#Working with Alpine

CodeScoring.Save supports Alpine (APK) repositories compatible with the standard apk client:

• proxy repository — a caching mirror of an external APK repository;
• hosted repository — storage for your own .apk packages with automatic APKINDEX.tar.gz updates.

#Creating a Repository

In the web UI, open a project, click Create repository, and select Format: Alpine / APK and Type: Proxy or Hosted. Common fields are described in Repository Management.

#Proxy Repository

Set Proxy URL to the mirror address, for example https://dl-cdn.alpinelinux.org/alpine. Set Cache TTL, seconds to the metadata cache refresh interval.

Create through the API:

curl -X POST https://save.example.com/api/v1/repos \
  -H "Content-Type: application/json" \
  -u "<username>:<password>" \
  -d '{
    "project": "infra",
    "name": "apk-proxy",
    "format": "apk",
    "repository_type": "proxy",
    "remote_url": "https://dl-cdn.alpinelinux.org/alpine",
    "cache_ttl": 3600
  }'

#Hosted Repository

curl -X POST https://save.example.com/api/v1/repos \
  -H "Content-Type: application/json" \
  -u "<username>:<password>" \
  -d '{
    "project": "infra",
    "name": "apk-hosted",
    "format": "apk",
    "repository_type": "hosted"
  }'

#Client Configuration

Add Save URLs to /etc/apk/repositories, specifying the Alpine branch and component:

https://<username>:<password>@save.example.com/cs-save/apk/<project>/apk-proxy/v3.24/main
https://<username>:<password>@save.example.com/cs-save/apk/<project>/apk-proxy/v3.24/community

apk update
apk add curl

Replace v3.24 with your system's branch. The client appends the architecture (x86_64, aarch64, etc.) to the URL automatically. To route all downloads through Save, replace the original mirror URLs in /etc/apk/repositories.

If Proxy URL already includes a branch or component, do not repeat them in the client URL. For example, with upstream https://dl-cdn.alpinelinux.org/alpine/v3.24/main, the repository line ends at /apk-proxy.

#Trusting the Repository Key

Proxy. Save preserves upstream signatures: the official Alpine mirror uses the standard keys from the alpine-keys package.

Hosted. If metadata signing is enabled on the server (METADATA_SIGNING_ENABLED), download the repository's public key before connecting:

curl -fsSLOJ -u "<username>:<password>" \
  --output-dir /etc/apk/keys \
  "https://save.example.com/cs-save/apk/<project>/apk-hosted/repository.rsa.pub"

Keep the filename returned by the server: apk locates the key by that name. A ready-to-use command is also available under Useful snippets on the repository page. For an unsigned hosted repository, use apk update --allow-untrusted and apk add --allow-untrusted <package>.

#Publishing Packages to a Hosted Repository

Upload a package at <branch>/<component>/<architecture>/<name>-<version>.apk:

curl -u "<username>:<password>" \
  -T hello-1.0-r0.apk \
  "https://save.example.com/cs-save/apk/<project>/apk-hosted/v3.24/main/x86_64/hello-1.0-r0.apk"

Save reads the name and version from the package. The filename and architecture in the path must match the package metadata. Upload noarch packages to concrete architecture directories, such as x86_64 and aarch64, separately for each required architecture. Uploading to the same path again returns 409.

The index updates automatically within a few seconds. Add /apk-hosted/v3.24/main to /etc/apk/repositories, configure trust in the key, and run:

apk update
apk add hello

#Troubleshooting

Check index availability for the required branch, component, and architecture:

curl -f -u "<username>:<password>" \
  -o APKINDEX.tar.gz \
  "https://save.example.com/cs-save/apk/<project>/apk-hosted/v3.24/main/x86_64/APKINDEX.tar.gz"

If the client cannot see the package yet, wait for the index update and run apk update again. For trust errors, check that the repository key is installed in /etc/apk/keys under its original filename.