Alpine

Relic generates and signs an APKINDEX.tar.gz for each folder. Lay packages out as Alpine's mirrors do: <version>/<repository>/<architecture>/, such as v3.21/main/x86_64/.

Upload a package to a local repository:

relic artifact upload hello-1.0-r0.apk alpine-local/v3.21/main/x86_64/hello-1.0-r0.apk

As root, this command adds the repository, with your token, and its public key to apk:

relic package setup apk alpine --branch v3.21 --write

It adds the branch's main repository; --alpine-repositories "main community" names others.

To configure apk by hand, save the public key, served on the JFrog® Artifactory® API. Name the file after the key pair (relic-rsa unless the repository sets signingKey):

curl -fsSL -u <you>:<token> -o /etc/apk/keys/relic-rsa.rsa.pub https://relic.example.com/artifactory/api/security/keypair/public/repositories/alpine

Add the repository to /etc/apk/repositories:

https://<you>:<token>@relic.example.com/alpine/alpine/v3.21/main

Update the indexes:

apk update

Install a package:

apk add hello

• signingKey names the RSA key pair that signs the indexes, created on first use; it cannot sign RPM or Debian repositories. The default is relic-rsa. secondarySigningKey also signs, so the key can be replaced: apk accepts indexes signed by both with either key, and relic package setup apk run again writes both public keys to /etc/apk/keys (Signing keys).
• A remote, such as https://dl-cdn.alpinelinux.org/alpine, serves the upstream's signed indexes unchanged; apk checks them with Alpine's keys.
• A virtual repository merges and signs its members' indexes.
• A noarch package is listed under its folder's architecture.
• Through the JFrog Artifactory API, primaryKeyPairRef is the signing key and secondaryKeyPairRef the secondary signing key; jf apk upload puts a package in its folder.