build: allow custom apk repositories maintaining the existing api

[a-gave]

With opkg the fingerprints of keys for additional repositories, were calculated from the key itself.

With apk use the placeholder names 'asu-client-0.pem', 'asu-client-1.pem', with key indexes, to keep the api unchanged.

[codecov]

Codecov Report

❌ Patch coverage is 4.34783% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.94%. Comparing base (5e65dec) to head (6a1aa72).
⚠️ Report is 363 commits behind head on main.

Files with missing lines	Patch %	Lines
asu/build.py	0.00%	17 Missing ⚠️
asu/util.py	16.66%	5 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1589       +/-   ##
===========================================
+ Coverage   80.75%   90.94%   +10.18%     
===========================================
  Files          15       16        +1     
  Lines         977     1755      +778     
===========================================
+ Hits          789     1596      +807     
+ Misses        188      159       -29     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[efahl]

Oh, excellent timing! I was just looking into fixing this for apk on Saturday, you saved me the effort. (I dealt with a forum post sometime in the last couple weeks with someone trying to add extra feeds for 25.12 on their local server.)

I'll give it some testing and report back...

[efahl]

So what do your actual APK feeds look like? Do they have an apk v3 APKINDEX.tar.gz or Packages.adb index? Where are the public repo keys stored, right in the feed itself?

I'm curious because OpenWrt is using subtly non-standard packages.adb (lower case 'p' should be 'Packages.adb' per https://man.archlinux.org/man/apk-repositories.5.en), and the feeds file lists them explicitly, thus overriding the search mechanism.

$ cat /etc/apk/repositories.d/distfeeds.list
https://downloads.openwrt.org/snapshots/targets/x86/64/packages/packages.adb

Whereas on my Alpine laptop running apk-tools v3, they are using the directory search (and the index is a v2 APKINDEX.tar.gz).

$ cat /etc/apk/repositories
#/media/dm-0/apks
http://mirrors.ocf.berkeley.edu/alpine/v3.23/main
http://mirrors.ocf.berkeley.edu/alpine/v3.23/community
...

And there's Chimera, which has both v2 and v3 indexes: https://repo.chimera-linux.org/current/main/x86_64/.

[a-gave]

So what do your actual APK feeds look like? Do they have an apk v3 APKINDEX.tar.gz or Packages.adb index? Where are the public repo keys stored, right in the feed itself?

I'm using https://github.com/openwrt/gh-action-sdk to produce them.
https://github.com/libremesh/lime-feed/tree/gh-pages/master/openwrt-25.12/x86_64
and an equal fork with some development code of mine https://github.com/a-gave/lime-feed/tree/gh-pages/master/openwrt-25.12/x86_64

The index is the file packages.adb.
Keys are added in /etc/apk/keys/ by a main package via an uci-defaults script

[efahl]

The following is more for my own benefit, to document and explain what's needed to use "extra package feeds".

---

In .env add the prefixes of the extra package feeds.

asu-host$ cat .env
REPOSITORY_ALLOW_LIST=[ "https://extra.feeds.net/packages/" ]

Now in order to use packages from that feed site, you add repositories and repository_keys to the request, containing the path to the package index and the public key used to sign the index (or packages), respectively. These need not correspond pairwise, you could specify a single key that signed multiple feeds (that's what is done on the official OpenWrt package feeds), you simply need to list all your repositories and any keys used to sign them in any order.

{
  "target": "x86/64",
  "profile": "generic",
  "repositories": [ ""https://extra.feeds.net/packages/x86/64/extra/packages.adb" ],
  "repository_keys": [ "blah blah..." ],
  "packages_versions": {
    "openssh-sftp-server": "9.9_p2-r1",

Notes:
With a feed configuration (i.e., repositories entry) that just has a directory, apk assumes v2 indexes and fails to find an index:

$ cat /etc/apk/repositories.d/distfeeds.list
https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/

$ apk update
ERROR: wget: exited with error 8
WARNING: updating and opening https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/APKINDEX.tar.gz: unexpected end of file

THIS IS UNUSED BY ASU BUT MENTIONED FOR COMPLETENESS. If we use explicit v3 search, with the proper prefix in the feeds, apk attempts to download Packages.adb and again fails.

$ cat /etc/apk/repositories.d/distfeeds.list
v3 https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/

$ apk update
ERROR: wget: exited with error 8
WARNING: updating and opening https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/Packages.adb: unexpected end of file

But, if we eliminate the search with explicit file naming, apk finds the file and everything is fine.

$ cat /etc/apk/repositories.d/distfeeds.list
v3 https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/packages.adb

$ apk update
 [https://downloads.openwrt.org/snapshots/packages/x86_64/video/x86_64/packages.adb]
OK: 335 distinct packages available

This means that you can use either a directory in your repositories request, which must be paired with a feed containing Packages.adb (explicitly upper case P), or any arbitrary index file name (thus allowing use of OpenWrt's convention of packages.adb).

[a-gave]

obsolete due to #1602