Building APK packages for Alpine Linux (abuild)

6 posts / 0 new
Last post
#1 Sat, 2015-12-19 10:31
Egidijus
  • Egidijus's picture
  • Offline
  • Last seen: 1 year 9 months ago
  • Joined: 2015-12-18

Hello all, Alpine is awesome.
Alpine is an amazing project, and super important for Docker and micro-services.

We are working on a tool-set to build Alpine APK packages, so one could host any odd packages that anyone might need.

So far we had success building individual packages, signing the indexes, pushing the packages to our Amazon AWS s3 repo, baking-in the public keys for the repo in to alpine, and installing the packages without any issues.

Since then, we created a more automated way of building packages with jenkins + docker.
Now, we are having some unexpected signature/key verification issues when trying to install a package that was built with these tools, and I hope some one here can help me.

The output from abuild suggests that the packages are correctly signed.
There are no conflicts from  apk update about invalid keys.
But when I attempt to install the package from our repo  apk add nginx@ourrepo  , apk complains that we have have a bad signature:

/ # apk add nginx@ourrepo
(1/2) Installing pcre (8.37-r1)
(2/2) Installing nginx@ourrepo (1.9.7-r0)
ERROR: nginx-1.9.7-r0: BAD signature
1 errors; 30 MiB in 20 packages

I have some questions about the signing and how ABUILD works in general:

1) Does the filename of the public key in  /etc/apk/keys   matter? Is the filename parse in any way?
2) Does the  PACKAGER="yourname@aol.com" in  /etc/abuild.conf matter (at time of signing)? Is there a comparison/check of the PACKAGER value in abuild.conf with the name you enter when generating the key pair?  docker run --name keys --entrypoint abuild-keygen -e PACKAGER="Your Name <yourname@aol.com>" andyshinn/alpine-abuild -n
3) Is there a way to check, verify what apk expects to be the correct signer for the public key?

Any help is much appreciated!!

Project that does the APK building:
https://github.com/madedotcom/alpine-jazz-hands

Mon, 2015-12-21 13:07
Egidijus
  • Egidijus's picture
  • Offline
  • Last seen: 1 year 9 months ago
  • Joined: 2015-12-18

So, it appears that we had several silly mistakes.
I was syncing the APK index and packages to S3 with s3cmd, but it only sent files that are new, and it didn't care that content of files was different.
I also made sure that the  PACKAGER="Your Name <yourname@aol.com>" info is exactly the same in  /etc/abuild.conf as what was used to generate the keys.

Everything works!!

Wed, 2015-12-23 07:31
deromanenko
  • deromanenko's picture
  • Offline
  • Last seen: 2 years 1 month ago
  • Joined: 2015-12-21

Very like Alpine community. If we look any topic on this forum, what do we see?

First message - guy praises the Alpine and explains problem he have and ask any help.
Few hours...
Second message - guy solve this problem by himself and explain how he do this and happy.

We should call this "Alpine-way"

Sat, 2016-01-09 10:50
Egidijus
  • Egidijus's picture
  • Offline
  • Last seen: 1 year 9 months ago
  • Joined: 2015-12-18

Alpine is remarkably functional and rather well tooled out.
I think that the closer to the metal that you get (compiling and building your own packages), the better your understanding of how things work.

Wed, 2016-07-06 11:32
kyvaith
  • kyvaith's picture
  • Offline
  • Last seen: 1 year 8 months ago
  • Joined: 2016-07-05

Hi,

Egidijus I don't see any references to Jenkins in provided repository. Can you please provided us a way to supervise Alpine packages build with Jenkins?

Thanks.

Tue, 2017-02-07 15:34
johnmiller
  • johnmiller's picture
  • Offline
  • Last seen: 1 year 1 month ago
  • Joined: 2017-02-07

Thinking of introducing this to my team (20four7va) and do some upgrade in our system. Want to learn more about it.

Log in or register to post comments