45 lines
2.0 KiB
Markdown
45 lines
2.0 KiB
Markdown
# Project Review and Development Roadmap
|
|
|
|
## Current State
|
|
|
|
This repository packages four upstream services for Alpine 3.24, with source
|
|
builds, binary repackages, OpenRC integration, Docker-based local builds, and
|
|
CI publication to the Gitea Alpine registry. Package selection avoids rebuilding
|
|
unchanged versions already present in the registry.
|
|
|
|
The main release risks are missing retained build artifacts, permissive duplicate
|
|
publish handling, rolling toolchain inputs, and limited end-to-end service
|
|
validation. Documentation and test defaults must remain synchronized with each
|
|
`APKBUILD` version.
|
|
|
|
## Prioritized Goals
|
|
|
|
1. **Reproducible, auditable releases.** Split build and publish work so publish
|
|
consumes a retained APK artifact plus a checksum manifest; verify registry
|
|
contents after upload and reject mismatched duplicate versions.
|
|
2. **Build security visibility.** Generate an installed-rootfs CycloneDX SBOM
|
|
and advisory Trivy report for every package and architecture selected by CI.
|
|
Retain reports as Gitea workflow artifacts.
|
|
3. **Service-level confidence.** Add bounded readiness checks for Gitea,
|
|
LavinMQ, and GreptimeDB; retain SeaweedFS role startup coverage.
|
|
4. **Automation correctness.** Add fixture-based tests for package selection,
|
|
APKINDEX parsing, metadata/version drift, and registry error paths.
|
|
5. **Developer feedback and cost.** Record build durations/cache outcomes,
|
|
keep package-scoped validation, and add a scheduled update-report workflow.
|
|
|
|
## Security Reports
|
|
|
|
`mise run apk:security-report` scans the installed root filesystem for each
|
|
selected local package. It writes advisory reports under:
|
|
|
|
```text
|
|
packages/security-reports/<package>/<architecture>/
|
|
├── trivy.json
|
|
├── sbom.cdx.json
|
|
└── summary.md
|
|
```
|
|
|
|
The scan includes the package, its selected subpackages, and resolved runtime
|
|
dependencies from the signed local repository. Findings do not block a build yet; report generation,
|
|
package installation, and report validation do.
|