Building APK packages for Alpine Linux (abuild)
-
- Offline
- 1 year 9 months ago
- 2015-12-18
Hello all, Alpine is awesome.
Alpine is an amazing project, and super important for Docker and micro-services.
We are working on a tool-set to build Alpine APK packages, so one could host any odd packages that anyone might need.
So far we had success building individual packages, signing the indexes, pushing the packages to our Amazon AWS s3 repo, baking-in the public keys for the repo in to alpine, and installing the packages without any issues.
Since then, we created a more automated way of building packages with jenkins + docker.
Now, we are having some unexpected signature/key verification issues when trying to install a package that was built with these tools, and I hope some one here can help me.
The output from abuild suggests that the packages are correctly signed.
There are no conflicts from apk update
about invalid keys.
But when I attempt to install the package from our repo apk add nginx@ourrepo
, apk complains that we have have a bad signature:
/ # apk add nginx@ourrepo (1/2) Installing pcre (8.37-r1) (2/2) Installing nginx@ourrepo (1.9.7-r0) ERROR: nginx-1.9.7-r0: BAD signature 1 errors; 30 MiB in 20 packages
I have some questions about the signing and how ABUILD works in general:
1) Does the filename of the public key in /etc/apk/keys
matter? Is the filename parse in any way?
2) Does the PACKAGER="yourname@aol.com"
in /etc/abuild.conf
matter (at time of signing)? Is there a comparison/check of the PACKAGER value in abuild.conf with the name you enter when generating the key pair? docker run --name keys --entrypoint abuild-keygen -e PACKAGER="Your Name <yourname@aol.com>" andyshinn/alpine-abuild -n
3) Is there a way to check, verify what apk expects to be the correct signer for the public key?
Any help is much appreciated!!
Project that does the APK building:
https://github.com/madedotcom/alpine-jazz-hands
So, it appears that we had several silly mistakes.
I was syncing the APK index and packages to S3 with s3cmd, but it only sent files that are new, and it didn't care that content of files was different.
I also made sure that the
PACKAGER="Your Name <yourname@aol.com>"
info is exactly the same in/etc/abuild.conf
as what was used to generate the keys.Everything works!!
Very like Alpine community. If we look any topic on this forum, what do we see?
First message - guy praises the Alpine and explains problem he have and ask any help.
Few hours...
Second message - guy solve this problem by himself and explain how he do this and happy.
We should call this "Alpine-way"
Alpine is remarkably functional and rather well tooled out.
I think that the closer to the metal that you get (compiling and building your own packages), the better your understanding of how things work.
Hi,
Egidijus I don't see any references to Jenkins in provided repository. Can you please provided us a way to supervise Alpine packages build with Jenkins?
Thanks.
Thinking of introducing this to my team (20four7va) and do some upgrade in our system. Want to learn more about it.