This is unwanted information disclosure.

Reported-by: Max Justicz <max@justi.cz>

Most applets return whatever apk_solver_commit() returns. It is the
number of errors found (or negative for hard error). Sanitize the
error value to not give false success exit code in the unlikely case
of errors % 256 == 0.

Reported-by: Max Justicz <max@justi.cz>

We should not update repository index when --no-network is specified.

ref #9126

ref #9063

Jussi Kukkonen authored 6 years ago and Ariadne Conill committed 6 years ago

It's common for a pre-install script to do something like
    addgroup -S group 2>/dev/null
When apk installs files after this, it sets the owner/group based on id cache
but currently the id cache is stale and doesn't contain the new group at that
point: instead the file will be installed with gid that the build host
happened to have for that group -- on target this might mean a non-existing
group or a completely different group.

We can't know if the script really did modify id cache contents so make sure
to reset the id cache on every script execution.

Sören Tempel authored 6 years ago and Ariadne Conill committed 6 years ago

Virtual packages have the origin pointer set to NULL. Trying to print it
using the BLOB_PRINTF macros causes a segmentation fault.

Inspired by the `print_origin_name` function from `src/search.c` this
commit attempts to fix it by checking whether `pkg->origin` is NULL
before attempting to print it. If it is NULL the pkg name is printed
instead.

Since printing the pkg name requires a different format string this
commit splits the printf call for printing the package line into
multiple ones. The output format shouldn't have changed at all though.

Natanael Copa authored 6 years ago and Timo Teräs committed 6 years ago

Run apk_solver_solve once with all args as dependencies instead of
running apk_solver_solve for each arg. This is neccesary so the
install_if calculation is done correctly.

During netboot on systems without RTC, time() will be near zero,
and the index fill not exist. Thus the plain test of st.st_mtime
against system time failed. Verify that fstatat() succeeds.

TLS_client_method is a LibreSSL extension.
SSLv23_client_method is generic, and doesn't mean SSL v2/v3 only.

list: use `apk list --providers` to search virtual providers instead of enabling virtuals by default

list does everything search does and more

The list applet provides a convenient way of inspecting both the available
and installed package databases by listing their contents.  In some ways,
it is similar to `apk search` but is considered to be a superset of
`apk search` functionality.

A few `apk list` criterion are not yet ready though, such as `apk list --depends`
which searches by runtime dependency (replacing `apk info --rdepends`).

Internally the value is in seconds, but on command line it's in
minutes.

This modifies apk cache for indexes to be automatically refreshed
periodically without explicit 'update' or '--update-cache' usage.

The default is to do if-modified-since request if the local copy
is older than 4 hours. This age can be changed with --cache-max-age.
Using --update-cache will change this age to 60 seconds to make
sure the cached copy is relatively new. The small age is in order
to try to avoid downloading indexes second time when apk-tools is
upgraded and apk re-execs after self-upgrade.

Accordingly using explicitly 'apk update' will now enforce
--force-refresh and request the very latest index by requesting
any potential http proxy to do refresh too.

fixes #8161

This unloads --force as several of the things are really not wanted
together. E.g. --force-refresh is a lot different from --force-broken-world
and doing --force to get the other might introduce unwanted behaviour.

--force is still kept for backwards compatibility and it enables
most things --force was used for.

ref #8161

Henrik Riomar authored 7 years ago and Timo Teräs committed 7 years ago

This flag enables a group of options used during initramfs tmpfs
initial install.

Henrik Riomar authored 7 years ago and Timo Teräs committed 7 years ago

This flag skips running hook scripts

This flag *must* be used during initramfs tmpfs initial install.
The reason that this new flag is needed is that the hooks will currently
always fail as musl and /bin/sh is missing at this stage on diskless.