Joachim Schlöffel
0f5d8f1c5c
Build Alpine Packages / preflight (pull_request) Successful in 10s
Build Alpine Packages / build (greptimedb) (pull_request) Successful in 9s
Build Alpine Packages / build (lavinmq) (pull_request) Successful in 8s
Build Alpine Packages / build (nifi) (pull_request) Successful in 8s
Build Alpine Packages / build (rclone-openrc) (pull_request) Successful in 8s
Build Alpine Packages / build (gitea) (pull_request) Successful in 1m2s
Build Alpine Packages / build (seaweedfs) (pull_request) Successful in 9s
Build Alpine Packages / verify-and-publish (pull_request) Successful in 44s
Build Alpine Packages / preflight (push) Successful in 11s
Build Alpine Packages / build (greptimedb) (push) Successful in 11s
Build Alpine Packages / build (lavinmq) (push) Successful in 8s
Build Alpine Packages / build (nifi) (push) Successful in 8s
Build Alpine Packages / build (rclone-openrc) (push) Successful in 8s
Build Alpine Packages / build (seaweedfs) (push) Successful in 9s
Build Alpine Packages / build (gitea) (push) Successful in 1m0s
Build Alpine Packages / verify-and-publish (push) Successful in 47s
313 lines
9.8 KiB
Markdown
313 lines
9.8 KiB
Markdown
# Alpine Packages
|
|
|
|
Alpine stable packaging for internal packages. This repository carries selected
|
|
upstream releases ahead of Alpine community packages when we need newer
|
|
features, packaging fixes, or service layouts on the current Alpine branch.
|
|
|
|
Packages are either source builds or binary repackages:
|
|
|
|
- Source builds compile upstream source releases inside the Alpine build
|
|
environment and link against Alpine libraries.
|
|
- Binary repackages wrap official upstream Linux release artifacts in Alpine
|
|
package metadata, OpenRC services, config defaults, and role subpackages.
|
|
|
|
```text
|
|
https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
|
|
```
|
|
|
|
## Available Packages
|
|
|
|
| Package | APK Name | Package Version | Package Type | Purpose |
|
|
|-----------------------------------------------------------|--------------|-----------------|----------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
|
|
| [SeaweedFS](packaging/alpine/local/seaweedfs/README.md) | `seaweedfs` | `4.48` | Binary repackaging of official upstream release tarballs | Ships current SeaweedFS features with Alpine OpenRC role splits. |
|
|
| [GreptimeDB](packaging/alpine/local/greptimedb/README.md) | `greptimedb` | `1.2.1` | Source build from upstream release | Provides a current GreptimeDB build and component OpenRC packages before it is available from Alpine community. |
|
|
| [LavinMQ](packaging/alpine/local/lavinmq/README.md) | `lavinmq` | `2.10.1` | Source build from upstream release | Provides a current LavinMQ build on Alpine 3.24 with matching Crystal support. |
|
|
| [Gitea](packaging/alpine/local/gitea/README.md) | `gitea` | `28.2.0` | Binary repackaging of official upstream release binaries | Ships current Gitea releases with the expected Alpine runtime layout and OpenRC service. |
|
|
| [Apache NiFi](packaging/alpine/local/nifi/README.md) | `nifi` | `2.12.0` | Binary repackaging of the official Standard distribution | Provides Apache NiFi 2 with a secure default configuration and OpenRC service. |
|
|
| [rclone OpenRC](packaging/alpine/local/rclone-openrc/README.md) | `rclone-openrc` | `0.1.0` | OpenRC integration for Alpine's rclone package | Provides reusable, instance-capable OpenRC supervision for rclone commands. |
|
|
|
|
## Use In Production
|
|
|
|
### Add The Package Repository
|
|
|
|
Install the registry key:
|
|
|
|
```sh
|
|
cd /etc/apk/keys
|
|
curl -fsSLOJ https://code.factoring.digital/api/packages/public/alpine/key
|
|
```
|
|
|
|
Add the repository for the node's Alpine branch:
|
|
|
|
```sh
|
|
printf '%s\n' \
|
|
'https://code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages' \
|
|
>> /etc/apk/repositories
|
|
|
|
apk update
|
|
```
|
|
|
|
Private registry URL format:
|
|
|
|
```text
|
|
https://<user>:<token>@code.factoring.digital/api/packages/public/alpine/v3.24/alpine-packages
|
|
```
|
|
|
|
## Contribution
|
|
|
|
### Package Layout
|
|
|
|
Package sources live under:
|
|
|
|
```text
|
|
packaging/alpine/local/<pkgname>/
|
|
```
|
|
|
|
Local build output is written under:
|
|
|
|
```text
|
|
packages/local/<arch>/
|
|
```
|
|
|
|
Signing keys and distfiles are cached under:
|
|
|
|
```text
|
|
.cache/abuild/
|
|
.cache/apk-distfiles/
|
|
```
|
|
|
|
### Build Commands
|
|
|
|
```sh
|
|
$ mise tasks
|
|
Name Description
|
|
apk:build Build the Alpine package in Docker for the default architecture
|
|
apk:build-aarch64 Build the Alpine package in Docker for aarch64
|
|
apk:build-all Build the Alpine package in Docker for all configured architectures
|
|
apk:build-x86_64 Build the Alpine package in Docker for x86_64
|
|
apk:checksum Refresh APKBUILD checksums in Docker
|
|
apk:ci-build Build all configured Alpine packages directly in the current Alpine...
|
|
apk:ci-smoke Install-test built packages directly in the current Alpine environment
|
|
apk:clean Remove generated Alpine package build outputs
|
|
apk:lint Run Alpine APKBUILD lint in Docker
|
|
apk:lint-shell Run ShellCheck for packaging automation
|
|
apk:packages List built Alpine packages and dependencies
|
|
apk:publish-check Run lint, multi-arch build, package listing, and smoke test
|
|
apk:publish-gitea Publish built packages to the Gitea Alpine package registry
|
|
apk:outdated Check packaged upstream versions and release summaries
|
|
apk:security-report Generate Trivy and CycloneDX reports for built packages
|
|
apk:shell Open an Alpine package build shell in Docker
|
|
apk:smoke Install-test built packages from the local repository in Docker
|
|
apk:test-install Test README installation instructions in a fresh Alpine container
|
|
apk:test-shell Open an Alpine shell with the local APK repository configured
|
|
apk:update-generated Refresh packaged upstream examples and shell completions
|
|
apk:runtime-test Run package-local Docker runtime tests against the local...
|
|
gitea-workflow-build Run the Gitea build workflow locally through act as a pull_request event
|
|
```
|
|
|
|
`apk:build` targets `x86_64` by default. Multi-arch builds target `x86_64` and
|
|
`aarch64`:
|
|
|
|
```sh
|
|
ALPINE_ARCHES="x86_64 aarch64" mise run apk:build-all
|
|
```
|
|
|
|
Limit package selection with `ALPINE_PACKAGE` or `ALPINE_PACKAGES`:
|
|
|
|
```sh
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:build
|
|
ALPINE_PACKAGES="seaweedfs other-package" mise run apk:build-all
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:test-install
|
|
ALPINE_PACKAGE=greptimedb mise run apk:checksum
|
|
ALPINE_PACKAGE=greptimedb mise run apk:build
|
|
ALPINE_PACKAGE=greptimedb SKIP_BUILD=1 mise run apk:test-install
|
|
ALPINE_PACKAGE=lavinmq mise run apk:build
|
|
ALPINE_PACKAGE=lavinmq SKIP_BUILD=1 mise run apk:test-install
|
|
ALPINE_PACKAGE=gitea mise run apk:build
|
|
ALPINE_PACKAGE=gitea SKIP_BUILD=1 mise run apk:test-install
|
|
```
|
|
|
|
Override Docker cache scope:
|
|
|
|
```sh
|
|
ALPINE_APK_CACHE_SCOPE=public-alpine-packages ALPINE_PACKAGE=greptimedb mise run apk:build
|
|
ALPINE_APK_CACHE_PREFIX=alpine-apk-ci ALPINE_PACKAGE=greptimedb mise run apk:build
|
|
```
|
|
|
|
Local packages use `local` as the default package metadata identity. Override it
|
|
when needed:
|
|
|
|
```sh
|
|
PACKAGER="Example Builder <builder@example.com>" ALPINE_PACKAGE=seaweedfs mise run apk:build
|
|
```
|
|
|
|
Open an Alpine package build shell:
|
|
|
|
```sh
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:shell
|
|
```
|
|
|
|
Run the install test:
|
|
|
|
```sh
|
|
mise run apk:test-install
|
|
```
|
|
|
|
Reuse existing local packages:
|
|
|
|
```sh
|
|
SKIP_BUILD=1 mise run apk:test-install
|
|
SKIP_BUILD=1 mise run apk:test-shell
|
|
```
|
|
|
|
`apk:test-shell` opens an Alpine shell with the local APK repository configured.
|
|
Install whichever built packages you want inside the container:
|
|
|
|
```sh
|
|
apk add seaweedfs seaweedfs-master-openrc
|
|
weed version
|
|
|
|
apk add greptimedb greptimedb-docs greptimedb-standalone-openrc
|
|
greptime --version
|
|
|
|
apk add rclone-openrc
|
|
rclone version
|
|
```
|
|
|
|
Run package-local runtime tests:
|
|
|
|
```sh
|
|
mise run apk:runtime-test
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:runtime-test
|
|
ALPINE_VERSION=3.24 mise run apk:runtime-test
|
|
```
|
|
|
|
### Adding Packages
|
|
|
|
Package path:
|
|
|
|
```text
|
|
packaging/alpine/local/<pkgname>/
|
|
```
|
|
|
|
Optional package hooks:
|
|
|
|
```text
|
|
packaging/alpine/local/<pkgname>/scripts/test-install.sh
|
|
packaging/alpine/local/<pkgname>/scripts/update-generated-sources.sh
|
|
packaging/alpine/local/<pkgname>/scripts/runtime-test.sh
|
|
```
|
|
|
|
Start from the blueprint:
|
|
|
|
```text
|
|
packaging/alpine/blueprint/
|
|
```
|
|
|
|
### Generated Package Sources
|
|
|
|
Generated package sources live next to the package `APKBUILD`:
|
|
|
|
```text
|
|
packaging/alpine/local/seaweedfs/example-*.toml
|
|
packaging/alpine/local/seaweedfs/weed.bash-completion
|
|
```
|
|
|
|
Refresh generated sources:
|
|
|
|
```sh
|
|
mise run apk:update-generated
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:update-generated
|
|
mise run apk:checksum
|
|
```
|
|
|
|
### Upstream Update Visibility
|
|
|
|
Check whether packaged upstream versions are current:
|
|
|
|
```sh
|
|
mise run apk:outdated
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:outdated
|
|
```
|
|
|
|
By default this is a warning-only signal. To make outdated or unknown package
|
|
versions fail the command:
|
|
|
|
```sh
|
|
APK_UPDATE_CHECK_MODE=fail mise run apk:outdated
|
|
```
|
|
|
|
When an update is available, the command also lists compact release-note
|
|
summaries for every release between the packaged and latest versions.
|
|
|
|
### Security Reports and Roadmap
|
|
|
|
The [project review and development roadmap](docs/project-review.md) tracks
|
|
release-reliability goals. Generate advisory Trivy and CycloneDX reports for
|
|
built packages with:
|
|
|
|
```sh
|
|
ALPINE_PACKAGE=seaweedfs mise run apk:security-report
|
|
```
|
|
|
|
Reports are written to `packages/security-reports/` and are uploaded by CI for
|
|
each selected package build. Local runs scan the newest compatible package set
|
|
available in the signed local repository.
|
|
|
|
### Gitea Workflow
|
|
|
|
The smoke test installs rebuilt artifacts from the local repository and uses
|
|
the published registry as a fallback for unchanged packages.
|
|
|
|
Repository variables:
|
|
|
|
```text
|
|
INSTANCE_URL=https://code.factoring.digital
|
|
PACKAGE_OWNER=public
|
|
PACKAGE_NAME=alpine-packages
|
|
```
|
|
|
|
Repository secrets:
|
|
|
|
```text
|
|
PACKAGE_USER=<gitea package publisher>
|
|
PACKAGE_TOKEN=<token with package write access>
|
|
```
|
|
|
|
Check the workflow locally:
|
|
|
|
```sh
|
|
mise run gitea-workflow-build
|
|
```
|
|
|
|
Publish local packages:
|
|
|
|
```sh
|
|
INSTANCE_URL=https://code.factoring.digital \
|
|
PACKAGE_OWNER=public \
|
|
PACKAGE_NAME=alpine-packages \
|
|
PACKAGE_USER=... \
|
|
PACKAGE_TOKEN=... \
|
|
mise run apk:publish-gitea
|
|
```
|
|
|
|
### Checklist
|
|
|
|
Before opening a PR, run:
|
|
|
|
```sh
|
|
mise run apk:publish-check
|
|
mise run gitea-workflow-build
|
|
mise run apk:test-install
|
|
mise run apk:runtime-test
|
|
```
|
|
|
|
Then test at least one installed role in the package shell:
|
|
|
|
```sh
|
|
mise run apk:test-shell
|
|
apk add seaweedfs seaweedfs-master-openrc
|
|
rc-service seaweedfs.master start
|
|
weed version
|
|
```
|