Installation using apk package fails under Alpine

[geissebn]

What are the steps to reproduce this issue?

1. Start new Alpine instance (docker run -it alpine:latest)
2. Follow installation guide at https://git-secret.io/installation#alpine-systems--apk-package

What happens?

apk add --update --no-cache git-secret fails with

WARNING: Ignoring https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main: package file format error
ERROR: unable to select packages:
  git-secret (no such package):
    required by: world[git-secret]

What were you expecting to happen?

git-secret should install

Any logs, error output, etc?

Complete shell output:

/ # sh -c "echo 'https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main'" >> /etc/apk/repositor
ies
/ # wget -O /etc/apk/keys/git-secret-apk.rsa.pub 'https://gitsecret.jfrog.io/artifactory/api/security/k
eypair/public/repositories/git-secret-apk'
Connecting to gitsecret.jfrog.io (20.101.176.184:443)
saving to '/etc/apk/keys/git-secret-apk.rsa.pub'
git-secret-apk.rsa.p 100% |*******************************************************|   450  0:00:00 ETA
'/etc/apk/keys/git-secret-apk.rsa.pub' saved
/ # apk add --update --no-cache git-secret
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
fetch https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main/x86_64/APKINDEX.tar.gz
WARNING: Ignoring https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main: package file format error
ERROR: unable to select packages:
  git-secret (no such package):
    required by: world[git-secret]

Any other comments?

The JFrog repo seems to be broken. https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main redirects to a login mask

What versions of software are you using?

Operating system: (uname -a) Linux 47766af9ef90 5.10.104-linuxkit #1 SMP Wed Mar 9 19:05:23 UTC 2022 x86_64 Linux

[sobolevn]

JFrog 🤦

[geissebn]

Well, how can we mitigate this issue?

[sobolevn]

The only thing I can recommend for now: use source installation.
I am trying to fix JFrog right now.

[sobolevn]

Or try direct download: https://gitsecret.jfrog.io/artifactory/git-secret-apk/all/main/x86_64/git-secret-0.4.0.apk

[sobolevn]

Hm, this is strange. Looks like we have a different problem:

• Our release CI works for Alpine15: https://github.com/sobolevn/git-secret/actions/runs/2419777805
• Update to Alpine16 fails with the same error you have: Bump alpine from 3.15.4 to 3.16.0 in /.ci/release-ci/alpine #876

So, maybe something is change in 15 -> 16 alpine migration?

[sobolevn]

@joshrabinowitz I think we can try to release 0.5.0 on new alpine releaser.
It might solve this problem 🤔

[joshrabinowitz]

@sobolevn I approve. Can you perform the release?

[sobolevn]

Yes, on 2.06 🎉

[joshrabinowitz]

On 2.06 of what @sobolevn

[joshrabinowitz]

Should we be filing an issue with jfrog? It seems this is a jfrog issue; can anyone confirm or deny

[sobolevn]

On 5.06 😞
Don't have any time this week.

[sobolevn]

New release (0.5.0) is published.
Direct .apk link: https://gitsecret.jfrog.io/artifactory/git-secret-apk/latest-stable/main/x86_64/git-secret-0.5.0.apk

[sobolevn]

But, it seems that our CI still fails for Alpine 3.16: https://github.com/sobolevn/git-secret/runs/6743924484?check_suite_focus=true#step:3:70

[sobolevn]

I will contact JFrog, maybe there's something they can do on their side 😞

[joshrabinowitz]

Any movement on this? I propose we reach out to alpine (or jfrog?) experts for advice about what is going wrong with alpine builds.
See also #881

[sobolevn]

They literally said: Alpine is bad, do not support it 😢
Imagine my face at that moment.

[joshrabinowitz]

they being JFrog?

[sobolevn]

Yeap, support chat

[sobolevn]

https://www.jfrog.com/confluence/display/JFROG/Known+Issues#KnownIssues-ExistingKnownIssues

[joshrabinowitz]

@sobolevn is there a particular issue are you referring to there?

[joshrabinowitz]

This is also basically a dup/regression of #801 and #802

[rvanbutselaar]

Any updates on this, or should we move to Debian / Red Hat based Docker images?

[sobolevn]

It does not work :(
https://github.com/sobolevn/git-secret/runs/7047920383?check_suite_focus=true
There's nothing I can do (except finding new Alpine repo host).

[joshrabinowitz]

we recommend you move to source-based installations for Alpine until this is resolved
Edit: You can install 0.5.0 from source using:

git clone -b v0.5.0 https://github.com/sobolevn/git-secret.git git-secret && \
    cd git-secret && make build && \
    PREFIX="/usr/local" make install