Usage APK

Usage: Alpine APK

Publishing

silo publish ./hello-1.0-r0.apk --repo myrepo --channel edge

The format is inferred from the file extension; pass --format apk to be explicit. Publishing is gRPC/CLI-only — there is no HTTP publish path for apk.

Consuming — private repo (auth enabled)

apk can't send auth headers, so the token has to be embedded in the URL itself:

echo "http://silo:TOKEN@silo.internal:8080/myrepo/edge/apk" \
  >> /etc/apk/repositories

apk appends /$arch/APKINDEX.tar.gz itself, so the entry stops at .../apk — naming the architecture here would double it. Replace TOKEN with a token that has at least read permission scoped to myrepo.

Consuming — public repo (no auth)

Once the repo is public (silo repo set myrepo --mode=public, see Usage), drop the embedded credential:

echo "http://silo.internal:8080/myrepo/edge/apk" >> /etc/apk/repositories

Publishing still requires a write-scoped token regardless of repo mode.

noarch packages

apk-tools only ever fetches $repo/$hostarch/APKINDEX.tar.gz and never looks in a noarch directory of its own accord, so silo answers for noarch content under whichever architecture asks: every architecture's index lists the channel's noarch packages, and the package file itself is stored once rather than copied into every prefix. No special client configuration is needed.

Signing

If the server has signing.apk configured (see Setup), the index is signed with RSA PKCS#1 v1.5 over SHA-1, prepending the .SIGN.RSA.<key_name> member apk-tools expects. Deploy the matching public key on the client under /etc/apk/keys/<key_name> (the same key_name set in the server's signing.apk config).

Without signing.apk configured, apk needs --allow-untrusted — apk-tools will not use an unsigned index and cannot be talked out of requiring one otherwise.