Usage APK

Usage: Alpine APK

Publishing

silo publish ./hello-1.0-r0.apk --repo myrepo --channel edge

The format is inferred from the file extension; pass --format apk to be explicit. Publishing is gRPC/CLI-only — there is no HTTP publish path for apk.

Consuming — private repo (auth enabled)

apk can't send auth headers, so the token has to be embedded in the URL itself:

echo "http://silo:TOKEN@silo.internal:8080/myrepo/edge/apk" \
  >> /etc/apk/repositories

apk appends /$arch/APKINDEX.tar.gz itself, so the entry stops at .../apk — naming the architecture here would double it. Replace TOKEN with a token that has at least read permission scoped to myrepo.

Consuming — public repo (no auth)

Once the repo is public (silo repo set myrepo --mode=public, see Usage), drop the embedded credential:

echo "http://silo.internal:8080/myrepo/edge/apk" >> /etc/apk/repositories

Publishing still requires a write-scoped token regardless of repo mode.

noarch packages

apk-tools only ever fetches $repo/$hostarch/APKINDEX.tar.gz and never looks in a noarch directory of its own accord, so silo answers for noarch content under whichever architecture asks: every architecture's index lists the channel's noarch packages, and the package file itself is stored once rather than copied into every prefix. No special client configuration is needed.

Signing

If the server has signing.apk configured (see Setup), the index is signed with RSA PKCS#1 v1.5 over SHA-1, prepending the .SIGN.RSA.<key_name> member apk-tools expects. Deploy the matching public key on the client under /etc/apk/keys/<key_name> (the same key_name set in the server's signing.apk config).

Without signing.apk configured, apk needs --allow-untrusted — apk-tools will not use an unsigned index and cannot be talked out of requiring one otherwise.

Silo only ever signs the index, never the .apk file itself. Whatever bytes you silo publish are stored and served byte-for-byte — silo doesn't parse out or add a .SIGN.RSA member on the package. This is fine for the normal case: a client installing from a configured repo trusts the package because its checksum is listed in the signed APKINDEX, not because the file carries its own signature. If you specifically need an individually-signed .apk (e.g. to apk add ./foo.apk standalone, outside any repo), sign it yourself with abuild-sign before publishing — and use the same RSA key as the server's signing.apk, so clients only ever need to trust one public key under /etc/apk/keys instead of two.