinmq.initd
+	lavinmq.logrotate
 	use-vendored-build-inputs.patch
 	"
 
@@ -71,11 +73,20 @@ _openrc() {
 		"$subpkgdir"/etc/conf.d/lavinmq
 }
 
+_logrotate() {
+	pkgdesc="Log rotation configuration for $pkgname"
+	depends="$pkgname=$pkgver-r$pkgrel logrotate"
+
+	install -Dm644 "$srcdir"/lavinmq.logrotate \
+		"$subpkgdir"/etc/logrotate.d/$pkgname
+}
+
 sha512sums="
-1c2c932a0698227abfe8353988ea75b48f9048f183d85410797af5bc14495e2cb4497e72acc8fc9ff9ef8f78e8ebb648a1b40b5cf7f1b86e18597d10297417ff  lavinmq-2.10.1.tar.gz
+35757407adb6fdd6378c65cde229471bd362b6a7fdc13279658312ef8a7304c0557619a1394a0b4cf33ef25ffb6c039f65c217f2af37bf12fc01b73d84e55e69  lavinmq-2.10.2.tar.gz
-d0dfdd5c0e474024f57deb9e31c76e3f176e798c8d21dea53d3aea1b05436bd03fa34e69ccddf322bc89adedce5f379df5a316cddbbdfe12520e5bf672ad8228  lavinmq-2.10.1-shards.tar.gz
+d0dfdd5c0e474024f57deb9e31c76e3f176e798c8d21dea53d3aea1b05436bd03fa34e69ccddf322bc89adedce5f379df5a316cddbbdfe12520e5bf672ad8228  lavinmq-2.10.2-shards.tar.gz
-ae3cea2534b211abbcbd1e4fcb6da73dfaf383a19aef1c45f367cba77492cc20a7ce8283fc42f26c0a023149114c369bed307fb8cde0b8f27fba61165092e986  lavinmq-2.10.1-assets.tar.gz
+ae3cea2534b211abbcbd1e4fcb6da73dfaf383a19aef1c45f367cba77492cc20a7ce8283fc42f26c0a023149114c369bed307fb8cde0b8f27fba61165092e986  lavinmq-2.10.2-assets.tar.gz
 62a609d50f28db960098c4c84ce4f1dad78413366a9a9aca18fe321114d687be3bf7b71924d4ace69bd74383c5ac40d2ee09ae0eef9c1bfe653b97448e42e110  lavinmq.confd
 1853196e70297b5c4a2207fde50df735620cf6d99c4994644fd676bffaf863d67300ad7ae771c4bbb86fce1a0485c2a7968cf912c5f5bb878e08b15e5a28ba1b  lavinmq.initd
+9999dd6a96bd29a3d0bda1b2110af940b15acf1250a0f3ba6c93d16bd62063ab1c1dfa4c237da99bbb401150517abde59e2c7275f4b72c3eb7c90e1ce61d43b9  lavinmq.logrotate
 e7617099f745ecbf2f0686830d0a1b28044741ebd543798505b5b3c08f1be96b6cc478eb18f6785af49b100c2f49d837775f0721ac27519ddf3f081e681c581c  use-vendored-build-inputs.patch
 "

packaging/alpine/local/lavinmq/README.md

@@ -38,6 +38,13 @@ rc-update add lavinmq default
 rc-service lavinmq start
 ```
 
+Install daily rotation for the OpenRC service log, retaining 14 compressed
+archives:
+
+```sh
+apk add lavinmq-logrotate
+```
+
 Wrapper settings in `/etc/conf.d/lavinmq`:
 
 - `LAVINMQ_CONFIG`: config file path passed with `--config`
@@ -48,23 +55,14 @@ Wrapper settings in `/etc/conf.d/lavinmq`:
 
 1. In `APKBUILD`, set `pkgver` to the new upstream version and reset `pkgrel`
    to `0`.
-2. Add versioned vendored archives for the locked Shards dependencies and
+2. Generate the versioned, locked Shards and frontend-asset archives:
-   frontend assets. If the new upstream `shard.lock` and the asset rules in its
-   `Makefile` are unchanged, the existing archives can be reused under the new
-   names:
 
    ```sh
-   cd packaging/alpine/local/lavinmq
+   ALPINE_PACKAGE=lavinmq mise run apk:update-generated
-   cp lavinmq-2.10.1-shards.tar.gz lavinmq-<version>-shards.tar.gz
-   cp lavinmq-2.10.1-assets.tar.gz lavinmq-<version>-assets.tar.gz
-   git add -f lavinmq-<version>-shards.tar.gz lavinmq-<version>-assets.tar.gz
    ```
 
-   When `shard.lock` changes, extract the upstream source, run
+   The hook uses the upstream `shard.lock` and `Makefile`, so it also refreshes
-   `shards install --production` in it, and create the shards archive with
+   the bundled inputs when either dependency list changes.
-   `tar -czf lavinmq-<version>-shards.tar.gz lib`. If the asset rules change,
-   download the files specified by the new `Makefile` to a staging directory
-   and create `lavinmq-<version>-assets.tar.gz` from that directory's contents.
 3. From the repository root, refresh checksums and build the package:
 
    ```sh

packaging/alpine/local/lavinmq/lavinmq.logrotate

@@ -0,0 +1,10 @@
+/var/log/lavinmq/lavinmq.log {
+	daily
+	rotate 14
+	missingok
+	notifempty
+	compress
+	delaycompress
+	copytruncate
+	su lavinmq lavinmq
+}

packaging/alpine/local/lavinmq/scripts/test-install.sh

@@ -20,7 +20,7 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-lavinmq}" "${PACKAGE_VERSIO
       printf "%s\n" /repo >> /etc/apk/repositories
     fi
     apk update
-    apk add "${PACKAGE_NAME}" "${PACKAGE_NAME}-doc" "${PACKAGE_NAME}-openrc"
+    apk add "${PACKAGE_NAME}" "${PACKAGE_NAME}-doc" "${PACKAGE_NAME}-logrotate" "${PACKAGE_NAME}-openrc"
 
     test -x /usr/bin/lavinmq
     test -x /usr/bin/lavinmqctl
@@ -30,6 +30,9 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-lavinmq}" "${PACKAGE_VERSIO
     test "$(stat -c "%U:%G %a" /var/lib/lavinmq)" = "lavinmq:lavinmq 750"
     test -f /etc/conf.d/lavinmq
     test -f /etc/init.d/lavinmq
+    test -f /etc/logrotate.d/lavinmq
+    apk info -e logrotate
+    logrotate -d /etc/logrotate.conf
     test -f /usr/share/doc/lavinmq/README.md
     test -f /usr/share/doc/lavinmq/changelog
 

packaging/alpine/local/lavinmq/scripts/update-generated-sources.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+package_dir="${PACKAGE_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)}"
+repo_root="${REPO_ROOT:-$(cd "${package_dir}/../../../.." && pwd)}"
+pkgver="$(awk -F= '$1 == "pkgver" { print $2; exit }' "${package_dir}/APKBUILD")"
+distfiles_dir="${repo_root}/.cache/apk-distfiles"
+shards_cache_dir="${repo_root}/.cache/shards"
+source_archive="${distfiles_dir}/lavinmq-${pkgver}.tar.gz"
+shards_archive="${package_dir}/lavinmq-${pkgver}-shards.tar.gz"
+assets_archive="${package_dir}/lavinmq-${pkgver}-assets.tar.gz"
+tmpdir="$(mktemp -d)"
+assets_dir="${tmpdir}/assets"
+
+cleanup() {
+  rm -rf "${tmpdir}"
+}
+trap cleanup EXIT
+
+mkdir -p "${distfiles_dir}" "${shards_cache_dir}"
+if [[ ! -f "${source_archive}" ]]; then
+  curl --fail --location --retry 3 --silent --show-error \
+    --output "${source_archive}" \
+    "https://github.com/cloudamqp/lavinmq/archive/refs/tags/v${pkgver}.tar.gz"
+fi
+
+tar -xzf "${source_archive}" -C "${tmpdir}"
+source_dir="${tmpdir}/lavinmq-${pkgver}"
+if [[ ! -d "${source_dir}" ]]; then
+  printf 'unexpected LavinMQ source archive layout: %s\n' "${source_archive}" >&2
+  exit 1
+fi
+
+# shard.lock pins the Crystal dependencies.  `make js` fetches exactly the
+# frontend assets declared by this upstream version's Makefile.
+(
+  cd "${source_dir}"
+  SHARDS_CACHE_PATH="${shards_cache_dir}" shards install --production
+  make js
+)
+
+tar --create --gzip --file "${shards_archive}" \
+  --directory "${source_dir}" \
+  --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+  lib
+mkdir -p "${assets_dir}"
+# The offline Makefile patch intentionally reads every asset from the root of
+# .alpine-assets, including helpers.segment.js which upstream stores in chunks/.
+find "${source_dir}/static/js/lib" -type f -exec cp -p {} "${assets_dir}/" \;
+tar --create --gzip --file "${assets_archive}" \
+  --directory "${assets_dir}" \
+  --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+  .
+
+printf 'Updated %s and %s\n' "${shards_archive##*/}" "${assets_archive##*/}"

packaging/alpine/local/nifi/APKBUILD

@@ -0,0 +1,75 @@
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
+pkgname=nifi
+pkgver=2.12.0
+pkgrel=1
+pkgdesc="Reliable system for processing and distributing data"
+url="https://nifi.apache.org/"
+arch="x86_64 aarch64"
+license="Apache-2.0"
+depends="openjdk21-jre-headless"
+makedepends="unzip"
+install="$pkgname.pre-install"
+pkgusers="nifi"
+pkggroups="nifi"
+subpackages="
+	$pkgname-openrc:_openrc:noarch
+	"
+options="!check !strip !tracedeps"
+source="
+	$pkgname-$pkgver-bin.zip::https://dlcdn.apache.org/nifi/$pkgver/nifi-$pkgver-bin.zip
+	nifi.confd
+	nifi.initd
+	nifi.wrapper
+	"
+package() {
+	local _dir
+
+	install -d "$pkgdir"/usr/lib/nifi "$pkgdir"/etc/nifi
+	cp -a "$builddir"/. "$pkgdir"/usr/lib/nifi/
+	chmod -R a+rX "$pkgdir"/usr/lib/nifi
+
+	cp -a "$pkgdir"/usr/lib/nifi/conf/. "$pkgdir"/etc/nifi/
+	rm -r "$pkgdir"/usr/lib/nifi/conf
+	ln -s /etc/nifi "$pkgdir"/usr/lib/nifi/conf
+
+	install -d -m 0750 -o nifi -g nifi "$pkgdir"/var/lib/nifi
+	for _dir in \
+		assets \
+		connector_assets \
+		content_repository \
+		database_repository \
+		diagnostics \
+		extensions \
+		flowfile_repository \
+		nar_repository \
+		provenance_repository \
+		state \
+		status_repository \
+		work; do
+		install -d -m 0750 -o nifi -g nifi "$pkgdir"/var/lib/nifi/$_dir
+		ln -s /var/lib/nifi/$_dir "$pkgdir"/usr/lib/nifi/$_dir
+	done
+	install -d -m 0750 -o nifi -g nifi "$pkgdir"/var/log/nifi
+	ln -s /var/log/nifi "$pkgdir"/usr/lib/nifi/logs
+	ln -s /run/nifi "$pkgdir"/usr/lib/nifi/run
+
+	chown -R nifi:nifi "$pkgdir"/etc/nifi
+	chmod 0750 "$pkgdir"/etc/nifi
+
+	install -Dm755 "$srcdir"/nifi.wrapper "$pkgdir"/usr/bin/nifi
+}
+
+_openrc() {
+	pkgdesc="$pkgdesc (OpenRC service)"
+	depends="$pkgname=$pkgver-r$pkgrel openrc"
+
+	install -Dm755 "$srcdir"/nifi.initd "$subpkgdir"/etc/init.d/nifi
+	install -Dm644 "$srcdir"/nifi.confd "$subpkgdir"/etc/conf.d/nifi
+}
+
+sha512sums="
+5891039ccf15234bb21c2d1ce65027357ca7603ad8fdfc946dd4b6499ab8061fb07a6a56f8e8c5bb7635d446354ca7cc76ba40e55921818931f193a75f247334  nifi-2.12.0-bin.zip
+fd576c2d2333aa79f7dac90e83f9cf6e0faed9748ebce0dfc1c18bcd1da0ec1d0da90d4004055bbddcb0f011a0e9efdc08f0eed2f3c19d49b1746019f2be1da9  nifi.confd
+9f8a005fcd6a6f75a553321c27c672c4c202e8b86ff5fa0a1bd5eb0e7305592e67d8dc6a915d1f1bc01b39916b0fb0e61478cb6ae5aee4ae8b3be36c80c5662a  nifi.initd
+7764c6a53f0fb109ecde4959b438a0eeb669b00eafdbdb2abe5255f4053a237d4e97349594b3bf053abd55a96f8e217aa0cf0fec59a7c14f1db2490e747f713e  nifi.wrapper
+"

packaging/alpine/local/nifi/README.md

@@ -0,0 +1,50 @@
+# Apache NiFi Alpine Package
+
+Repackages Apache NiFi 2.12.0 Standard for Alpine. The package requires Java
+21 and retains NiFi 2's secure default: HTTPS listens on `127.0.0.1:8443` and
+uses generated single-user credentials.
+
+## Install
+
+```sh
+apk add nifi nifi-openrc
+rc-update add nifi default
+rc-service nifi start
+```
+
+Open `https://127.0.0.1:8443/nifi` and retrieve the generated credentials:
+
+```sh
+grep 'Generated \(Username\|Password\)' /var/log/nifi/nifi-app.log
+```
+
+Set fixed single-user credentials as the service account:
+
+```sh
+doas -u nifi nifi set-single-user-credentials '<username>' '<password>'
+rc-service nifi restart
+```
+
+## Runtime Layout
+
+```text
+/usr/bin/nifi              Administration command wrapper
+/usr/lib/nifi              NiFi binaries and bundled NARs
+/etc/nifi                  Mutable NiFi configuration and authorization state
+/var/lib/nifi              Repositories, state, extensions, and work files
+/var/log/nifi              Application logs
+/etc/conf.d/nifi           OpenRC account defaults
+/etc/init.d/nifi           OpenRC service
+```
+
+Edit `/etc/nifi/nifi.properties` to bind a different HTTPS address, configure
+TLS, or select LDAP, OIDC, or another supported authentication provider.
+
+## Package Commands
+
+```sh
+ALPINE_PACKAGE=nifi mise run apk:checksum
+ALPINE_PACKAGE=nifi mise run apk:build
+ALPINE_PACKAGE=nifi SKIP_BUILD=1 mise run apk:test-install
+ALPINE_PACKAGE=nifi mise run apk:runtime-test
+```

packaging/alpine/local/nifi/nifi.confd

@@ -0,0 +1,3 @@
+# Defaults for Apache NiFi.
+NIFI_USER="nifi"
+NIFI_GROUP="nifi"

packaging/alpine/local/nifi/nifi.initd

@@ -0,0 +1,26 @@
+#!/sbin/openrc-run
+
+description="Apache NiFi dataflow service"
+
+supervisor=supervise-daemon
+name=nifi
+command="/usr/lib/nifi/bin/nifi.sh"
+command_args="run"
+command_user="${NIFI_USER:-nifi}:${NIFI_GROUP:-nifi}"
+directory="/usr/lib/nifi"
+pidfile="/run/nifi/nifi.pid"
+supervise_daemon_args="--chdir /usr/lib/nifi --env HOME=/var/lib/nifi --pidfile ${pidfile}"
+
+depend() {
+	need net
+	use dns logger
+}
+
+start_pre() {
+	local service_owner="${NIFI_USER:-nifi}:${NIFI_GROUP:-nifi}"
+
+	checkpath -d -m 0750 -o "$service_owner" \
+		/run/nifi \
+		/var/lib/nifi \
+		/var/log/nifi
+}

packaging/alpine/local/nifi/nifi.pre-install

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+addgroup -S nifi 2>/dev/null
+adduser -S -D -H -h /var/lib/nifi -s /sbin/nologin \
+	-G nifi -g nifi nifi 2>/dev/null
+
+exit 0

packaging/alpine/local/nifi/nifi.wrapper

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+exec /usr/lib/nifi/bin/nifi.sh "$@"

packaging/alpine/local/nifi/scripts/runtime-test.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add nifi nifi-openrc curl
+
+test -x /usr/bin/nifi
+test -x /usr/lib/nifi/bin/nifi.sh
+test -d /etc/nifi
+test -L /usr/lib/nifi/conf
+test "$(readlink /usr/lib/nifi/conf)" = /etc/nifi
+test -d /var/lib/nifi
+test -d /var/log/nifi
+test -f /etc/init.d/nifi
+test -f /etc/conf.d/nifi
+test -d /usr/lib/nifi/docs
+test "$(stat -c '%U:%G %a' /var/lib/nifi)" = "nifi:nifi 750"
+
+rc-update add nifi default || true
+test -L /etc/runlevels/default/nifi
+rc-service nifi start
+
+for _attempt in $(seq 1 300); do
+	if curl --fail --insecure --silent --show-error \
+		https://localhost:8443/nifi/ >/dev/null; then
+		break
+	fi
+	sleep 1
+done
+
+curl --fail --insecure --silent --show-error https://localhost:8443/nifi/ >/dev/null
+grep -q 'Generated Username' /var/log/nifi/nifi-app.log
+grep -q 'Generated Password' /var/log/nifi/nifi-app.log
+rc-service nifi status
+rc-service nifi stop

packaging/alpine/local/nifi/scripts/test-install.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
+# shellcheck source=scripts/apk/test-install-lib.sh
+. "${repo_root}/scripts/apk/test-install-lib.sh"
+
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-nifi}" "${PACKAGE_VERSION:-2.12.0-r0}" <<'SCRIPT'
+    set -e
+
+    if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
+      if [ -n "${ALPINE_REPOSITORY_KEY_URL}" ]; then
+        apk add --no-cache curl >/dev/null
+        cd /etc/apk/keys
+        curl -fsSLOJ "${ALPINE_REPOSITORY_KEY_URL}"
+      fi
+      printf "%s\n" "${ALPINE_REPOSITORY_URL}" >> /etc/apk/repositories
+    else
+      cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
+      printf "%s\n" /repo >> /etc/apk/repositories
+    fi
+    apk update
+    apk add "${PACKAGE_NAME}" "${PACKAGE_NAME}-openrc"
+
+    test -x /usr/bin/nifi
+    test -x /usr/lib/nifi/bin/nifi.sh
+    test -d /etc/nifi
+    test -L /usr/lib/nifi/conf
+    test "$(readlink /usr/lib/nifi/conf)" = /etc/nifi
+    test -d /var/lib/nifi
+    test -d /var/log/nifi
+    test -f /etc/init.d/nifi
+    test -f /etc/conf.d/nifi
+    test -d /usr/lib/nifi/docs
+    test "$(stat -c '%U:%G %a' /var/lib/nifi)" = "nifi:nifi 750"
+
+    rc-update add nifi default
+    test -L /etc/runlevels/default/nifi
+SCRIPT

packaging/alpine/local/nifi/update-check.conf

@@ -0,0 +1,3 @@
+provider="github"
+repo="apache/nifi"
+version_prefix="rel/nifi-"

packaging/alpine/local/rclone-openrc/APKBUILD

@@ -0,0 +1,29 @@
+# Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
+pkgname=rclone-openrc
+pkgver=0.1.0
+pkgrel=1
+pkgdesc="Generic, instance-capable OpenRC service for rclone"
+url="https://rclone.org/"
+arch="noarch"
+license="MIT"
+depends="openrc rclone"
+install="$pkgname.pre-install"
+pkgusers="rclone"
+pkggroups="rclone"
+options="!check"
+source="
+	rclone.confd
+	rclone.initd
+	"
+
+package() {
+	install -d -m 0750 -o root -g rclone "$pkgdir"/etc/rclone
+	install -d -m 0750 -o rclone -g rclone "$pkgdir"/var/lib/rclone/cache
+	install -Dm644 "$srcdir"/rclone.confd "$pkgdir"/etc/conf.d/rclone
+	install -Dm755 "$srcdir"/rclone.initd "$pkgdir"/etc/init.d/rclone
+}
+
+sha512sums="
+91a05da2c5740a810faf0226ab5fcb3d92a9db56b42c10decaed91481d3129cfc37f5f726a6dc1b5b1246ad4d1386cbe918e109f152969912ea670dbff35fe70  rclone.confd
+e92ce86aa21ce1a94beb8304c806b4c0045d412477d7a232e37b0f28354af3060de054c5ae3d1ea353b92d19137a0cfa00b0891b0e179aa32bc6b2c7ecdfc7ea  rclone.initd
+"

packaging/alpine/local/rclone-openrc/README.md

@@ -0,0 +1,59 @@
+# rclone OpenRC Alpine Package
+
+Provides a generic, instance-capable OpenRC service for Alpine's `rclone`
+package. It does not repackage the rclone binary.
+
+## Install
+
+```sh
+apk add rclone-openrc
+```
+
+The package creates the unprivileged `rclone` account, `/etc/rclone` for
+configuration and credentials, and `/var/lib/rclone/cache` for rclone state.
+It deliberately does not create remotes, credentials, authorized-key files, or
+SSH host keys; provision those as machine-specific secrets.
+
+## Create an Instance
+
+Copy the template and symlink the generic service under an instance name:
+
+```sh
+cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+ln -s rclone /etc/init.d/rclone.sftp
+```
+
+For an SFTP server, configure `/etc/conf.d/rclone.sftp`:
+
+```sh
+RCLONE_COMMAND="serve sftp"
+RCLONE_REMOTE="/srv/storage"
+RCLONE_ARGS="
+  --addr :2022
+  --authorized-keys /etc/rclone/authorized_keys
+  --key /etc/rclone/ssh_host_ed25519_key
+  --log-level INFO
+"
+```
+
+Then enable and start it:
+
+```sh
+rc-update add rclone.sftp default
+rc-service rclone.sftp start
+```
+
+Other instances, such as `rclone.webdav` or `rclone.rcd`, use their own
+`/etc/conf.d/rclone.<name>` file with the same generic init script. The service
+runs rclone in the foreground under `supervise-daemon`, which restarts it after
+an unexpected exit. Set `RCLONE_RESPAWN_MAX` to a positive value to limit
+restart attempts.
+
+## Package Commands
+
+```sh
+ALPINE_PACKAGE=rclone-openrc mise run apk:checksum
+ALPINE_PACKAGE=rclone-openrc mise run apk:build
+ALPINE_PACKAGE=rclone-openrc SKIP_BUILD=1 mise run apk:test-install
+ALPINE_PACKAGE=rclone-openrc mise run apk:runtime-test
+```

packaging/alpine/local/rclone-openrc/rclone-openrc.pre-install

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+addgroup -S rclone 2>/dev/null
+adduser -S -D -H -h /var/lib/rclone -s /sbin/nologin \
+	-G rclone -g rclone rclone 2>/dev/null
+
+exit 0

packaging/alpine/local/rclone-openrc/rclone.confd

@@ -0,0 +1,23 @@
+# Defaults for rclone OpenRC instances.
+#
+# To create an instance, copy this file to /etc/conf.d/rclone.<name> and create
+# /etc/init.d/rclone.<name> as a symlink to /etc/init.d/rclone. For example:
+#
+#   cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+#   ln -s rclone /etc/init.d/rclone.sftp
+#
+# Each instance must set RCLONE_COMMAND. RCLONE_REMOTE is optional because
+# commands such as "rcd" do not use a remote.
+RCLONE_COMMAND=""
+RCLONE_REMOTE=""
+RCLONE_ARGS=""
+
+RCLONE_CONFIG="/etc/rclone/rclone.conf"
+RCLONE_CACHE_DIR="/var/lib/rclone/cache"
+RCLONE_USER="rclone"
+RCLONE_GROUP="rclone"
+
+# Restart a long-running rclone command after an unexpected exit. Set
+# RCLONE_RESPAWN_MAX to a positive number to limit restart attempts.
+RCLONE_RESPAWN_DELAY="5"
+RCLONE_RESPAWN_MAX="0"

packaging/alpine/local/rclone-openrc/rclone.initd

@@ -0,0 +1,31 @@
+#!/sbin/openrc-run
+
+instance_name="${RC_SVCNAME#rclone.}"
+description="rclone ${instance_name} service"
+
+supervisor="supervise-daemon"
+command="/usr/bin/rclone"
+command_user="${RCLONE_USER:-rclone}:${RCLONE_GROUP:-rclone}"
+pidfile="/run/rclone/${RC_SVCNAME}.pid"
+respawn_delay="${RCLONE_RESPAWN_DELAY:-5}"
+respawn_max="${RCLONE_RESPAWN_MAX:-0}"
+supervise_daemon_args="--chdir /var/lib/rclone --pidfile ${pidfile}"
+command_args="${RCLONE_COMMAND:-} ${RCLONE_REMOTE:-} --config ${RCLONE_CONFIG:-/etc/rclone/rclone.conf} --cache-dir ${RCLONE_CACHE_DIR:-/var/lib/rclone/cache} ${RCLONE_ARGS:-}"
+
+depend() {
+	need net
+	use dns logger
+}
+
+start_pre() {
+	local service_owner="${RCLONE_USER:-rclone}:${RCLONE_GROUP:-rclone}"
+
+	if [ -z "${RCLONE_COMMAND:-}" ]; then
+		eerror "RCLONE_COMMAND is required; configure /etc/conf.d/${RC_SVCNAME}"
+		return 1
+	fi
+
+	checkpath -d -m 0750 -o "$service_owner" \
+		/run/rclone \
+		"${RCLONE_CACHE_DIR:-/var/lib/rclone/cache}"
+}

packaging/alpine/local/rclone-openrc/scripts/runtime-test.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+apk add rclone-openrc
+
+test -x /usr/bin/rclone
+test -f /etc/conf.d/rclone
+test -f /etc/init.d/rclone
+test "$(stat -c '%U:%G %a' /etc/rclone)" = "root:rclone 750"
+test "$(stat -c '%U:%G %a' /var/lib/rclone/cache)" = "rclone:rclone 750"
+
+cp /etc/conf.d/rclone /etc/conf.d/rclone.rcd
+ln -s rclone /etc/init.d/rclone.rcd
+sed -i 's|^RCLONE_COMMAND=""|RCLONE_COMMAND="rcd"|' /etc/conf.d/rclone.rcd
+sed -i 's|^RCLONE_ARGS=""|RCLONE_ARGS="--rc-addr 127.0.0.1:5572 --rc-no-auth"|' /etc/conf.d/rclone.rcd
+
+rc-update add rclone.rcd default || true
+rc-service rclone.rcd start
+rc-service rclone.rcd status
+rc-service rclone.rcd stop

packaging/alpine/local/rclone-openrc/scripts/test-install.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="${REPO_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../../.." && pwd)}"
+# shellcheck source=scripts/apk/test-install-lib.sh
+. "${repo_root}/scripts/apk/test-install-lib.sh"
+
+apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-rclone-openrc}" "${PACKAGE_VERSION:-}" <<'SCRIPT'
+    set -e
+
+    if [ -n "${ALPINE_REPOSITORY_URL}" ]; then
+      if [ -n "${ALPINE_REPOSITORY_KEY_URL}" ]; then
+        apk add --no-cache curl >/dev/null
+        cd /etc/apk/keys
+        curl -fsSLOJ "${ALPINE_REPOSITORY_KEY_URL}"
+      fi
+      printf "%s\n" "${ALPINE_REPOSITORY_URL}" >> /etc/apk/repositories
+    else
+      cp "/repo/${ALPINE_ARCH}"/*.rsa.pub /etc/apk/keys/
+      printf "%s\n" /repo >> /etc/apk/repositories
+    fi
+    apk update
+    apk add "${PACKAGE_NAME}"
+
+    test -x /usr/bin/rclone
+    test -f /etc/conf.d/rclone
+    test -f /etc/init.d/rclone
+    test -d /etc/rclone
+    test "$(stat -c '%U:%G %a' /etc/rclone)" = "root:rclone 750"
+    test "$(stat -c '%U:%G %a' /var/lib/rclone/cache)" = "rclone:rclone 750"
+
+    cp /etc/conf.d/rclone /etc/conf.d/rclone.sftp
+    ln -s rclone /etc/init.d/rclone.sftp
+    rc-update add rclone.sftp default
+    test -L /etc/runlevels/default/rclone.sftp
+SCRIPT

packaging/alpine/local/seaweedfs/APKBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Joachim Schlöffel <joachim.schloeffel@financial-service-plus.de>
 pkgname=seaweedfs
 pkgver=4.48
-pkgrel=1
+pkgrel=4
 pkgdesc="Distributed storage system for object storage, file systems, and Iceberg tables"
 url="https://github.com/seaweedfs/seaweedfs"
 arch="x86_64 aarch64"
@@ -15,6 +15,7 @@ subpackages="
 	$pkgname-bash-completion:_bashcomp:noarch
 	$pkgname-doc
 	$pkgname-filer-openrc:_openrc_filer:noarch
+	$pkgname-logrotate:_logrotate:noarch
 	$pkgname-master-openrc:_openrc_master:noarch
 	$pkgname-s3-openrc:_openrc_s3:noarch
 	$pkgname-sftp-openrc:_openrc_sftp:noarch
@@ -45,6 +46,7 @@ source="
 	seaweedfs.admin.confd
 	seaweedfs.filer.confd
 	seaweedfs.initd
+	seaweedfs.logrotate
 	seaweedfs.master.confd
 	seaweedfs.s3.confd
 	seaweedfs.sftp.confd
@@ -62,7 +64,8 @@ prepare() {
 }
 
 build() {
-	go build -mod=readonly -buildvcs=false -trimpath -o "$builddir/weed-bin" ./weed
+	go build -mod=readonly -buildvcs=false -trimpath \
+		-tags "sqlite rclone gocdk" -o "$builddir/weed-bin" ./weed
 
 	cd "$_worker_builddir"
 	cargo build --locked --release -p weed-lance-worker
@@ -109,6 +112,14 @@ _openrc_volume() { _openrc_service volume; }
 _openrc_webdav() { _openrc_service webdav; }
 _openrc_worker() { _openrc_service worker; }
 
+_logrotate() {
+	pkgdesc="Log rotation configuration for $pkgname"
+	depends="$pkgname=$pkgver-r$pkgrel logrotate"
+
+	install -Dm644 "$srcdir"/seaweedfs.logrotate \
+		"$subpkgdir"/etc/logrotate.d/$pkgname
+}
+
 _worker_lance() {
 	pkgdesc="SeaweedFS Lance table maintenance worker"
 	depends="$pkgname=$pkgver-r$pkgrel libgcc"
@@ -149,6 +160,7 @@ b7caad9dff0bb812d4046b8e0285ac4e88a7af3a742a168579df08762da735a025725f78286e17bd
 82e2793bf483ffb5b0c8fbe38e6c9df75afe01f824f8414cafd91e4bed5c79c13dae1ca659070401d4968d16ed4b26455b0c6208f777705527bceb2e5f286988  seaweedfs.admin.confd
 5ad952c37c62a770327bd70f7349fa677406606f0b9bf03fdc8f6c6804701f1e77710ab20d6153f9e0cfb549ec161d68a3316abab9c59837bbe3f91ee99e5ce0  seaweedfs.filer.confd
 19cbd65d701b0995e088f265d88f481f14e214ecbd8a783f7e7b17e811e421a28425f96d073757cc07fbb17e8eb084d14d41f46baee82ee13e043ce0c0c5bde9  seaweedfs.initd
+816e763164c2cec66509c213ed56cb633f13d1daf48a511d1a9cfdf692a6ad945cf599cb0e706202b8fd522022ce512eae6170422e478abdf95334b0088ac4cc  seaweedfs.logrotate
 57ba77519bb266f0117eaadae3af5ae6bc99bb653668ff526202f327df1c8d93973c0e19dae0c53a19e06389868043c04e53f16f01c851b77fe1387e92cc993b  seaweedfs.master.confd
 22a3ea6c83266a979ea7c848fc74b40fc0f2ade960b273fa11e63d4a72a1328bd688c9918be3e9234cfb19f889fd9c931388bb5c2863cea3500e534b8bd90282  seaweedfs.s3.confd
 3e9c41bc61cdd9a4c53ece64d847eca26ab7d0ce0cc98e72462c3dbb225a40de10a02201362801015a9c629d77d5c0d54c7228e9d20111fb6f478b2267d2db98  seaweedfs.sftp.confd

packaging/alpine/local/seaweedfs/README.md

@@ -2,8 +2,9 @@
 
 Builds SeaweedFS 4.48 from its upstream source release for `x86_64` and
 `aarch64`. The package intentionally builds the upstream baseline feature set,
-without optional build tags. Go and Cargo dependencies are resolved from the
+with the `sqlite`, `rclone`, and `gocdk` optional Go build tags enabled. Go and
-versions pinned in the upstream `go.sum` and `Cargo.lock` files.
+Cargo dependencies are resolved from the versions pinned in the upstream
+`go.sum` and `Cargo.lock` files.
 
 ## Package Commands
 
@@ -130,6 +131,15 @@ Bash completion:
 apk add bash-completion seaweedfs-bash-completion
 ```
 
+Log rotation for the default OpenRC service logs:
+
+```sh
+apk add seaweedfs-logrotate
+```
+
+This rotates `/var/log/seaweedfs/seaweedfs.*.log` daily and retains 14
+compressed archives.
+
 ## Upgrade Or Pin
 
 Upgrade:

packaging/alpine/local/seaweedfs/scripts/test-install.sh

@@ -16,6 +16,7 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-seaweedfs}" "${PACKAGE_VERS
       seaweedfs-master-openrc \
       seaweedfs-volume-openrc \
       seaweedfs-filer-openrc \
+      seaweedfs-logrotate \
       seaweedfs-worker-lance-openrc
 
     test -x /usr/bin/weed
@@ -30,6 +31,9 @@ apk_test_install_run "${repo_root}" "${PACKAGE_NAME:-seaweedfs}" "${PACKAGE_VERS
     test -f /etc/init.d/seaweedfs.volume
     test -f /etc/init.d/seaweedfs.filer
     test -f /etc/init.d/seaweedfs.worker-lance
+    test -f /etc/logrotate.d/seaweedfs
+    apk info -e logrotate
+    logrotate -d /etc/logrotate.conf
     test -x /usr/bin/weed-worker
     /usr/bin/weed-worker --help >/dev/null
 

packaging/alpine/local/seaweedfs/seaweedfs.logrotate

@@ -0,0 +1,10 @@
+/var/log/seaweedfs/seaweedfs.*.log {
+	daily
+	rotate 14
+	missingok
+	notifempty
+	compress
+	delaycompress
+	copytruncate
+	su seaweedfs seaweedfs
+}

scripts/apk/ci-package-cache.sh

@@ -30,16 +30,30 @@ registry_key_url() {
 }
 
 download_registry_metadata() {
-  local arch url key_dir
+  local arch url key_dir http_status
 
   require_registry_config INSTANCE_URL "${instance_url}"
   require_registry_config PACKAGE_OWNER "${owner}"
+  declare -gA registry_index_available=()
   mkdir -p "${registry_cache}"
   url="$(registry_url)"
   for arch in ${arches}; do
-    curl --fail --silent --show-error --location \
+    if http_status="$(curl --fail --silent --location \
       --output "${registry_cache}/${arch}.APKINDEX.tar.gz" \
-      "${url}/${arch}/APKINDEX.tar.gz"
+      --write-out '%{http_code}' \
+      "${url}/${arch}/APKINDEX.tar.gz")"; then
+      registry_index_available["${arch}"]=1
+      continue
+    fi
+    if [[ "${http_status}" == 404 ]]; then
+      registry_index_available["${arch}"]=0
+      printf 'Registry index is absent: %s/%s/APKINDEX.tar.gz; treating it as empty\n' \
+        "${url}" "${arch}" >&2
+      continue
+    fi
+    printf 'failed to download registry index (%s): %s/%s/APKINDEX.tar.gz\n' \
+      "${http_status:-curl error}" "${url}" "${arch}" >&2
+    return 1
   done
   key_dir="${registry_cache}/keys"
   mkdir -p "${key_dir}"
@@ -59,6 +73,7 @@ load_registry_index() {
   declare -gA registry_latest_versions=()
 
   for arch in ${arches}; do
+    [[ "${registry_index_available[${arch}]:-0}" == 1 ]] || continue
     while IFS=$'\t' read -r package_name package_version; do
       [[ -n "${package_name}" && -n "${package_version}" ]] || continue
       registry_key="${arch}|${package_name}"

scripts/apk/ci-smoke.sh

@@ -6,12 +6,13 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 . "${repo_root}/scripts/apk/package-lib.sh"
 repo_name="${ALPINE_REPO_NAME:-local}"
 arch="${ALPINE_ARCH:-$(apk --print-arch)}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc rclone-openrc}"
 repo_dir="${repo_root}/packages/${repo_name}/${arch}"
 registry_url="${ALPINE_REGISTRY_URL:-}"
 registry_key="${ALPINE_REGISTRY_KEY:-}"
 read -r -a package_list <<< "${packages}"
 declare -A source_packages=()
+local_repo_complete=0
 
 while IFS= read -r package_dir; do
   while IFS= read -r spec; do
@@ -26,18 +27,30 @@ for package in "${package_list[@]}"; do
   fi
 done
 
+if [[ -d "${repo_dir}" ]]; then
+  local_repo_complete=1
+  for package in "${package_list[@]}"; do
+    if ! compgen -G "${repo_dir}/${package}-*.apk" >/dev/null; then
+      local_repo_complete=0
+      break
+    fi
+  done
+fi
+
 if [[ -d "${repo_dir}" ]]; then
   cp "${repo_dir}"/*.rsa.pub /etc/apk/keys/
   echo "${repo_root}/packages/${repo_name}" >> /etc/apk/repositories
 fi
 
-if [[ -n "${registry_url}" ]]; then
+if [[ -n "${registry_url}" && "${local_repo_complete}" == 0 ]]; then
   if [[ ! -f "${registry_key}" ]]; then
     printf 'missing Alpine registry signing key: %s\n' "${registry_key:-<unset>}" >&2
     exit 1
   fi
   cp "${registry_key}" /etc/apk/keys/
   echo "${registry_url}" >> /etc/apk/repositories
+elif [[ -n "${registry_url}" ]]; then
+  printf 'Using the complete local Alpine repository; registry fallback is not needed\n'
 fi
 
 if [[ ! -d "${repo_dir}" && -z "${registry_url}" ]]; then
@@ -64,6 +77,11 @@ if command -v gitea >/dev/null 2>&1; then
   test -f /etc/gitea/app.ini
   test -d /var/lib/gitea
 fi
+if command -v rclone >/dev/null 2>&1; then
+  rclone version
+  test -f /etc/conf.d/rclone
+  test -f /etc/init.d/rclone
+fi
 if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
   find /etc/init.d -maxdepth 1 -name 'seaweedfs.*' -print | sort
 fi

scripts/apk/smoke.sh

@@ -5,7 +5,7 @@ repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 alpine_version="${ALPINE_VERSION:-3.24}"
 platform="${ALPINE_BUILD_PLATFORM:-linux/amd64}"
 arch="${ALPINE_ARCH:-x86_64}"
-packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc}"
+packages="${SMOKE_PACKAGES:-seaweedfs seaweedfs-master-openrc seaweedfs-filer-openrc seaweedfs-worker-openrc greptimedb lavinmq lavinmq-openrc gitea gitea-openrc rclone-openrc}"
 
 if [[ ! -d "${repo_root}/packages/local/${arch}" ]]; then
   printf 'missing local repository: packages/local/%s\n' "${arch}" >&2
@@ -39,6 +39,11 @@ docker run --rm --platform "${platform}" \
       test -f /etc/gitea/app.ini
       test -d /var/lib/gitea
     fi
+    if command -v rclone >/dev/null 2>&1; then
+      rclone version
+      test -f /etc/conf.d/rclone
+      test -f /etc/init.d/rclone
+    fi
     if ls /etc/init.d/seaweedfs.* >/dev/null 2>&1; then
       ls -1 /etc/init.d/seaweedfs.* | sort
     fi

scripts/apk/test-shell.sh

@@ -76,6 +76,7 @@ Examples:
   apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
   apk add lavinmq lavinmq-openrc
   apk add gitea gitea-openrc
+  apk add rclone-openrc
 
 Entering ${TEST_SHELL}.